Note: This is a beta release of Red Hat Bugzilla 5.0. The data contained within is a snapshot of the live data so any changes you make will not be reflected in the production Bugzilla. Also email is disabled so feel free to test any aspect of the site that you want. File any problems you find or give feedback here.

Bug 170360

Summary: bind-chroot directory permissions allow inappropriate write access for the named user.
Product: Red Hat Enterprise Linux 4 Reporter: Jason Vas Dias <jvdias>
Component: bindAssignee: Jason Vas Dias <jvdias>
Status: CLOSED ERRATA QA Contact: Ben Levenson <benl>
Severity: medium Docs Contact:
Priority: medium    
Version: 4.0CC: poelstra
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: i386   
OS: Linux   
URL: NA
Whiteboard: RHEL4U3NAK
Fixed In Version: RHBA-2006-0288 Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2006-08-10 21:14:12 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Bug Depends On: 167682    
Bug Blocks: 181409    

Description Jason Vas Dias 2005-10-10 23:14:54 UTC
+++ This bug was initially created as a clone of Bug #167682 +++

From Bugzilla Helper:
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.8)
Gecko/20050511 Firefox/1.0.4

Description of problem:
The default directory permission for bind-chroot rpm should not allow group
write access for the named group for the following directories.

chmod g-w /var/named/chroot/
chmod g-w /var/named/chroot/var
chmod g-w /var/named/chroot/etc
chmod g-w /var/named/chroot/dev

Allowing write access for "named" to these directories would allow an exploit of
the named server to rename and recreate files and directories, which would
effectively provide write access to named configuration files, and the master
zone files.

Of course administrators can fix the permissions themselves, however it would be
best of a secure by default configuration would be provided. Other
subdirectories such as var/run/named are expected to be writable, of coure, but
the top level directories muct not be writable. 

I'm working a security benchmark for BIND with the Center for Internet Security,
which will be published soon. If there is going to be a fix for this it would be
helpful to include a mention of it in the document. 

Thank you!

Ralph Durkee, CISSP, GSEC, GCIH
Principal Consultant
USA 585-624-9551
http://rd1.net

Version-Release number of selected component (if applicable):
bind-chroot-9.3.1-10_FC4

How reproducible:
Always

Steps to Reproduce:
1.yum install bind-chroot
2.ls -al /var/named/chroot/
3.
  

Actual Results:  # ls -al /var/named/chroot/
total 40
drwxrwx---   6 root named 4096 Aug 22 16:33 .
drwxr-x---   5 root named 4096 Sep  6 21:09 ..
drwxrwxr--   2 root named 4096 Sep  6 21:09 dev
drwxrwx---   2 root named 4096 Sep  6 21:09 etc
dr-xr-xr-x  64 root root     0 Sep  1 14:39 proc
drwxrwx---   5 root named 4096 Sep  6 21:09 var


Expected Results:  # ls -al /var/named/chroot/
total 40
drwxr-x---   6 root named 4096 Aug 22 16:33 .
drwxr-x---   5 root named 4096 Sep  6 21:09 ..
drwxr-xr--   2 root named 4096 Sep  6 21:09 dev
drwxr-x---   2 root named 4096 Sep  6 21:09 etc
dr-xr-xr-x  64 root root     0 Sep  1 14:39 proc
drwxr-x---   5 root named 4096 Sep  6 21:09 var


Additional info:

Comment 1 Jason Vas Dias 2005-10-11 00:11:32 UTC
This is fixed with bind-9.2.4-12_EL4, errata RHBA-2005:764, available from:
 http://people.redhat.com/~jvdias/bind/RHEL-4  

Comment 9 Bob Johnson 2006-04-11 17:08:34 UTC
This issue is on Red Hat Engineering's list of planned work items 
for the upcoming Red Hat Enterprise Linux 4.4 release.  Engineering 
resources have been assigned and barring unforeseen circumstances, Red 
Hat intends to include this item in the 4.4 release.

Comment 12 Red Hat Bugzilla 2006-08-10 21:14:17 UTC
An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on the solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.

http://rhn.redhat.com/errata/RHBA-2006-0288.html