From owner-freebsd-security-notifications Mon Jul 9 9:30: 7 2001 Delivered-To: freebsd-security-notifications@freebsd.org Received: from freefall.freebsd.org (freefall.freebsd.org [216.136.204.21]) by hub.freebsd.org (Postfix) with ESMTP id D4EBC37B40A; Mon, 9 Jul 2001 09:30:00 -0700 (PDT) (envelope-from security-advisories@FreeBSD.org) Received: (from kris@localhost) by freefall.freebsd.org (8.11.3/8.11.3) id f69GU0k91455; Mon, 9 Jul 2001 09:30:00 -0700 (PDT) (envelope-from security-advisories@FreeBSD.org) Date: Mon, 9 Jul 2001 09:30:00 -0700 (PDT) Message-Id: <200107091630.f69GU0k91455@freefall.freebsd.org> X-Authentication-Warning: freefall.freebsd.org: kris set sender to security-advisories@FreeBSD.org using -f From: FreeBSD Security Advisories To: FreeBSD Security Advisories Subject: FreeBSD Ports Security Advisory FreeBSD-SA-01:41.hanterm Sender: owner-freebsd-security-notifications@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: Reply-To: postmaster@freebsd.org X-Loop: FreeBSD.org -----BEGIN PGP SIGNED MESSAGE----- ============================================================================= FreeBSD-SA-01:41 Security Advisory FreeBSD, Inc. Topic: hanterm ports allow local root compromise Category: ports Module: ko-hanterm, ko-hanterm-xf Announced: 2001-07-09 Credits: ksecurity@iland.co.kr Affects: Ports collection prior to the correction date. Corrected: 2001-05-29 Vendor status: Contacted FreeBSD only: NO I. Background hanterm is a modified version of xterm which supports Korean language entry and display. It is included in the FreeBSD ports collection in two versions: ko-hanterm and ko-hanterm-xf. II. Problem Description The hanterm binary is installed with setuid root permissions, but contains insecure code which allows unprivileged local users to obtain root access on the local system. The hanterm ports are not installed by default, nor is it "part of FreeBSD" as such: it is part of the FreeBSD ports collection, which contains over 5400 third-party applications in a ready-to-install format. The ports collections shipped with FreeBSD 4.3 contain this problem since it was discovered after the release. FreeBSD makes no claim about the security of these third-party applications, although an effort is underway to provide a security audit of the most security-critical ports. III. Impact Unprivileged local users can obtain root access on the local system. If you have not chosen to install the ko-hanterm or ko-hanterm-xf ports/packages, then your system is not vulnerable to this problem. IV. Workaround 1) Deinstall the ko-hanterm and ko-hanterm-xf ports/packages, if you have installed them. 2) Remove the setuid root permission from the /usr/X11R6/bin/hanterm file. Execute the following command as root: # chmod u-s /usr/X11R6/bin/hanterm V. Solution One of the following: 1) Upgrade your entire ports collection and rebuild the ko-hanterm/ko-hanterm-xf ports. 2) Deinstall the old package and install a new package dated after the correction date, obtained from: [i386] ko-hanterm: ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/i386/packages-4-stable/korean/ko-hanterm-3.1.5_1.tgz ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/i386/packages-5-current/korean/ko-hanterm-3.1.5_1.tgz ko-hanterm-xf: ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/i386/packages-4-stable/korean/ko-hanterm-xf-19_1.tgz ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/i386/packages-5-current/korean/ko-hanterm-xf-19_1.tgz [alpha] Packages are not automatically generated for the alpha architecture at this time due to lack of build resources. 