Re: Re: Security advisory for musl libc - stack-based buffer overflow in ipv6 literal parsing [CVE-2015-1817]

[Rich Felker <dalias@libc.org>]

On Fri, Apr 17, 2015 at 09:10:08PM +0800, Matt Johnston wrote:
> Hi,
> 
> I think Dropbear probably is vulnerable to CVE-2015-1817
> post-authentication. TCP forwarding requests will call
> getaddrinfo() 
> https://secure.ucc.asn.au/hg/dropbear/file/cbd674d63cd4/dbutil.c#l415
> (moved to netio.c in head, and PF_UNSPEC has been fixed to
> AF_UNSPEC). Pre-authentication should be OK, only
> getnameinfo() is called (if that's enabled).

Yes, I agree dropbear is affected.

And wow, this is an utter mess. Not only does dropbear fail to drop
root before processing forwards; it NEVER drops root at all. The
user's session remains running as root for its full lifetime. Aside
from being a huge risk, it also allows users to bypass uid-based
firewall rules via port forwarding; for example, a rule that forbids
normal users from making outgoing connections on port 25 would not be
honored.

Is there any reason for not performing the setgroups/setgid/setuid
immediately after authentication succeeds? Have you looked at whether
it would be easy to patch that in?

None of this excuses CVE-2015-1817 which was a huge failure on our
part, but it seems pretty crazy that dropbear is doing EVERYTHING as
root.

> musl's network-facing DNS code seems a bit precarious with
> pointer arithmetic?

Which code are you talking about? There was a previous problem with
dn_expand, which is the main function that comes to mind for me, and
the code was fixed and heavily reviewed at the time.

Are there other areas you're concerned about?

Rich