From owner-freebsd-announce@freebsd.org Wed Jul 12 15:20:23 2017 Return-Path: Delivered-To: freebsd-announce@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id CAF8ED99FC0 for ; Wed, 12 Jul 2017 15:20:23 +0000 (UTC) (envelope-from security-advisories@freebsd.org) Received: from freefall.freebsd.org (freefall.freebsd.org [IPv6:2610:1c1:1:6074::16:84]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client CN "freefall.freebsd.org", Issuer "Let's Encrypt Authority X3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id A5F2A6639A; Wed, 12 Jul 2017 15:20:23 +0000 (UTC) (envelope-from security-advisories@freebsd.org) Received: by freefall.freebsd.org (Postfix, from userid 1035) id E83876AB3; Wed, 12 Jul 2017 15:20:22 +0000 (UTC) From: FreeBSD Security Advisories To: FreeBSD Security Advisories Reply-To: freebsd-security@freebsd.org Precedence: bulk Message-Id: <20170712152022.E83876AB3@freefall.freebsd.org> Date: Wed, 12 Jul 2017 15:20:22 +0000 (UTC) Subject: [FreeBSD-Announce] FreeBSD Security Advisory FreeBSD-SA-17:05.heimdal X-BeenThere: freebsd-announce@freebsd.org X-Mailman-Version: 2.1.23 List-Id: "Project Announcements \[moderated\]" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 12 Jul 2017 15:20:23 -0000 -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= FreeBSD-SA-17:05.heimdal Security Advisory The FreeBSD Project Topic: heimdal KDC-REP service name validation vulnerability Category: contrib Module: heimdal Announced: 2017-07-12 Affects: All supported versions of FreeBSD. Corrected: 2017-07-12 07:26:07 UTC (stable/11, 11.1-PRERELEASE) 2017-07-12 08:07:16 UTC (releng/11.1, 11.1-RC2-p1) 2017-07-12 08:07:16 UTC (releng/11.1, 11.1-RC1-p1) 2017-07-12 07:26:07 UTC (stable/11, 11.1-BETA3-p1) 2017-07-12 08:07:36 UTC (releng/11.0, 11.0-RELEASE-p11) 2017-07-12 07:26:07 UTC (stable/10, 10.3-STABLE) 2017-07-12 15:16:01 UTC (releng/10.3, 10.3-RELEASE-p20) CVE Name: CVE-2017-11103 For general information regarding FreeBSD Security Advisories, including descriptions of the fields above, security branches, and the following sections, please visit . I. Background Heimdal implements the Kerberos 5 network authentication protocols. The Kerberos protocol uses "tickets" to authenticate a client to a service. A Key Distribution Center (KDC) is trusted by all principals registered in that administrative "realm" to store a secret key in confidence, of which, the proof of knowledge is used to verify the authenticity of a principal. II. Problem Description There is a programming error in the Heimdal implementation that used an unauthenticated, plain-text version of the KDC-REP service name found in a ticket. III. Impact An attacker who has control of the network between a client and the service it talks to will be able to impersonate the service, allowing a successful man-in-the-middle (MITM) attack that circumvents the mutual authentication. IV. Workaround No workaround is available, but only Kerberos enabled clients are affected. V. Solution Perform one of the following: 1) Upgrade your vulnerable system to a supported FreeBSD stable or release / security branch (releng) dated after the correction date. A reboot is recommended. 2) To update your vulnerable system via a binary patch: Systems running a RELEASE version of FreeBSD on the i386 or amd64 platforms can be updated via the freebsd-update(8) utility: # freebsd-update fetch # freebsd-update install A reboot is recommended. 