3) download a new port skeleton for the ko-hanterm/ko-hanterm-xf port from: http://www.freebsd.org/ports/ and use it to rebuild the port. 4) Use the portcheckout utility to automate option (3) above. The portcheckout port is available in /usr/ports/devel/portcheckout or the package can be obtained from: ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/i386/packages-3-stable/devel/portcheckout-2.0.tgz ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/i386/packages-4-stable/devel/portcheckout-2.0.tgz ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/alpha/packages-4-stable/devel/portcheckout-2.0.tgz ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/i386/packages-5-current/devel/portcheckout-2.0.tgz ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/alpha/packages-5-current/devel/portcheckout-2.0.tgz -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.6 (FreeBSD) Comment: For info see http://www.gnupg.org iQCVAwUBO0lzS1UuHi5z0oilAQGuXwP9EZWLrlaxYZYBBFLASErm2PjTSgazT/8c EyrxNw33Qal+xecxopeS3p/3Cf9x/Y0cH53ZMJoId6MaWJSwQOWlVqNC/ehjm2tx NPfLu3eR1JhguFoQ0YRHnMBvX1KBRfVQnfoa7HFd1vPeKEqsaXBvRz8HSurpgNml nUXVwvklmPc= =W5bd -----END PGP SIGNATURE----- To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security-notifications" in the body of the message From owner-freebsd-security-notifications Wed Jul 11 12:16:21 2001 Delivered-To: freebsd-security-notifications@freebsd.org Received: from freefall.freebsd.org (freefall.freebsd.org [216.136.204.21]) by hub.freebsd.org (Postfix) with ESMTP id 1BED337B401; Wed, 11 Jul 2001 12:16:20 -0700 (PDT) (envelope-from security-advisories@FreeBSD.org) Received: (from jedgar@localhost) by freefall.freebsd.org (8.11.3/8.11.3) id f6BJGKD45244; Wed, 11 Jul 2001 12:16:20 -0700 (PDT) (envelope-from security-advisories@FreeBSD.org) Date: Wed, 11 Jul 2001 12:16:20 -0700 (PDT) Message-Id: <200107111916.f6BJGKD45244@freefall.freebsd.org> X-Authentication-Warning: freefall.freebsd.org: jedgar set sender to security-advisories@FreeBSD.org using -f From: FreeBSD Security Advisories To: FreeBSD Security Advisories Subject: FreeBSD Security Advisory FreeBSD-SA-01:42.signal Sender: owner-freebsd-security-notifications@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: Reply-To: postmaster@freebsd.org X-Loop: FreeBSD.org -----BEGIN PGP SIGNED MESSAGE----- ============================================================================= FreeBSD-SA-01:42 Security Advisory FreeBSD, Inc. Topic: signal handling during exec may allow local root compromise Category: core Module: kernel Announced: 2001-07-10 Credits: Georgi Guninski Affects: All released versions of FreeBSD 4.x, FreeBSD 4.3-STABLE prior to the correction date. Corrected: 2001-07-09 FreeBSD only: Yes I. Background When a process forks, it inherits the parent's signals. When the process execs, the kernel clears the signal handlers because they are not valid in the new address space. II. Problem Description A flaw exists in FreeBSD signal handler clearing that would allow for some signal handlers to remain in effect after the exec. Most of the signals were cleared, but some signal hanlders were not. This allowed an attacker to execute arbitrary code in the context of a setuid binary. All versions of 4.x prior to the correction date including and 4.3-RELEASE are vulnerable to this problem. The problem has been corrected by copying the inherited signal handlers and resetting the signals instead of sharing the signal handlers. III. Impact Local users may be able to gain increased privileges on the local system. IV. Workaround Do not allow untrusted users to gain access to the local system. V. Solution One of the following: 1) Upgrade your vulnerable FreeBSD system to 4.3-STABLE after the correction date. 2) To patch your present system: download the relevant patch from the below location, and execute the following commands as root: [FreeBSD 4.1, 4.2, and 4.3 base systems] This patch has been verified to apply to FreeBSD 4.1, 4.2, and 4.3 only. It may or may not apply to older releases. # fetch ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-01:42/signal-4.3.patch # fetch ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-01:42/signal-4.3.patch.asc Verify the detached