+++ This bug was initially created as a clone of Bug #167682 +++ From Bugzilla Helper: User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.8) Gecko/20050511 Firefox/1.0.4 Description of problem: The default directory permission for bind-chroot rpm should not allow group write access for the named group for the following directories. chmod g-w /var/named/chroot/ chmod g-w /var/named/chroot/var chmod g-w /var/named/chroot/etc chmod g-w /var/named/chroot/dev Allowing write access for "named" to these directories would allow an exploit of the named server to rename and recreate files and directories, which would effectively provide write access to named configuration files, and the master zone files. Of course administrators can fix the permissions themselves, however it would be best of a secure by default configuration would be provided. Other subdirectories such as var/run/named are expected to be writable, of coure, but the top level directories muct not be writable. I'm working a security benchmark for BIND with the Center for Internet Security, which will be published soon. If there is going to be a fix for this it would be helpful to include a mention of it in the document. Thank you! Ralph Durkee, CISSP, GSEC, GCIH Principal Consultant USA 585-624-9551 http://rd1.net Version-Release number of selected component (if applicable): bind-chroot-9.3.1-10_FC4 How reproducible: Always Steps to Reproduce: 1.yum install bind-chroot 2.ls -al /var/named/chroot/ 3. Actual Results: # ls -al /var/named/chroot/ total 40 drwxrwx--- 6 root named 4096 Aug 22 16:33 . drwxr-x--- 5 root named 4096 Sep 6 21:09 .. drwxrwxr-- 2 root named 4096 Sep 6 21:09 dev drwxrwx--- 2 root named 4096 Sep 6 21:09 etc dr-xr-xr-x 64 root root 0 Sep 1 14:39 proc drwxrwx--- 5 root named 4096 Sep 6 21:09 var Expected Results: # ls -al /var/named/chroot/ total 40 drwxr-x--- 6 root named 4096 Aug 22 16:33 . drwxr-x--- 5 root named 4096 Sep 6 21:09 .. drwxr-xr-- 2 root named 4096 Sep 6 21:09 dev drwxr-x--- 2 root named 4096 Sep 6 21:09 etc dr-xr-xr-x 64 root root 0 Sep 1 14:39 proc drwxr-x--- 5 root named 4096 Sep 6 21:09 var Additional info:
This is fixed with bind-9.2.4-12_EL4, errata RHBA-2005:764, available from: http://people.redhat.com/~jvdias/bind/RHEL-4
This issue is on Red Hat Engineering's list of planned work items for the upcoming Red Hat Enterprise Linux 4.4 release. Engineering resources have been assigned and barring unforeseen circumstances, Red Hat intends to include this item in the 4.4 release.
An advisory has been issued which should help the problem described in this bug report. This report is therefore being closed with a resolution of ERRATA. For more information on the solution and/or where to find the updated files, please follow the link below. You may reopen this bug report if the solution does not work for you. http://rhn.redhat.com/errata/RHBA-2006-0288.html