[comp.unix.sysv386] security bug in ISC sysv386. here's a quick fix.

mike@vort.uucp (Mike Nemeth) (02/13/91)

calm down folks, there's a quick fix. if you're root just do the following:

- nuke everybody off the system now. tell 'em the disk's on fire.
- as root, run the following

# cd /
# /etc/conf/bin/idtune UAREARW 0

run "kconfig", build a new kernel, install it, and then try
running "that program" again. you should get "memory fault".

it worked for me. your mileage may vary.

speaking of bugs, i have a math-intensive program that appears to
crash 386/387 boxes running either dos or unix. under dos it crashes
with various types of math errors or just hangs, under ISC 3.2.2
it just hangs the system. any ideas anybody?

-- 
The Five M's of Engineering: Make it simple. Make it rugged. Make it reliable.
                             Make an off switch. Make sure the latter works.
Mike Nemeth   VORT Computing   (403) 261-5015   ...calgary!vort!mike

weave@chopin.udel.edu (Ken Weaverling) (02/13/91)

In article <1991Feb12.200752.2772@vort.uucp> mike@vort.uucp (Mike Nemeth) writes:
>calm down folks, there's a quick fix. if you're root just do the following:
>
>- nuke everybody off the system now. tell 'em the disk's on fire.
>- as root, run the following
>
># cd /
># /etc/conf/bin/idtune UAREARW 0

This bug is also present on AT&T SYSV/386 and that tunable param ain't
defined on my box. I called my vendor today. They are *working* on it....


-- 
>>>---> Ken Weaverling  >>>---->  weave@brahms.udel.edu

randy@chinet.chi.il.us (Randy Suess) (02/13/91)

In article <1991Feb12.200752.2772@vort.uucp> mike@vort.uucp (Mike Nemeth) writes:
>calm down folks, there's a quick fix. if you're root just do the following:
]# cd /
]# /etc/conf/bin/idtune UAREARW 0

	That only works if you have a math coprocessor.  I have an idea
	that the majority of ISC systems don't have them, and many are
	public access systems.

-- 
Randy Suess
randy@chinet.chi.il.us

witr@rwwa.COM (Robert W. Withrow) (02/14/91)

FYI, It doesn't show up in SYSV R4, which is not surprising since R4
uses a different memory management scheme.
-- 
---
 Robert Withrow, R.W. Withrow Associates, Swampscott MA 01907 USA
 Tel: +1 617 598 4480, Fax: +1 617 598 4430, Uucp: witr@rwwa.COM

kherron@ms.uky.edu (Kenneth Herron) (02/14/91)

weave@chopin.udel.edu (Ken Weaverling) writes:

>># /etc/conf/bin/idtune UAREARW 0

>This bug is also present on AT&T SYSV/386 and that tunable param ain't
>defined on my box. I called my vendor today. They are *working* on it....

Confirmed.  The bug exists on Sysv 386 3.2.1, and there's no parameter
by that name.  The good news is that the program dumps core under
Sysv/386 4.0, without changing anything.
-- 
Kenneth Herron                                            kherron@ms.uky.edu
University of Kentucky                                        (606) 257-2975
Department of Mathematics 
                                "Never trust gimmicky gadgets" -- the Doctor

jgd@Dixie.Com (John G. DeArmond) (02/14/91)

randy@chinet.chi.il.us (Randy Suess) writes:

>	That only works if you have a math coprocessor.  I have an idea
>	that the majority of ISC systems don't have them, and many are
>	public access systems.

You might be surprised.  Dixie.com has a 387 only because it had to be
there to get ISC 2.0.2 to boot!  We laughingly called it ISC's $500
copy protection Dongle that knew how to add :-)

John

-- 
John De Armond, WD4OQC        | "Purveyors of speed to the Trade"  (tm)
Rapid Deployment System, Inc. |  Home of the Nidgets (tm)
Marietta, Ga                  | 
{emory,uunet}!rsiatl!jgd      |"Politically InCorrect.. And damn proud of it  

src@scuzzy.in-berlin.de (Heiko Blume) (02/14/91)

mike@vort.uucp (Mike Nemeth) writes:

>calm down folks, there's a quick fix. if you're root just do the following:

>- nuke everybody off the system now. tell 'em the disk's on fire.
>- as root, run the following

># cd /
># /etc/conf/bin/idtune UAREARW 0

>run "kconfig", build a new kernel, install it, and then try
>running "that program" again. you should get "memory fault".