3) To update your vulnerable system via a source code patch: The following patches have been verified to apply to the applicable FreeBSD release branches. a) Download the relevant patch from the location below, and verify the detached PGP signature using your PGP utility. # fetch https://security.FreeBSD.org/patches/SA-17:05/heimdal.patch # fetch https://security.FreeBSD.org/patches/SA-17:05/heimdal.patch.asc # gpg --verify heimdal.patch.asc b) Apply the patch. Execute the following commands as root: # cd /usr/src # patch < /path/to/patch c) Recompile the operating system using buildworld and installworld as described in . Restart all daemons that use the library, or reboot the system. VI. Correction details The following list contains the correction revision numbers for each affected branch. Branch/path Revision - ------------------------------------------------------------------------- stable/10/ r320907 releng/10.3/ r320915 stable/11/ r320907 releng/11.0/ r320911 releng/11.1/ r320910 - ------------------------------------------------------------------------- To see which files were modified by a particular revision, run the following command, replacing NNNNNN with the revision number, on a machine with Subversion installed: # svn diff -cNNNNNN --summarize svn://svn.freebsd.org/base Or visit the following URL, replacing NNNNNN with the revision number: VII. References The latest revision of this advisory is available at -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.1.21 (FreeBSD) iQIzBAEBCgAdFiEEHPf/b631yp++G4yy7Wfs1l3PaucFAllmPXgACgkQ7Wfs1l3P audcIhAAz/QvL+4RPmTUvCLi8apSyHUCIlgiazrip0k77AQ19k9iLljJJijZu/ol 4f4VPmBh2iAiBsxvALvhljIEQnj4ApeAQrkqzY8ims/4SPJlYw0mBzchAnaJ8MzK 6UbQLWtqfhK67GXnjxXOtUa8LXno4GgOaeaFYYtf3Px0QHoJlMgQ6u1F5upReBur Ux5PGm3aRnjz124ZyW23wdAlZ5I8Y+hWcRQkyfTkFajIBrSjG+VIz2cRbvu1su9N nwCbxFpDt+6qeatmIsfSj7RFcpyYwMwZJXgMcVc0nVR59XhYyya/4GVYu/3mLNpx hDgKoyHiM6olVkB+9mvRi07fjs333fHcRM3z6UeJtGHkCkdCMgm3vElkvi+ubenH vpCrJApOr/qklT/mqlpRuVJ/nlEa/ueyaP4zyi8ts7gM/0Hue+zelHRt7XsfAK6n pwwZqIrZQHq7sxyhaZxgCUb56wc8+O1cxXZK6qSE3DeoE5YYPSqcm5a5tZtLbxI+ e4Bt/DtonZfxS/UEiuSgrg8LAiYAakBh45rmSsMKvz5+fRN+ecPKyMCI//R7uI/c 7sSQnT7A3WC3yHDZDvcYs0XrKNWvv28lZZGM/aVxrPGAiOunijMgORZw4fkoeCFO MmcpIFvJ3LDmkngwmvZjj4gF6Wpw6Lav4zYQWG8NG1sjdciCUkw= =QQ1C -----END PGP SIGNATURE----- From owner-freebsd-announce@freebsd.org Wed Jul 12 15:20:34 2017 Return-Path: Delivered-To: freebsd-announce@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id 7C347D9A024 for ; Wed, 12 Jul 2017 15:20:34 +0000 (UTC) (envelope-from security-advisories@freebsd.org) Received: from freefall.freebsd.org (freefall.freebsd.org [96.47.72.132]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client CN "freefall.freebsd.org", Issuer "Let's Encrypt Authority X3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 572326647D; Wed, 12 Jul 2017 15:20:34 +0000 (UTC) (envelope-from security-advisories@freebsd.org) Received: by freefall.freebsd.org (Postfix, from userid 1035) id 683C46B37; Wed, 12 Jul 2017 15:20:32 +0000 (UTC) From: FreeBSD Errata Notices To: FreeBSD Errata Notices Reply-To: freebsd-stable@freebsd.org Precedence: bulk Message-Id: <20170712152032.683C46B37@freefall.freebsd.org> Date: Wed, 12 Jul 2017 15:20:32 +0000 (UTC) Subject: [FreeBSD-Announce] FreeBSD Errata Notice FreeBSD-EN-17:06.hyperv X-BeenThere: freebsd-announce@freebsd.org X-Mailman-Version: 2.1.23 List-Id: "Project Announcements \[moderated\]" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 12 Jul 2017 15:20:34 -0000 -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= FreeBSD-EN-17:06.hyperv Errata Notice The FreeBSD Project Topic: Boot compatibility improvements with Azure VMs Category: core Module: hyperv/storvsc Announced: 2017-07-12 Credits: Microsoft OSTC Affects: FreeBSD 10.3 Corrected: 2016-10-19 08:45:19 UTC (stable/10, 10.3-STABLE) 2017-07-12 08:07:55 