-----BEGIN PGP SIGNED MESSAGE-----
Quote:>My Linux box was broken into using a file that was sent to me. The file
>is 3295 bytes in size and is an:
>ELF 32-bit LSB dynamic lib i386 (386 and up) Version 1 file
>I was told that anon ftp might be the starting point for that attack.
The individual uploaded a hacked libc into your ftp/incoming directory.
He then exported the LD_PRELOAD path via telnet negotions. After Inetd
invoked /bin/login, (Inetd)UID=(/bin/login)EUID so the alternate library
was honored. They probably modified the call to crypt() during login to
allow automatic success.
As a fix, you could apply a wrapper around /bin/login to cleanse all
instances of unwanted environment variables before execing it. I'll
include such a wrapper (must be compiled statically):
/* This is a login wrapper that removes all instances of various
variables from the environment.
Original author: Lawrence R. Rogers
This is a modified version and is only partially based on the work
of the original author; Lawrence R. Rogers is not responsible for
this version.
NOTE: THIS PROGRAM MUST BE COMPILED STATICALLY TO BE EFFECTIVE
AGAINST EXPLOITATION. For example:
gcc -static -o login FILENAME
Where FILENAME is the name of the file to which you saved this.
To install this wrapper, first move `/bin/login' or
`/usr/bin/login' (make sure it is the one that telnetd (8)
executes) to `/bin/login.real' or whatever you defined
_PATH_LOGIN_REAL to be. Then replace the original with the
executable generated by compiling this file (again, make sure that
this executable is statically linked or it will be ineffective). */
#include <stdio.h>
#include <string.h>
#include <unistd.h>
#include <syslog.h>
#ifndef SYSLOG_FACILITY
#define SYSLOG_FACILITY LOG_AUTHPRIV
#endif /* SYSLOG_FACILITY */
#ifndef SYSLOG_LEVEL
#define SYSLOG_LEVEL LOG_ALERT
#endif /* SYSLOG_LEVEL */
#ifndef _PATH_LOGIN_REAL
#define _PATH_LOGIN_REAL "/bin/login.real"
#endif /* _PATH_LOGIN_REAL */
/* This should be a list of environment strings that we want to allow
users to pass to login (1) (and possibly to the shell). These will
be matched using strncmp (3).
This list should really only contain the names of environment
variables that control display parameters, as any others should be
able to wait until the shell's rc files (e.g., `.login',
`.profile', `/etc/profile', etc.,) are executed. */
static const char *legal_env_strings[] =
{
"DISPLAY=",
"TERM=",
0
Quote:};
int
main (argc, argv, envp)
int argc;
char **argv, **envp;
{
char **p1, **p2;
int i;
openlog (argv[0], LOG_PID, SYSLOG_FACILITY);
for (p1 = p2 = envp; *p1; p1++)
{
int found = 0;
/* Traverse the list of legal environment strings. If we have a
match, pass it in envp; otherwise, send a warning to the
system logger. */
for (i = 0; legal_env_strings[i] && !found; i++)
{
if (!strncmp (*p1, legal_env_strings[i], strlen (legal_env_strings[i])))
found = 1;
}
if (found)
{
*p2++ = *p1;
}
else
{
syslog (SYSLOG_LEVEL,
"illegal environment string: `%s'\n", *p1);
}
}
*p2 = 0;
closelog ();
execve (_PATH_LOGIN_REAL, argv, envp);
perror (_PATH_LOGIN_REAL);
exit (1);
Quote:}
-----BEGIN PGP SIGNATURE-----
Version: 2.6.2
iQCVAwUBMaA3S7t34LFBwvDtAQFEegQAqDxHsyYzaLsK02NQmwlvF/fO5LH6nMY0
RyLKRvpToIfTxF0JUqk1tMNb7eP8lunx031cDoG+n+tb+CKJiNU39nvt+4YPIe/h
1FaqlBnfFJGF+1Q3CPvzeYSmA2QfOKksfv/BSMjIWW5B8136wuTCHIGp3Hw4bvno
hkkTYLLZhKM=
=EdMS
-----END PGP SIGNATURE-----
--
/ "Meddle not in the affairs of dragons, for \
*}=={*}>======- thou art crunchy and go well with ketchup." -======<{*}=={*
Musashi - - -=- Finger for PGP key -=- - - Musashi
by