Bug 170359 - bind-chroot directory permissions allow inappropriate write access for the named user.
bind-chroot directory permissions allow inappropriate write access for the na...
Status: CLOSED ERRATA
Product: Red Hat Enterprise Linux 3
Classification: Red Hat
Component: bind (Show other bugs)
3.0
i386 Linux
medium Severity medium
: ---
: ---
Assigned To: Jason Vas Dias
Ben Levenson
NA
: Security
Depends On: 167682
Blocks: RHEL3U8CanFix
  Show dependency treegraph
 
Reported: 2005-10-10 19:14 EDT by Jason Vas Dias
Modified: 2007-11-30 17:07 EST (History)
0 users

See Also:
Fixed In Version: RHBA-2006-0287
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2006-07-20 10:58:25 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:


Attachments (Terms of Use)

  None (edit)
Description Jason Vas Dias 2005-10-10 19:14:10 EDT
+++ This bug was initially created as a clone of Bug #167682 +++

From Bugzilla Helper:
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.8)
Gecko/20050511 Firefox/1.0.4

Description of problem:
The default directory permission for bind-chroot rpm should not allow group
write access for the named group for the following directories.

chmod g-w /var/named/chroot/
chmod g-w /var/named/chroot/var
chmod g-w /var/named/chroot/etc
chmod g-w /var/named/chroot/dev

Allowing write access for "named" to these directories would allow an exploit of
the named server to rename and recreate files and directories, which would
effectively provide write access to named configuration files, and the master
zone files.

Of course administrators can fix the permissions themselves, however it would be
best of a secure by default configuration would be provided. Other
subdirectories such as var/run/named are expected to be writable, of coure, but
the top level directories muct not be writable. 

I'm working a security benchmark for BIND with the Center for Internet Security,
which will be published soon. If there is going to be a fix for this it would be
helpful to include a mention of it in the document. 

Thank you!

Ralph Durkee, CISSP, GSEC, GCIH
Principal Consultant
USA 585-624-9551
http://rd1.net

Version-Release number of selected component (if applicable):
bind-chroot-9.3.1-10_FC4

How reproducible:
Always

Steps to Reproduce:
1.yum install bind-chroot
2.ls -al /var/named/chroot/
3.
  

Actual Results:  # ls -al /var/named/chroot/
total 40
drwxrwx---   6 root named 4096 Aug 22 16:33 .
drwxr-x---   5 root named 4096 Sep  6 21:09 ..
drwxrwxr--   2 root named 4096 Sep  6 21:09 dev
drwxrwx---   2 root named 4096 Sep  6 21:09 etc
dr-xr-xr-x  64 root root     0 Sep  1 14:39 proc
drwxrwx---   5 root named 4096 Sep  6 21:09 var


Expected Results:  # ls -al /var/named/chroot/
total 40
drwxr-x---   6 root named 4096 Aug 22 16:33 .
drwxr-x---   5 root named 4096 Sep  6 21:09 ..
drwxr-xr--   2 root named 4096 Sep  6 21:09 dev
drwxr-x---   2 root named 4096 Sep  6 21:09 etc
dr-xr-xr-x  64 root root     0 Sep  1 14:39 proc
drwxr-x---   5 root named 4096 Sep  6 21:09 var


Additional info:
Comment 1 Jason Vas Dias 2005-10-10 20:10:00 EDT
This is fixed with bind-9.2.4-10_EL3, errata RHBA-2005:804, available from:
  http://people.redhat.com/~jvdias/bind/RHEL-3
Comment 9 Bob Johnson 2006-04-11 12:00:51 EDT
This issue is on Red Hat Engineering's list of planned work items 
for the upcoming Red Hat Enterprise Linux 3.8 release.  Engineering 
resources have been assigned and barring unforeseen circumstances, Red 
Hat intends to include this item in the 3.8 release.
Comment 12 Red Hat Bugzilla 2006-07-20 10:58:25 EDT
An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on the solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.

http://rhn.redhat.com/errata/RHBA-2006-0287.html

Note You need to log in before you can comment on or make changes to this bug.