PGP signature using your PGP utility. # cd /usr/src/sys/kern # patch -p < /path/to/patch [ Recompile your kernel as described in http://www.freebsd.org/handbook/kernelconfig.html and reboot the system ] -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.6 (FreeBSD) Comment: FreeBSD: The Power To Serve iQCVAwUBO0sNtlUuHi5z0oilAQH3aAP/dXzWd8u8Ya9pwOB9ymK3fNQD4GqHaT1b vKthgZNumVcnoNL3LC/iuMlmufIuVdVXM12ISad+aW5HkqZ0tDFSc4GLA9cX/riN r66h7IBAOc0p+NQH8TTSjCehUC1Np40hgsca+/onIfhhV7MKGWDY6I6BwJF9UWvD ZY62Dx/1yI8= =gDIP -----END PGP SIGNATURE----- To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security-notifications" in the body of the message From owner-freebsd-security-notifications Wed Jul 11 12:17:22 2001 Delivered-To: freebsd-security-notifications@freebsd.org Received: from freefall.freebsd.org (freefall.freebsd.org [216.136.204.21]) by hub.freebsd.org (Postfix) with ESMTP id 4FB4937B403; Wed, 11 Jul 2001 12:17:19 -0700 (PDT) (envelope-from security-advisories@FreeBSD.org) Received: (from jedgar@localhost) by freefall.freebsd.org (8.11.3/8.11.3) id f6BJHJ845333; Wed, 11 Jul 2001 12:17:19 -0700 (PDT) (envelope-from security-advisories@FreeBSD.org) Date: Wed, 11 Jul 2001 12:17:19 -0700 (PDT) Message-Id: <200107111917.f6BJHJ845333@freefall.freebsd.org> X-Authentication-Warning: freefall.freebsd.org: jedgar set sender to security-advisories@FreeBSD.org using -f From: FreeBSD Security Advisories To: FreeBSD Security Advisories Subject: FreeBSD Ports Security Advisory FreeBSD-SA-01:43.fetchmail Sender: owner-freebsd-security-notifications@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: Reply-To: postmaster@freebsd.org X-Loop: FreeBSD.org -----BEGIN PGP SIGNED MESSAGE----- ============================================================================= FreeBSD-SA-01:43 Security Advisory FreeBSD, Inc. Topic: fetchmail contains potentially exploitable buffer overflow Category: ports Module: fetchmail Announced: 2001-07-10 Credits: Wolfram Kleff Affects: Ports collection prior to the correction date. Corrected: 2001-06-15 Vendor status: Updated version released FreeBSD only: NO I. Background fetchmail is a program used to retrieve email from POP and IMAP servers. II. Problem Description The fetchmail port, versions prior to fetchmail-5.8.6, contains a potentially exploitable buffer overflow when rewriting headers longer than 512 bytes. This problem may allow remote users to cause fetchmail to crash and potentially execute arbitrary code as the user running fetchmail. The fetchmail port is not installed by default, nor is it "part of FreeBSD" as such: it is part of the FreeBSD ports collection, which contains over 5400 third-party applications in a ready-to-install format. The ports collection shipped with FreeBSD 4.3 is vulnerable to this problem since it was discovered after its release. FreeBSD makes no claim about the security of these third-party applications, although an effort is underway to provide a security audit of the most security-critical ports. III. Impact Remote users using specially crafted email messages may be able to cause fetchmail to crash and potentially execute arbitrary code as the user running fetchmail. If you have not chosen to install the fetchmail port/package, then your system is not vulnerable to this problem. IV. Workaround Deinstall the fetchmail port/package if you have installed it. V. Solution One of the following: 1) Upgrade your entire ports collection and rebuild the fetchmail port. 2) Deinstall the old package and install a new package dated after the correction date, obtained from the following directories: [i386] ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/i386/packages-4-stable/mail/fetchmail-5.8.6.tgz ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/i386/packages-5-current/mail/fetchmail-5.8.6.tgz [alpha] Packages are not automatically generated for the alpha architecture at this time due to lack of build resources. 