Bug 25851

Summary: [patch] security hole in anonymous FTP setup script
Product: Base System Reporter: tedm <tedm>
Component: binAssignee: Ceri Davies <ceri>
Status: Closed FIXED    
Severity: Affects Only Me    
Priority: Normal    
Version: Unspecified   
Hardware: Any   
OS: Any   

Description tedm 2001-03-16 11:10:01 UTC 
If /stand/sysinstall is run AFTER users are added to the system,
and used to setup anonymous FTP, as part of it's setup routine
it copies the system /etc/group to /var/ftp/etc.  The problem is
that by then the system's /etc/group file has been populated with
the userID's of local users that are in the "wheel" group.

This allows an anonymous user to obtain a list of all users on
the system who are authorized to su to the root user.  It may also
give an attacker a list of all userID's on the sytem, depending on
how many userID's are in the system /etc/group file by then.  This
represents an unnecessary release of information to a remote attacker.

Fix: 

I would suggest that during the setup, the anonymous
FTP setup script strip out the users listed on each one of the
group lines, as this information is not needed for operation of
anonymous FTP.  Another possibility would be to use a 
dummy group file with just the default groups in it that was
embedded in the setup script.  Even if the existing behavior was
left intact and a warning was put up this would be better than
nothing.
How-To-Repeat: Populate /etc/group with userID's in the system then run /stand/sysinstall and select Network services then select Setup Anonymous FTP.
Comment 1 Kris Kennaway freebsd_committer freebsd_triage 2001-03-24 05:45:39 UTC 
Responsible Changed
From-To: freebsd-bugs->sysinstall

jkh is Mr sysinstall
Comment 2 ru freebsd_committer freebsd_triage 2001-07-03 15:25:08 UTC 
Responsible Changed
From-To: sysinstall->jkh

Mr sysinstall is jkh
Comment 3 jkh freebsd_committer freebsd_triage 2001-08-31 01:28:41 UTC 
Responsible Changed
From-To: jkh->eric

Eric handles these now
Comment 4 Eric Melville freebsd_committer freebsd_triage 2001-10-01 19:51:56 UTC 
Responsible Changed
From-To: eric->freebsd-qa

assign idle sysinstall bugs to freebsd-qa, as suggested by murray
Comment 5 Zak Johnson 2002-06-19 16:31:41 UTC 
This patch fixes the problem by stripping the user list from each line.

--- release/sysinstall/anonFTP.c.orig	Thu Sep 27 02:38:32 2001
+++ release/sysinstall/anonFTP.c	Wed Jun 19 11:26:36 2002
@@ -298,7 +298,7 @@
 	if (DITEM_STATUS(createFtpUser()) == DITEM_SUCCESS) {
 	    msgNotify("Copying password information for anon FTP.");
 	    vsystem("awk -F: '{if ($3 < 10 || $1 == \"ftp\") print $0}' /etc/passwd > %s/etc/passwd && chmod 444 %s/etc/passwd", tconf.homedir, tconf.homedir);
-	    vsystem("awk -F: '{if ($3 < 100) print $0}' /etc/group > %s/etc/group && chmod 444 %s/etc/group", tconf.homedir, tconf.homedir);
+	    vsystem("awk -F: '!/^#/ {if ($3 < 100) printf \"%s:%s:%s:\\n\", $1, $2, $3}' /etc/group > %s/etc/group && chmod 444 %s/etc/group", tconf.homedir, tconf.homedir);
 	    vsystem("chown -R root.%s %s/pub", tconf.group, tconf.homedir);
 	}
 	else {

-Zak
Comment 6 Zak Johnson 2002-06-19 20:46:32 UTC 
Sorry, there was an error in the previous patch.

-Zak

--- anonFTP.c.orig	Thu Sep 27 02:38:32 2001
+++ anonFTP.c	Wed Jun 19 15:43:02 2002
@@ -298,7 +298,7 @@
 	if (DITEM_STATUS(createFtpUser()) == DITEM_SUCCESS) {
 	    msgNotify("Copying password information for anon FTP.");
 	    vsystem("awk -F: '{if ($3 < 10 || $1 == \"ftp\") print $0}' /etc/passwd > %s/etc/passwd && chmod 444 %s/etc/passwd", tconf.homedir, tconf.homedir);
-	    vsystem("awk -F: '{if ($3 < 100) print $0}' /etc/group > %s/etc/group && chmod 444 %s/etc/group", tconf.homedir, tconf.homedir);
+	    vsystem("awk -F: '!/^#/ {if ($3 < 100) printf \"%%s:%%s:%%s:\\n\", $1, $2, $3}' /etc/group > %s/etc/group && chmod 444 %s/etc/group", tconf.homedir, tconf.homedir);
 	    vsystem("chown -R root.%s %s/pub", tconf.group, tconf.homedir);
 	}
 	else {
Comment 7 Ceri Davies freebsd_committer freebsd_triage 2005-12-30 14:33:07 UTC 
Here is an update patch that works.


Index: anonFTP.c
===================================================================
RCS file: /home/ncvs/src/usr.sbin/sysinstall/anonFTP.c,v
retrieving revision 1.35
diff -u -r1.35 anonFTP.c
--- anonFTP.c	16 Nov 2004 19:06:42 -0000	1.35
+++ anonFTP.c	30 Dec 2005 14:31:39 -0000
@@ -299,7 +299,7 @@
 	    vsystem("awk -F: '{if ((substr($1, 1, 1) != \"+\") && (substr($1, 1, 1) != \"-\") && ($3 < 10 || $1 == \"ftp\")) print $0}' /etc/master.passwd > %s/etc/master.passwd", tconf.homedir);
 	    vsystem("/usr/sbin/pwd_mkdb -d %s/etc %s/etc/master.passwd && chmod 444 %s/etc/pwd.db", tconf.homedir, tconf.homedir, tconf.homedir);
 	    vsystem("rm -f %s/etc/master.passwd %s/etc/spwd.db", tconf.homedir, tconf.homedir);
-	    vsystem("awk -F: '{if ((substr($1, 1, 1) != \"+\") && (substr($1, 1, 1) != \"-\") && ($3 < 100)) print $0}' /etc/group > %s/etc/group && chmod 444 %s/etc/group", tconf.homedir, tconf.homedir);
+	    vsystem("awk -F: '!/^#/ {if ((substr($1, 1, 1) != \"+\") && (substr($1, 1, 1) != \"-\") && ($3 < 100)) printf \"%%s:%%s:%%s:\\n\", $1, $2, $3}' /etc/group > %s/etc/group && chmod 444 %s/etc/group", tconf.homedir, tconf.homedir);
 	    vsystem("chown -R root.%s %s/pub", tconf.group, tconf.homedir);
 	}
 	else {
Comment 8 Ceri Davies freebsd_committer freebsd_triage 2005-12-30 14:33:13 UTC 
Responsible Changed
From-To: freebsd-qa->ceri

I have an updated patch for this.
Comment 9 Ceri Davies freebsd_committer freebsd_triage 2006-01-15 22:53:44 UTC 
State Changed
From-To: open->patched

Patched in -HEAD, thanks.
Comment 10 Ceri Davies freebsd_committer freebsd_triage 2006-01-24 18:36:47 UTC 
State Changed
From-To: patched->closed

Pulled back to RELENG_5 and RELENG_6.  Thank you.