yes, that works, BUT you will also get "memory fault" when
you run awk or any other floating point program if you don't
have a math coprocessor.
-- 
      Heiko Blume <-+-> src@scuzzy.in-berlin.de <-+-> (+49 30) 691 88 93
                    public source archive [HST V.42bis]:
        scuzzy Any ACU,f 38400 6919520 gin:--gin: nuucp sword: nuucp
                     uucp scuzzy!/src/README /your/home

lumpi@dobag.in-berlin.de (Joern Lubkoll) (02/14/91)

mike@vort.uucp (Mike Nemeth) writes:
>calm down folks, there's a quick fix. if you're root just do the following:
>- nuke everybody off the system now. tell 'em the disk's on fire.
>- as root, run the following
># cd /
># /etc/conf/bin/idtune UAREARW 0

and you should tune UAREAUS to 0 to !

>run "kconfig", build a new kernel, install it, and then try
>running "that program" again. you should get "memory fault".
>it worked for me. your mileage may vary.
just do this without a co cpu and start, lets say 'awk'.... blamm: core dump

because the floating-point emulator will no longer be able to run correct.

jl
-- 
lumpi@dobag.in-berlin.de  --  "Nothing is the complete absence of everything."

lumpi@dobag.in-berlin.de (Joern Lubkoll) (02/14/91)

weave@chopin.udel.edu (Ken Weaverling) writes:
>In article <1991Feb12.200752.2772@vort.uucp> mike@vort.uucp (Mike Nemeth) writes:
>>calm down folks, there's a quick fix. if you're root just do the following:
>>
>>- nuke everybody off the system now. tell 'em the disk's on fire.
>>- as root, run the following
>>
>># cd /
>># /etc/conf/bin/idtune UAREARW 0
>This bug is also present on AT&T SYSV/386 and that tunable param ain't
>defined on my box. I called my vendor today. They are *working* on it....
*working* .... I really hope, they are working on it, because it can't
go on this way !

jl
-- 
lumpi@dobag.in-berlin.de  --  "Nothing is the complete absence of everything."

lumpi@dobag.in-berlin.de (Joern Lubkoll) (02/14/91)

kherron@ms.uky.edu (Kenneth Herron) writes:
>weave@chopin.udel.edu (Ken Weaverling) writes:
>>># /etc/conf/bin/idtune UAREARW 0
>>This bug is also present on AT&T SYSV/386 and that tunable param ain't
>>defined on my box. I called my vendor today. They are *working* on it....
>Confirmed.  The bug exists on Sysv 386 3.2.1, and there's no parameter
>by that name.  The good news is that the program dumps core under
>Sysv/386 4.0, without changing anything.
I don't have SvsV386 4.0, but I would very much like to test for the bug,
possibly you have to change some values (Adresss of u-block or alike...)

jl
-- 
lumpi@dobag.in-berlin.de  --  "Nothing is the complete absence of everything."

kdenning@pcserver2.naitc.com (Karl Denninger) (02/16/91)

In article <1991Feb13.132436.3507@chinet.chi.il.us> randy@chinet.chi.il.us (Randy Suess) writes:
>In article <1991Feb12.200752.2772@vort.uucp> mike@vort.uucp (Mike Nemeth) writes:
>>calm down folks, there's a quick fix. if you're root just do the following:
>]# cd /
>]# /etc/conf/bin/idtune UAREARW 0
>
>	That only works if you have a math coprocessor.  I have an idea
>	that the majority of ISC systems don't have them, and many are
>	public access systems.
>-- 
>Randy Suess
>randy@chinet.chi.il.us

The cost of entry for an ISC person just went up about $500.  No math chip,
no way to work around the bug.

Thanks ISC.

--
Karl Denninger - AC Nielsen, Bannockburn IL (708) 317-3285
kdenning@nis.naitc.com

"The most dangerous command on any computer is the carriage return."
Disclaimer:  The opinions here are solely mine and may or may not reflect
  	     those of the company.

pdg@chinet.chi.il.us (Paul Guthrie) (02/17/91)

Posting the source code and binary was very irresponsible.  Some of
us were working through ISC's support channels to get this fixed
(and had been promised results).  Yes, it is obvious from the
release notes, but giving the means to every two-bit news reading
moron is not the right thing to do.  

One thing to keep in mind is that if your console is accessible, and
you have the kernel debugger active, anyone on the console can 
(among other nasty attacks) reset the protection variables
and get in as root.

-- 
Paul Guthrie
chinet!nsacray!paul or pdg@balr.com or attmail!balr!pdg