3) download a new port skeleton for the fetchmail port from: http://www.freebsd.org/ports/ and use it to rebuild the port. 4) Use the portcheckout utility to automate option (3) above. The portcheckout port is available in /usr/ports/devel/portcheckout or the package can be obtained from: ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/i386/packages-4-stable/devel/portcheckout-2.0.tgz ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/i386/packages-5-current/devel/portcheckout-2.0.tgz -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.6 (FreeBSD) Comment: FreeBSD: The Power To Serve iQCVAwUBO0sNt1UuHi5z0oilAQH3NAP/aozGB400MgGyT/mndBk39Y1tD1aPR1AN yDUG+ddeiskXWjR2UNUd3hqQNJ/8LNMqty8MYOVDB+4S+Pvk4MS2iXcW/4r8yPuT 2V0FfHos3ytxk/mujf7IlVhwp3fnGCFJpFJatgbhUUoU8gakl8BfR87zT77RbiDQ OuGG+fpBKEw= =zCcz -----END PGP SIGNATURE----- To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security-notifications" in the body of the message From owner-freebsd-security-notifications Wed Jul 11 12:17:29 2001 Delivered-To: freebsd-security-notifications@freebsd.org Received: from freefall.freebsd.org (freefall.freebsd.org [216.136.204.21]) by hub.freebsd.org (Postfix) with ESMTP id 5BB0837B406; Wed, 11 Jul 2001 12:17:23 -0700 (PDT) (envelope-from security-advisories@FreeBSD.org) Received: (from jedgar@localhost) by freefall.freebsd.org (8.11.3/8.11.3) id f6BJHNE45347; Wed, 11 Jul 2001 12:17:23 -0700 (PDT) (envelope-from security-advisories@FreeBSD.org) Date: Wed, 11 Jul 2001 12:17:23 -0700 (PDT) Message-Id: <200107111917.f6BJHNE45347@freefall.freebsd.org> X-Authentication-Warning: freefall.freebsd.org: jedgar set sender to security-advisories@FreeBSD.org using -f From: FreeBSD Security Advisories To: FreeBSD Security Advisories Subject: FreeBSD Ports Security Advisory FreeBSD-SA-01:44.gnupg Sender: owner-freebsd-security-notifications@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: Reply-To: postmaster@freebsd.org X-Loop: FreeBSD.org -----BEGIN PGP SIGNED MESSAGE----- ============================================================================= FreeBSD-SA-01:44 Security Advisory FreeBSD, Inc. Topic: gnupg contains format string vulnerability Category: ports Module: gnupg Announced: 2001-07-10 Credits: fish stiqz Affects: Ports collection prior to the correction date. Corrected: 2001-05-30 Vendor status: Updated version released FreeBSD only: NO I. Background GnuPG is an implementation of the PGP digital signature/encryption protocol II. Problem Description The gnupg port, versions prior to gnupg-1.0.6, contains a format string vulnerability. If gnupg attempts to decrypt a file whose filename does not end in '.gpg', the filename is copied to the prompt string, allowing a user-supplied format string. This may allow a malicious user to cause arbitrary code to be executed as the user running gnupg. The gnupg port is not installed by default, nor is it "part of FreeBSD" as such: it is part of the FreeBSD ports collection, which contains over 5400 third-party applications in a ready-to-install format. The ports collection shipped with FreeBSD 4.3 is vulnerable to this problem since it was discovered after its release. FreeBSD makes no claim about the security of these third-party applications, although an effort is underway to provide a security audit of the most security-critical ports. III. Impact A malicious user supplying a file to be decrypted by the target user running gnupg may be able to craft a filename causing arbitrary code to be executed as the user running gnupg. If you have not chosen to install the gnupg port/package, then your system is not vulnerable to this problem. IV. Workaround Deinstall the gnupg port/package if you have installed it. V. Solution One of the following: 1) Upgrade your entire ports collection and rebuild the gnupg port. 2) Deinstall the old package and install a new package dated after the correction date, obtained from the following directories: [i386] ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/i386/packages-4-stable/security/gnupg-1.0.6_1.tgz ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/i386/packages-5-current/security/gnupg-1.0.6_1.tgz [alpha] Packages are not automatically generated for the alpha architecture at this time due to lack of build resources. 