UTC (releng/10.3, 10.3-RELEASE-p20) For general information regarding FreeBSD Errata Notices and Security Advisories, including descriptions of the fields above, security branches, and the following sections, please visit . I. Background Hyper-V is a default hypervisor provided on Windows server by Microsoft. The ATA driver is the legacy storage driver for FreeBSD on Hyperv; now they are replaced by a synthetic driver which has better performance. There are issues when attaching multiple synthetic storage drivers for FreeBSD 10.3 on some of Hyper-V hosts. The CD/DVD cannot be detected in some circumstances which causes provisioning fail on Azure. II. Problem Description The disk INQUIRY response is not complete for FreeBSD 10.3 on some Hyper-V hosts, which will cause the disks to be detached during boot. An interrupt is missing if we allow intr_shuffle_irqs on Hyper-V. III. Impact FreeBSD 10.3 can not be boot properly on a guest system on Hyper-V host. IV. Workaround No workaround is available, however systems not running within Hyper-V or Azure are unaffected. V. Solution Perform one of the following: 1) Upgrade your system to a supported FreeBSD stable or release / security branch (releng) dated after the correction date. A reboot is required. 2) To update your system via a binary patch: Systems running a RELEASE version of FreeBSD on the i386 or amd64 platforms can be updated via the freebsd-update(8) utility: # freebsd-update fetch # freebsd-update install A reboot is required. 3) To update your system via a source code patch: The following patches have been verified to apply to the applicable FreeBSD release branches. a) Download the relevant patch from the location below, and verify the detached PGP signature using your PGP utility. # fetch https://security.FreeBSD.org/patches/EN-17:06/hyperv.patch # fetch https://security.FreeBSD.org/patches/EN-17:06/hyperv.patch.asc # gpg --verify hyperv.patch.asc b) Apply the patch. Execute the following commands as root: # cd /usr/src # patch < /path/to/patch c) Recompile your kernel as described in and reboot the system. VI. Correction details The following list contains the correction revision numbers for each affected branch. Branch/path Revision - ------------------------------------------------------------------------- stable/10/ r307623 releng/10.3/ r320912 - ------------------------------------------------------------------------- To see which files were modified by a particular revision, run the following command, replacing NNNNNN with the revision number, on a machine with Subversion installed: # svn diff -cNNNNNN --summarize svn://svn.freebsd.org/base Or visit the following URL, replacing NNNNNN with the revision number: VII. References The latest revision of this advisory is available at -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.1.21 (FreeBSD) iQIzBAEBCgAdFiEEHPf/b631yp++G4yy7Wfs1l3PaucFAllmPAEACgkQ7Wfs1l3P aucYWA/+MnvacneOAPWlxl5EoZClil8fFLfXvnWocUOxrdKEFdCDR4Kro/a4BvUz gyj6H5sKvM1j3laRZGsUDrK8iQyBwtYSmanCZvRHNau7OHNqy2gbbJaeDN6APy/j Jyp+GrIQa+o3+m15VuC8gZzbobNkdGwp7IS4gBDRC/u804Rij+DG0RMiUF0uZhxX n2JPTmsAKUls1o2H+02gLseDaNGMHkFGv9vGp4s9L6RZHLLcSrw9gYwLZYCb0tFE OyJzpZSSzvXjMprjAD+Ay2CIR2WHSqaxfs2jK4pqwbZnE9mIsW6wm+4FaH+ZLbzO KeMgP9f6T4WByQQEw66fSYufepC4qVDZnmeRwNph6nvv3bgqlpueceq5M+pZMM7k UvEH7I2nNfpAvtM5uzFOqyNNMuMwkLcLm10o/3AXumLKAL2Co5xsiViotryhB/mb XP3l9zvt6uwIlYwOJ0r2i0bbtGrtUZml74iBJU5Wu4ItztWOeCRJCosk+dbc2YZW uYOGwopo5n0SzypWG3CdZpSlhrvKwJrlEFLK6pHXYzC4gL8Wlqw8b/OMeu/yCvH8 MLRsitGiRK5sSSAitLjDqfRbxULq0o5F2K/OKRZw3LHL2m0Z+HNI0B68RTfhXp5U w3QQk20/7A2Au5Tgv9ihmCE7C7TdOYyNaN6n974kZUfaH6ggsmY= =ycJf -----END PGP SIGNATURE-----