A new version of Tiger (3.2.3) has been released. This version is mainly a bug fix release that incorporates all the fixes introduced in Debian since the 3.2.2 release.
It also updates Linux' gen_mounts to support many more filesystems and provides a way for local administrators to define local and non-local filesystems. Which makes it easier for local admins to define exotic filesystems if in use and avoid the warnings Tiger mails each time a script that runs through the filesystems (check_perms, check_known and find_files) runs.
Tiger version 3.2.2 now includes the all new 'audit scripts' written by Marc Heuse.
One common problem when auditing the security of 'live' (production) systems is that the administrator doesn't want the auditor to run a complex set of scripts (such as Tiger). This set of scripts can be used for offline audit of different operating systems.
These scripts will recover all the information from a system and pack it into a file so that the system can be audited based on this information. These scripts are not intrusive (unlike the Tiger checks) and have been used in the past in many different professional IT security audits.
For more information read the README file available at
http://cvs.savannah.nongnu.org/viewvc/tiger/audit/?root=tiger
After a long time the new 3.2.2 release is available. This release is basicly a bug fix release, introducing many of the changes available in CVS (and in the patches introduced in the Debian packages) which have been generated over the past time.
This release also introduces support for some operating systems including Tru64, Solaris 8/9 and improves the existing support of HPUX and Linux with new module checks.
For more information see the CHANGES file available in the sources.
The new release is available now at http://download.savannah.nongnu.org/releases/tiger/?C=M;O=D
While we are preparing a new release people might wonder were the old releases are. Well, they are hard to find (at least for me) but they are available at ftp://ftp.gnu.org/savannah/files/tiger/
This download area can be used while I struggle in order to get my GPG signature to be added properly so that I can submit files to the new download area.
If you want to keep up with the latest development release you should consider using CVS (there are nightly CVS tarballs available at Savannah which could be used as "interim" releases)
Important Note: Due to a recent compromise of the Savannah project servers ( http://savannah.nongnu.org/forum/forum.php?forum_id=2752) it is recommended that source code or binaries downloaded from there are checked carefully, specially if not signed with the Tiger's developer's key (http://www.tigersecurity.org/key.html). Note that even though there has been a security incident at Debian too (http://www.debian.org/News/2003/20031121), all the source code there and the packages mirror has been reviewed already (as detailed in the report after the compromise, http://www.debian.org/News/2003/20031202).
Debian archive sources for Tiger are available at:
http://ftp.debian.org/debian/pool/main/t/tiger/ (or in any of the Debian ftp mirrors)
A new stable release (3.2.1) for the Tiger security tool has been published. This new release includes a number of bug fixes, enhancements and new checks such as: check_ndd (for HPUX and SunOS systems), check_passwspec (for Linux and HPUX) check_trusted (for HPUX), check_rootkit (which can interact with the chkrootkit tool), check_xinetd, and, finally, aide_run and integrit_run which provide new checks for integrity file checkers. Other security checks have been enhanced or
fixed.
Other relevant changes include: full integration with TARA 3.0.3, improved HPUX support, preliminary MacOSX support, new functions for safer file creation and removal, and more documentation (such as an annotated version of CERT's Unix Security Checklist). For the full list of changes please read the 'CHANGES' file in the source code.
This release has been possible thanks to the contributions made by Tiger users. A new contrib/ directory has been created in the sources to cover those patches provided by the community which have not yet made it to the main tree but which will be integrated in the near future.
I would specially like to thank Ryan Bradetich and Nicolas François, who have provided invaluable feedback and enhancements in the form of patches.
There is a new pre-release Tiger 3.2.1 version available on Savannah's download area. The new stable version 3.2.1 will
boast a number of CHANGES with respect to 3.2. In the prerelase (and inthe CVS) you can read the the official changelog. You will see the addition of a number of new checks (such as check_rookit) and better support
for some systems (including preliminary support for MacOS X). This changes have been partly due to a source code merger with TARA version 3.0.3.
A full release will be puslished as soon as testing of this new release
candidate is finished. Thus, developers would appreciate if as much people as poosible tested out the new version and sent in comments (or bug
reports).
A new release of Tiger, version 3.2, has recently been published. This release is considered 'stable' (substituting the 2.2.4 version). Tiger 3.2 fixes some security vulnerabilities (a buffer overflow in realpath.c detected by and unsafe use of 'eval' in some of the checks and utils), provides seven more checks and also fixes bugs present in previous releases. Some other new features are:
- an 'ignore' mechanism similar to logcheck's that permits the generation of flexible OS baselines based on regular expressions. (Suggested baselines will be provided in the future)
- a new installation and configuration mechanism to ease the process of installing Tiger
- more documentation, including information on the expected roadmap (in the TODO file) and the information sources used to improve Tiger.
For more information on the fixes and new checks please read the 'CHANGES' file.
Users of previous versions of Tiger are encouraged to upgrade to this new release.
A security vulnerability has been detected by Steve Grub [1] in the c/realpath.c program which is distributed in all Tiger versions. The realpath function used did not proper limit the input to it which could cause a buffer overflow.
In some operating systems it might be possible to crash realpath if the filesystem has a file which is checked by the Tiger scripts and has an overlong filepath. A malicious local user might create such a path by creating recursive directories in a directory where he has write access and wait for a cron job to access it. It's not clear, however, if it would be directly exploitable (the name of the file which overflows the buffer would need to include characters which may not be permitted in the underlying file system)
Realpath is used by some of Tiger checks including:
- the 'find_files' check which calls sub/check_link. This check will run if Tiger_Check_Filesystem is set to 'Y'.
- the 'check_aliases' check
- the 'check_cron' check
- the 'check_inetd' check
- the 'check_path' check
- the 'check_printcap' check
The only one of these checks that will browse the full filesystem is 'find_files', other checks' use of realpath is limited to the local system configuration. Users who cannot patch Tiger (see below) have to consider disabling temporarily this check from the configuration files tigerrc and cronrc. Notice, that this check is run by default from Tiger's cron setup once a month.
A patch for the current unstable version (from 3.0 to 3.2rc3) has been provided and is available from the CVS sources: http://savannah.nongnu.org/cgi-bin/viewcvs/tiger/tiger/c/realpath.c.diff?r1=1.1&r2=1.2
Also, a patch for older versions (2.2.4) has been made available: http://savannah.nongnu.org/download/tiger/stable.pkg/2.2.4/tiger-2.2.4p1-patch2
I would like to thank Steve Grub for reporting this issue.
Javier Fernandez-Sanguino
[1] http://mail.gnu.org/archive/html/tiger-devel/2003-04/msg00001.html
With the intention of making people more aware that Tiger is now (in the process of being) ressurrected, I have posted an article at slashdot (http://developers.slashdot.org/article.pl?sid=03/04/22/220227&mode=thread&tid=117&tid=172).
It didn't make it to the frontpage and the formatting sucked (I remember doing proper formating) but still, it's worth mentioning.
The code at the CVS is now a 3.2 candidate. I'm going to label this release as stable so I encourage everyone to test it. New tarballs with the 3.2 version will be available soon at the Files section in Savannah. For all the new features and fixes please read the 'CHANGES' file. The most important fixes are: new checks and the new 'ignore' mechanism (which can be optionally used to reduce false positives or provide OS baselines).
Please send bug reports to the Savannah site. Thanks!