3) download a new port skeleton for the gnupg port from: http://www.freebsd.org/ports/ and use it to rebuild the port. 4) Use the portcheckout utility to automate option (3) above. The portcheckout port is available in /usr/ports/devel/portcheckout or the package can be obtained from: ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/i386/packages-4-stable/devel/portcheckout-2.0.tgz ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/i386/packages-5-current/devel/portcheckout-2.0.tgz -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.6 (FreeBSD) Comment: FreeBSD: The Power To Serve iQCVAwUBO0sNuVUuHi5z0oilAQEnPAP/XadCoa6avlv67LottE8OKLdxSbMRgVXL haBWIyZTMSLRiwgfiQS1riDXslCT8rI8piXSv5HI1zjT7OgkV6zXXRP2pez/EdLe H9sHUJMZNYP1VRfUUlxkmwfelT9cgD2Di3y9vrDouZTt4B5wEGgrzeNeQq1eFNlc 7SvBBZsxEZQ= =g1DW -----END PGP SIGNATURE----- To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security-notifications" in the body of the message From owner-freebsd-security-notifications Wed Jul 11 12:17:31 2001 Delivered-To: freebsd-security-notifications@freebsd.org Received: from freefall.freebsd.org (freefall.freebsd.org [216.136.204.21]) by hub.freebsd.org (Postfix) with ESMTP id 667C537B407; Wed, 11 Jul 2001 12:17:27 -0700 (PDT) (envelope-from security-advisories@FreeBSD.org) Received: (from jedgar@localhost) by freefall.freebsd.org (8.11.3/8.11.3) id f6BJHRe45354; Wed, 11 Jul 2001 12:17:27 -0700 (PDT) (envelope-from security-advisories@FreeBSD.org) Date: Wed, 11 Jul 2001 12:17:27 -0700 (PDT) Message-Id: <200107111917.f6BJHRe45354@freefall.freebsd.org> X-Authentication-Warning: freefall.freebsd.org: jedgar set sender to security-advisories@FreeBSD.org using -f From: FreeBSD Security Advisories To: FreeBSD Security Advisories Subject: FreeBSD Ports Security Advisory FreeBSD-SA-01:45.samba Sender: owner-freebsd-security-notifications@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: Reply-To: postmaster@freebsd.org X-Loop: FreeBSD.org -----BEGIN PGP SIGNED MESSAGE----- ============================================================================= FreeBSD-SA-01:45 Security Advisory FreeBSD, Inc. Topic: samba Category: ports Module: samba Announced: 2001-07-10 Credits: Michal Zalewski Affects: Ports collection prior to the correction date. Corrected: 2001-06-23 Vendor status: Updated version released FreeBSD only: NO I. Background Samba is an implementation of the Server Message Block (SMB) protocol. II. Problem Description The samba ports, versions prior to samba-2.0.10, samba-devel-2.2.0a, and ja-samba-2.0.9.j1.0_1, fail to properly validate NetBIOS names. By sending a specially crafted NetBIOS name containing unix path characters, a remote user may be able to cause the samba server to write the log files to arbitrary locations on the local filesystems. If samba is configured to use the '%m' macro in the 'log file' directive, the NetBIOS name will be substituted without sanity checking. This will allow the remote user to insert arbitrary paths given the 15 character NetBIOS name limit. However, if a local user can create symlinks accessible via this problem, a remote user may be able to append to any arbitrary file or filesystem. The samba port is not installed by default, nor is it "part of FreeBSD" as such: it is part of the FreeBSD ports collection, which contains over 5400 third-party applications in a ready-to-install format. The ports collection shipped with FreeBSD 4.3 is vulnerable to this problem since it was discovered after its release. FreeBSD makes no claim