NetBSD up to 7.0.1 /usr/libexec/mail.local link following

Summaryinfo

A vulnerability identified as problematic has been detected in NetBSD up to 7.0.1. This affects an unknown function in the library /usr/libexec/mail.local. The manipulation leads to link following. This vulnerability is uniquely identified as CVE-2016-6253. Local access is required to approach this attack. Moreover, an exploit is present. You should upgrade the affected component.

Detailsinfo

A vulnerability was found in NetBSD up to 7.0.1 (Operating System). It has been rated as critical. This issue affects some unknown functionality in the library /usr/libexec/mail.local. The manipulation with an unknown input leads to a link following vulnerability. Using CWE to declare the problem leads to CWE-59. The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

mail.local in NetBSD versions 6.0 through 6.0.6, 6.1 through 6.1.5, and 7.0 allows local users to change ownership of or append data to arbitrary files on the target system via a symlink attack on the user mailbox.

The weakness was disclosed 07/20/2016 by Mateusz Kocielski as NetBSD-SA2016-006 as confirmed security advisory (Website). The advisory is shared at ftp.netbsd.org. The public release has been coordinated in cooperation with the project team. The identification of this vulnerability is CVE-2016-6253 since 07/20/2016. The exploitation is known to be easy. An attack has to be approached locally. A simple authentication is required for exploitation. Technical details as well as a public exploit are known. The advisory points out:

he user mailbox (typically /var/mail/$USER) which is used to deliver a message, is checked using lstat(2) to verify that the file is not a symlink. Then if the file is not a symlink, it's opened. This is subject to a symlink race. An attacker has a window between the lstat(2) and open(2) calls during which she/he can create a symlink to an arbitrary file. The mail.local program then will append arbitrary data or change the ownership using fchown(2) to the file where the symlink points to.

The exploit is available at exploit-db.com. It is declared as proof-of-concept. We expect the 0-day to have been worth approximately $5k-$25k.

Upgrading eliminates this vulnerability. A possible mitigation has been published immediately after the disclosure of the vulnerability. The security advisory contains the following remark:

Potential workaround is to remove mail.local or turn off SUID bit from the file. This program was used by sendmail(8) which is no longer shipped with NetBSD (NetBSD uses postfix(1) as its MTA).

The vulnerability is also documented in the databases at Exploit-DB (40141), SecurityFocus (BID 92101†) and SecurityTracker (ID 1036429†). If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• Operating System

Name

• NetBSD

Version

• 6.0.0
• 6.0.1
• 6.0.2
• 6.0.3
• 6.0.4
• 6.0.5
• 6.0.6
• 6.1.0
• 6.1.1
• 6.1.2
• 6.1.3
• 6.1.4
• 6.1.5
• 7.0.0
• 7.0.1

License

• open-source

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion