Slashdot Mirror
Major Security Hole In Samsung Linux Drivers
GerbilSoft writes with news of a major security hole in Samsung's proprietary Linux printer drivers. From the Ubuntu Forums: "Just to inform you about a recent post on the French Ubuntu forum about Samsung drivers (sorry, in French). [Google translation here.] It appears that Samsung unified drivers change rights on some parts of the system: After installing the drivers, applications may launch using root rights, without asking any password. What is more, you may be able to kill your system, by deleting system components, generally modifiable only by using sudo." GerbilSoft adds: "Among the programs that it sets as setuid-root are OpenOffice, xsane, and xscanimage."
Nothing but the programs that absolutely have to should be run as root.
Is there an English (not some auto-translated forum) site covering this? I think its talking about this suid run printer driver?
Pete/Petri "damn, my chainsaw is clogged with 1's and 0's again." --clyde
It's a driver installation, so the ordinary user doesn't/can't do it.
However, it's a proprietary driver, that you need to install to use the printer, so if that's the printer you have people install it, expecting it not to create security holes.
This might have been discovered earlier, if it weren't for the closedness of the source.
My guess is that it happened due to a coder writing the driver so, it requires root to use it.
Then trying to guess which programs requires the driver, then setting those to run as root. Silly, but easy to do.
Sounds like it was done without peer review, so i guess they only have one guy writing their linux drivers..
So why is it proprietary? well some places printers are encouraged(required) by law (enforcement) to leave secret and invisible watermarks.
If it isn't done in the printer, it's done in the driver, if it's open, it'll be removed.
Blah blah sig blah blah blah irony blah blah
For those who can't read French, the Ubuntu forum is just a posting of a link to another forum where it was noticed. The posting, along with the interesting source can be found at http://linuxfr.org/forums/15/22562.html The interesting parts are:
The script copies the affected application's executable to one with a .bin extension, and replaces it with an suid wrapper script. This is undoable, but god, what a mess!
Okay, I couldn't overcome the lameness filter, go to the source to see for yourselves...
Only when the little bugger of an hotplug-manager changes the user id for the scanner device to the logged on user. Which still only gives one user access to the scanner. Have my Wife remote logged in and only one of us can use the scanner.
Unix security if just flawed and the flaw is called "root".
Martin
If you allow the local user to install programs, then the local user is either; /usr/bin and /usr/lib, or /opt) which wouldn't solve the problem TFA is on about /usr and a fine grained ACL system dictacting which users have access to what
/lib.
a) going to need write access to all the usual locations (either
b) going to need to use some middleware that *does* have rwx access to
"Driver" installs just need access to
Fact of the matter is that whatever user/process has the rights to install apps has the rights to fuck them up as well. Much like how windows can't help it if the user runs trojan_setup.exe.
As ther other poster noticed, things like SELinux offer incredibly fine grained access over what various users can and can't do, and if you go through the (fairly considerable) pain of setting it up it can give you an amazingly secure setup, but there's no way in hell it'd fly with everyday users or even most sysadmins. This is why Linux distros take such care with package management and like to retain control over their repositories - because they can't risk a third party, closed source package coming in and accidentally running a chmod -R 777 / on install. When you're dealing with companies that seemingly have little knowledge of Linux development and security models, this is a very real threat.
Moderation Total: -1 Troll, +3 Goat
After I installed the unified drivers for my Samsung printer/scanner, I had the unwelcome surprise of discovering that OpenOffice now opens as root, and not only that but did not ask for my password!
As a result, all documents I created were saved in the
I attempted to re-install
The beast (the problem) is occuring under Ubuntu 7.04 under Gnome.
Thank You. Bonjour,
Après avoir installé les drivers unifiés de Samsung pour gérer mon imprimante scanner, j'ai eu la très mauvaise surprise de constater que la suite openoffice s'ouvrait en root et ceci sans que me soit demandé le moindre mot de passe !!!
Du coup, les documents que je crée s'enregistrent dans le dossier
A tout hasard j'ai réinitialisé le
La bête est sous Ubuntu 7.04 et gnome. En attendant vote aide, je cherche et tente de résister au désespoir le plus sombre !
Merci
Printer drivers need to be installed with world execute permissions so that all users on the system can access the printer. The Samsung hacker's method of doing this, converting them to 4755 bin files and setting the original name as a link to the bin files, is one way of doing that -- IF his "unwrap" function had worked properly. That's the bug. Listed in the posting are files whose permissions need to be modified after the driver is installed.
Running with Linux for over 20 years!
I can't tell you why the driver did what it did. However, from what I've read, the driver actually moves binaries to new locations and replaces them with a startup script which is set to run suid. That's way, way, way over the line. It breaks lots of stuff, like updates and patches. Someone doesn't deserver to be fired. Someone deserves to be tarred and feathered and banned from ever touching a computer again.
"The legitimate powers of government extend only to such acts as are injurious to others." Thomas Jefferson.
In my opinion, the manager is responsible for the conduct of the employees. Taking responsibility for those working under you is a fundamental part of good leadership. Its the manager's job to check the employee's work to make sure that it meets quality criteria. In this case the manager failed in his or her supervisory duties.
We all know what to do, but we don't know how to get re-elected once we have done it
The bug is that the driver actually tries to UN-suid the applications: unwrap_setuid_third_party_application xsane unwrap_setuid_third_party_application xscanimage wrap_setuid_ooo_application soffice un wrap_setuid_ooo_application swriter un wrap_setuid_ooo_application simpress un wrap_setuid_ooo_application scalc un But they screwed up the oo unwrap part. The "un" should be BEFORE the "wrap" on those lines. It suids the apps temporarily, and improperly un-suids them.
I wouldn't be too surprised if something like this was a management decision to start with. Someone figured out they'd save some money on tech support calls, for example, if the users don't have to keep calling with stuff like "why does this ask for a password when I want to change the printer?" and "does your driver have a virus? my grandson said I should beware stuff that asks for a password" (for bonus points: "... and he didn't tell me the password anyway. Can I still use the printer?") and the like. Don't underestimate the kind of dumb decisions that get taken in the name of cost cutting.
And that includes the fact that it probably wasn't a programmer/architect that made the installer anyway. The drive for cost cutting includes the idea of giving each job to the lowest wage monkey who can possibly do it. So it's not entirely unheard of to offload to the cheapest interns or even to underused non-technical members of the team stuff like making an installer or writing the test cases.
In which case probably some under-paid and under-skilled monkey got the honour of figuring out how to install that stuff in Linux. These aren't typically the kind of guys you'd ask to do a security analysis and design, and they're not given ample times and funds for research either. So he'll google if he has a problem (like how to make some nice config dialog modify a file that was installed as writable by root only), and take the first thing that sorta looks like a solution.
Plus a few other such fun ways to fuck up in the name of keeping the costs down.
Mind you, I'm not saying this has to be what happened at Samsung. Just saying that I've seen that and worse happening in other places, so I wouldn't be too surprised.
A polar bear is a cartesian bear after a coordinate transform.