about the security of these third-party applications, although an effort is underway to provide a security audit of the most security-critical ports. III. Impact Remote users using specially crafted NetBIOS names may be able to insert arbitrary paths in log file names, causing log files to be written in unintended and inappropriate locations. If a local user can create symlinks accessible via this problem, a remote user may be able to append to any arbitrary file or filesystem. If you have not chosen to install the samba port/package, then your system is not vulnerable to this problem. IV. Workaround Remove all occurrences of the %m macro from smb.conf. Replacing the %m macro with the %I macro (replaced with the IP address of the client machine) is the recommended workaround for most sites. V. Solution One of the following: 1) Upgrade your entire ports collection and rebuild the samba port. 2) Deinstall the old package and install a new package dated after the correction date, obtained from the following directories: [i386] ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/i386/packages-4-stable/net/samba-2.0.10.tgz ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/i386/packages-5-current/net/samba-2.0.10.tgz ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/i386/packages-4-stable/net/samba-2.2.0a.tgz ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/i386/packages-5-current/net/samba-2.2.0a.tgz ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/i386/packages-4-stable/japanese/ja-samba-2.0.9.j1.0_1.tgz ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/i386/packages-5-current/japanese/ja-samba-2.0.9.j1.0_1.tgz [alpha] Packages are not automatically generated for the alpha architecture at this time due to lack of build resources. 3) download a new port skeleton for the samba port from: http://www.freebsd.org/ports/ and use it to rebuild the port. 4) Use the portcheckout utility to automate option (3) above. The portcheckout port is available in /usr/ports/devel/portcheckout or the package can be obtained from: ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/i386/packages-4-stable/devel/portcheckout-2.0.tgz ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/i386/packages-5-current/devel/portcheckout-2.0.tgz -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.6 (FreeBSD) Comment: FreeBSD: The Power To Serve iQCVAwUBO0sNulUuHi5z0oilAQGpUwP9FbgICIWlBI0KeUpp6YHwXUfQejJuls63 lP9lnN25B+aSgXNvXQKaSVgQrWXY7AjdX2hhp/zShIUoDTYt4rVQyByUH4Zdl704 HMzyX7+CiQ4tzG2lXwdHL1Bb1kVHtqX84GTpt+NlnUGSYYzTr/+wKHv04z1nIQ11 Z0Nrmj64Coo= =VgXS -----END PGP SIGNATURE----- To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security-notifications" in the body of the message From owner-freebsd-security-notifications Wed Jul 11 12:17:46 2001 Delivered-To: freebsd-security-notifications@freebsd.org Received: from freefall.freebsd.org (freefall.freebsd.org [216.136.204.21]) by hub.freebsd.org (Postfix) with ESMTP id 7265537B401; Wed, 11 Jul 2001 12:17:31 -0700 (PDT) (envelope-from security-advisories@FreeBSD.org) Received: (from jedgar@localhost) by freefall.freebsd.org (8.11.3/8.11.3) id f6BJHVm45368; Wed, 11 Jul 2001 12:17:31 -0700 (PDT) (envelope-from security-advisories@FreeBSD.org) Date: Wed, 11 Jul 2001 12:17:31 -0700 (PDT) Message-Id: <200107111917.f6BJHVm45368@freefall.freebsd.org> X-Authentication-Warning: freefall.freebsd.org: jedgar set sender to security-advisories@FreeBSD.org using -f From: FreeBSD Security Advisories To: FreeBSD Security Advisories Subject: FreeBSD Ports Security Advisory FreeBSD-SA-01:46.w3m Sender: owner-freebsd-security-notifications@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: Reply-To: postmaster@freebsd.org X-Loop: FreeBSD.org -----BEGIN PGP SIGNED MESSAGE----- ============================================================================= FreeBSD-SA-01:46 Security Advisory FreeBSD, Inc. Topic: w3m