From owner-freebsd-security-notifications Wed Feb 6 8: 3:57 2002 Delivered-To: freebsd-security-notifications@freebsd.org Received: from freefall.freebsd.org (freefall.FreeBSD.org [216.136.204.21]) by hub.freebsd.org (Postfix) with ESMTP id 5CCDC37B420; Wed, 6 Feb 2002 08:03:40 -0800 (PST) Received: (from nectar@localhost) by freefall.freebsd.org (8.11.6/8.11.6) id g16G3eo43778; Wed, 6 Feb 2002 08:03:40 -0800 (PST) (envelope-from security-advisories@freebsd.org) Date: Wed, 6 Feb 2002 08:03:40 -0800 (PST) Message-Id: <200202061603.g16G3eo43778@freefall.freebsd.org> X-Authentication-Warning: freefall.freebsd.org: nectar set sender to security-advisories@freebsd.org using -f From: FreeBSD Security Advisories To: FreeBSD Security Advisories Subject: FreeBSD Security Advisory FreeBSD-SA-02:09.fstatfs Sender: owner-freebsd-security-notifications@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: Reply-To: postmaster@freebsd.org X-Loop: FreeBSD.org -----BEGIN PGP SIGNED MESSAGE----- ============================================================================= FreeBSD-SA-02:09 Security Advisory FreeBSD, Inc. Topic: fstatfs race condition may allow local denial of service via procfs Category: core Module: kernel Announced: 2002-02-06 Credits: Stefan Esser Affects: All released versions of FreeBSD prior to 4.5-RELEASE Corrected: 2002-01-07 20:47:34 UTC (RELENG_4) 2002-01-17 15:46:46 UTC (RELENG_4_4) 2002-01-17 15:47:04 UTC (RELENG_4_3) FreeBSD only: YES I. Background fstatfs() is a function that retrieves filesystem statistics in the kernel. procfs is the process filesystem, which presents a filesystem interface to the system process table and associated data. II. Problem Description A race condition existed where a file could be removed between calling fstatfs() and the point where the file is accessed causing the file descriptor to become invalid. This may allow unprivileged local users to cause a kernel panic. Currently only the procfs filesystem is known to be vulnerable. III. Impact On vulnerable FreeBSD systems where procfs is mounted, unprivileged local users may be able to cause a kernel panic. IV. Workaround Unmount all instances of the procfs filesystem using the umount(8) command by performing the following as root: # umount -f -a -t procfs Disable the automatic mounting of all instances of procfs in /etc/fstab, remove or comment out the line(s) of the following form: proc /proc procfs rw 0 0 Note that unmounting procfs may have a negative impact on the operation of the system: under older versions of FreeBSD it is required for some aspects of the ps(1) command, and unmounting it may also break use of userland inter-process debuggers such as gdb. Other installed binaries including emulated Linux binaries may require access to procfs for correct operation. V. Solution 1) Upgrade your vulnerable FreeBSD system to 4.5-RELEASE or 4.5-STABLE, or the RELENG_4_5, RELENG_4_4, or RELENG_4_3 security branches dated after their respective correction dates. 2) FreeBSD 4.x systems prior to the correction date: The following patch has been verified to apply to all FreeBSD 4.x releases dated prior to the correction date. This patch may or may not apply to older, unsupported releases of FreeBSD. Download the patch and the detached PGP signature from the following locations, and verify the signature using your PGP utility. # fetch ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-02:09/fstatfs.patch # fetch ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-02:09/fstatfs.patch.asc Execute the following commands as root: # cd /usr/src # patch -p < /path/to/patch If procfs is statically compiled into the kernel (i.e. the kernel configuration file contains the line 'options PROCFS'), rebuild and reinstall your kernel as described in http://www.freebsd.org/handbook/kernelconfig.html and reboot the system with the new kernel for the changes to take effect. If procfs is dynamically loaded by KLD (use the kldstat command to verify whether this is the case) and the system securelevel has not been raised, the system can be patched at run-time without requiring a reboot by the execution of the following commands after patching the source as described above: # cd /usr/src/sys/modules/procfs # make depend && make all install # umount -f -a -t procfs # kldunload procfs # kldload procfs # mount -a -t procfs VI. Correction details The following list contains the $FreeBSD$ revision numbers of the file that was corrected in the FreeBSD source. Path Revision Branch - ------------------------------------------------------------------------- src/sys/kern/vfs_syscalls.c HEAD 1.216 RELENG_4 1.151.2.13 RELENG_4_4 1.151.2.9.2.1 RELENG_4_3 1.151.2.7.2.1 - ------------------------------------------------------------------------- VII. References -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.6 (FreeBSD) Comment: For info see