contains remotely exploitable buffer overflow Category: ports Module: w3m Announced: 2001-07-10 Credits: OGASAWARA Satoshi (LAC / s.ogaswr@lac.co.jp) KOBAYASHI Shigehiro (LAC / sigehiro@lac.co.jp) Affects: Ports collection prior to the correction date. Corrected: 2001-06-19 Vendor status: Updated version released FreeBSD only: NO I. Background w3m is a console-based web browser. II. Problem Description The w3m port, versions prior to w3m-0.2.1_1, contains a buffer overflow in the parsing of MIME headers. A malicious server which is visited by a user with the w3m browser can exploit the browser security holes in order to execute arbitrary code on the local machine as the local user. The w3m port is not installed by default, nor is it "part of FreeBSD" as such: it is part of the FreeBSD ports collection, which contains over 5400 third-party applications in a ready-to-install format. The ports collection shipped with FreeBSD 4.3 is vulnerable to this problem since it was discovered after its release. FreeBSD makes no claim about the security of these third-party applications, although an effort is underway to provide a security audit of the most security-critical ports. III. Impact A malicious server which is visited by a user with the w3m browser can exploit the browser security holes in order to execute arbitrary code as the local user. If you have not chosen to install the w3m port/package, then your system is not vulnerable to this problem. IV. Workaround Deinstall the w3m port/package if you have installed it. V. Solution One of the following: 1) Upgrade your entire ports collection and rebuild the w3m port. 2) Deinstall the old package and install a new package dated after the correction date, obtained from the following directories: [i386] ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/i386/packages-4-stable/www/w3m-ssl-0.2.1_1.tgz ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/i386/packages-5-current/www/w3m-ssl-0.2.1_1.tgz ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/i386/packages-4-stable/www/w3m-ssl-0.2.1_1.tgz ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/i386/packages-5-current/www/w3m-ssl-0.2.1_1.tgz [alpha] Packages are not automatically generated for the alpha architecture at this time due to lack of build resources. 3) download a new port skeleton for the w3m port from: http://www.freebsd.org/ports/ and use it to rebuild the port. 4) Use the portcheckout utility to automate option (3) above. The portcheckout port is available in /usr/ports/devel/portcheckout or the package can be obtained from: ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/i386/packages-4-stable/devel/portcheckout-2.0.tgz ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/i386/packages-5-current/devel/portcheckout-2.0.tgz -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.6 (FreeBSD) Comment: FreeBSD: The Power To Serve iQCVAwUBO0sQOFUuHi5z0oilAQG5DAP9EbxSc5vGjRnQCV5Nvs2x5pF/ZHvErLab 164B1fsx02DGCJ6wxi/7Di68DM6BoQ+LTSuWvC0f1HXEhUSa9F9+tDjl+bZ+8Mn8 3p0x3mT1wjajkW0ejOuochFnnQv0Yhwdx2Wc7UhtFyQOKTElNbt5/yN0XnFvjVtj h7/liv1MgbE= =a/OU -----END PGP SIGNATURE----- To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security-notifications" in the body of the message From owner-freebsd-security-notifications Wed Jul 11 12:17:48 2001 Delivered-To: freebsd-security-notifications@freebsd.org Received: from freefall.freebsd.org (freefall.freebsd.org [216.136.204.21]) by hub.freebsd.org (Postfix) with ESMTP id 7FE9937B416; Wed, 11 Jul 2001 12:17:35 -0700 (PDT) (envelope-from security-advisories@FreeBSD.org) Received: (from jedgar@localhost) by freefall.freebsd.org (8.11.3/8.11.3) id f6BJHZp45376; Wed, 11 Jul 2001 12:17:35 -0700 (PDT) (envelope-from security-advisories@FreeBSD.org) Date: Wed, 11 Jul 2001 12:17:35 -0700 (PDT) Message-Id: <200107111917.f6BJHZp45376@freefall.freebsd.org> X-Authentication-Warning: freefall.freebsd.org: jedgar