http://www.gnupg.org iQCVAwUBPGFTc1UuHi5z0oilAQGoMgP/REVJNr2Y+khbQAVX1VM+bnySdGxFKDVS 0niQ7ZrnI/Ffs7Kw0Nf5T82kvL2gFKRKPW1F2bl+A3qwDO2CBq/mKWLPuP+Ha/Id oLtLeE446o/Gv6wdYpKzcdzUtPFcAhaPdD8DxSmdXyVjXuIYXgojM4wPgQcf5PVL YW7uAAQ2cM0= =T2JK -----END PGP SIGNATURE----- To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security-notifications" in the body of the message From owner-freebsd-security-notifications Wed Feb 6 8: 4:35 2002 Delivered-To: freebsd-security-notifications@freebsd.org Received: from freefall.freebsd.org (freefall.FreeBSD.org [216.136.204.21]) by hub.freebsd.org (Postfix) with ESMTP id 4CA9E37B42A; Wed, 6 Feb 2002 08:04:09 -0800 (PST) Received: (from nectar@localhost) by freefall.freebsd.org (8.11.6/8.11.6) id g16G49W43852; Wed, 6 Feb 2002 08:04:09 -0800 (PST) (envelope-from security-advisories@freebsd.org) Date: Wed, 6 Feb 2002 08:04:09 -0800 (PST) Message-Id: <200202061604.g16G49W43852@freefall.freebsd.org> X-Authentication-Warning: freefall.freebsd.org: nectar set sender to security-advisories@freebsd.org using -f From: FreeBSD Security Advisories To: FreeBSD Security Advisories Subject: FreeBSD Ports Security Advisory FreeBSD-SA-02:10.rsync Sender: owner-freebsd-security-notifications@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: Reply-To: postmaster@freebsd.org X-Loop: FreeBSD.org -----BEGIN PGP SIGNED MESSAGE----- ============================================================================= FreeBSD-SA-02:10 Security Advisory FreeBSD, Inc. Topic: rsync port contains remotely exploitable vulnerability Category: ports Module: rsync Announced: 2002-02-06 Credits: Sebastian Krahmer Affects: Ports collection prior to the correction date Corrected: 2002-01-23 23:32:21 UTC FreeBSD only: NO I. Background rsync is a powerful network file distribution/synchronization utility. II. Problem Description The rsync port, versions prior to rsync-2.5.1_1, is not careful enough about reading integers from the network. In several places, signed and unsigned numbers are mixed, resulting in erroneous computations of buffer offsets. The rsync port is not installed by default, nor is it "part of FreeBSD" as such: it is part of the FreeBSD ports collection, which contains over 6000 third-party applications in a ready-to-install format. The ports collection shipped with FreeBSD 4.5 contains the corrected version of this port (rsync-2.5.1_1). FreeBSD makes no claim about the security of these third-party applications, although an effort is underway to provide a security audit of the most security-critical ports. III. Impact A remote attacker may cause rsync to write NUL bytes onto its stack. This can be exploited in order to execute arbitrary code with the privileges of the user running rsync. This is particularly damaging for sites running rsync in server mode, although a hostile server may also affect rsync clients. IV. Workaround 1) Deinstall the rsync ports/packages if you have them installed. V. Solution 1) Upgrade your entire ports collection and rebuild the port. 2) Deinstall the old package and install a new package dated after the correction date, obtained from the following directories: [i386] ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/i386/packages-4-stable/net/rsync-2.5.1_1.tgz ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/i386/packages-5-current/net/rsync-2.5.1_1.tgz [alpha] Packages are not automatically generated for the alpha architecture at this time due to lack of build resources. NOTE: It may be several days before updated packages are available. 3) Download a new port skeleton for the rsync port from: http://www.freebsd.org/ports/ and use it to rebuild the port. 4) Use the portcheckout utility to automate option (3) above. The portcheckout port is available in /usr/ports/devel/portcheckout or the package can be obtained from: ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/i386/packages-4-stable/Latest/portcheckout.tgz ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/i386/packages-5-current/Latest/portcheckout.tgz VI. Correction details The following list contains the $FreeBSD$ revision numbers of each file that was corrected in the FreeBSD source. Path Revision - ------------------------------------------------------------------------- ports/net/rsync/Makefile 1.61 ports/net/rsync/files/patch-251-secfix 1.1 - ------------------------------------------------------------------------- VII. References -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.6 (FreeBSD) Comment: For info see http://www.gnupg.org iQCVAwUBPGFAr1UuHi5z0oilAQFwZwP/fssLUKJ8mnaIPZhCj4XYT1rQJStyXnVQ kI3OFdHX/xoYTEffohoHAJqHkGfVTeriDOgRhEFy9jCreQwsIevyqEKPnBE4Kotx NhdOfLRO+kKndpDj/oqc/rGzm5tuofsg88fw7ZINqZDdQy0OGpbA8mqyB18g1aEL DDA6wACcxbA= =XnJ+ -----END PGP SIGNATURE----- To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security-notifications" in the body of the message