set sender to security-advisories@FreeBSD.org using -f From: FreeBSD Security Advisories To: FreeBSD Security Advisories Subject: FreeBSD Ports Security Advisory FreeBSD-SA-01:47.xinetd Sender: owner-freebsd-security-notifications@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: Reply-To: postmaster@freebsd.org X-Loop: FreeBSD.org -----BEGIN PGP SIGNED MESSAGE----- ============================================================================= FreeBSD-SA-01:47 Security Advisory FreeBSD, Inc. Topic: xinetd contains multiple vulnerabilities Category: ports Module: xinetd Announced: 2001-07-10 Credits: zen-parse@gmx.net Affects: Ports collection prior to the correction date. Corrected: 2001-06-30 Vendor status: Updated version released FreeBSD only: NO I. Background xinetd is a replacement for inetd, the internet super-server. II. Problem Description The xinetd port, versions prior to xinetd-2.3.0, contains a potentially exploitable buffer overflow in the logging routines. If xinetd is configured to log the userid of remote clients obtained via the RFC1413 ident service, a remote user may be able to cause xinetd to crash by returning a specially-crafted ident response. This may also potentially execute arbitrary code as the user running xinetd, normally root. In addition, xinetd used a default umask of 0. This may inadvertently cause applications started by xinetd to create world-writable files unless the applications explicitely set the umask. The xinetd port is not installed by default, nor is it "part of FreeBSD" as such: it is part of the FreeBSD ports collection, which contains over 5400 third-party applications in a ready-to-install format. The ports collection shipped with FreeBSD 4.3 is vulnerable to this problem since it was discovered after its release. FreeBSD makes no claim about the security of these third-party applications, although an effort is underway to provide a security audit of the most security-critical ports. III. Impact Remote users may be able to cause xinetd to crash and potentially execute arbitrary code as the user running xinetd. Processes started by xinetd may inadvertently use a umask of 0, causing files created by these processes to by world-writable. If you have not chosen to install the xinetd port/package, then your system is not vulnerable to this problem. IV. Workaround Deinstall the xinetd port/package if you have installed it. V. Solution One of the following: 1) Upgrade your entire ports collection and rebuild the xinetd port. 2) Deinstall the old package and install a new package dated after the correction date, obtained from the following directories: [i386] ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/i386/packages-4-stable/security/xinetd-2.3.0.tgz ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/i386/packages-5-current/security/xinetd-2.3.0.tgz [alpha] Packages are not automatically generated for the alpha architecture at this time due to lack of build resources. 3) download a new port skeleton for the xinetd port from: http://www.freebsd.org/ports/ and use it to rebuild the port. 4) Use the portcheckout utility to automate option (3) above. The portcheckout port is available in /usr/ports/devel/portcheckout or the package can be obtained from: ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/i386/packages-4-stable/devel/portcheckout-2.0.tgz ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/i386/packages-5-current/devel/portcheckout-2.0.tgz -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.6 (FreeBSD) Comment: FreeBSD: The Power To Serve iQCVAwUBO0sPDlUuHi5z0oilAQFOnAQAnzylUXvLsBiT2F5Mfwn94nd/r7nrP1WI a7hVwyXSYlfBXRFzsyUQsn1ED/t6mNzDKAiztZ7ZzsIfLxgcy7vFyzWmJSqEx6kk pPYzx2KXxB6FXbrSoX1Q4a5WgqWONgFEcG1Vua3nVmApdF0gy8XWinV9I0VWdlVY hQjelLjBi1U= =umCA -----END PGP SIGNATURE----- To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security-notifications" in the body of the message