From owner-freebsd-announce Mon Jul 9 8:47:31 2001 Delivered-To: freebsd-announce@freebsd.org Received: from fledge.watson.org (fledge.watson.org [204.156.12.50]) by hub.freebsd.org (Postfix) with ESMTP id 8F58037B401 for ; Mon, 9 Jul 2001 08:47:25 -0700 (PDT) (envelope-from robert@fledge.watson.org) Received: from fledge.watson.org (robert@fledge.pr.watson.org [192.0.2.3]) by fledge.watson.org (8.11.3/8.11.3) with SMTP id f69Fl5r86000 for ; Mon, 9 Jul 2001 11:47:05 -0400 (EDT) (envelope-from robert@fledge.watson.org) Date: Mon, 9 Jul 2001 11:47:05 -0400 (EDT) From: Robert Watson X-Sender: robert@fledge.watson.org To: freebsd-announce@FreeBSD.org Subject: NAI Labs Announces DARPA-Funded FreeBSD Security Initiative Message-ID: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Sender: owner-freebsd-announce@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.org NAI Labs Announces DARPA-Funded FreeBSD Security Initiative Monday, July 09, 2001 NAI Labs Partners With DARPA to Secure Open Source Operating System $1.2 Million Contract to Enhance Operating System Security Services NAI Labs, the advanced research group within PGP Security, a division of Network Associates, Inc., announced a $1.2 million contract awarded by the U.S. Navy's Space and Warfare Systems Command to develop security extensions to the Open Source FreeBSD operating system. This work, which is funded under the Defense Advanced Research Projects Agency (DARPA), will be done in partnership with members of the FreeBSD developer community, assuring tight system integration and rapid technology transfer. The project will be lead by NAI Labs Research Scientist Robert Watson, and NAI Labs Chief Scientist Lee Badger. The work will be done in part by sub-contractors from the FreeBSD development community, including Kirk McKusick, Poul-Henning Kamp, Jonathan Lemon, and Eivind Eklund. The $1.2 million will be paid over the life of an 18-month contract. Today's evolving military and business processes increasingly rely on Open Source systems to power network infrastructure, network services, file and database servers, and workstation environments. Unfortunately, these systems have traditionally lacked advanced security features, such as Mandatory Access Control, required for secure environments. Likewise, other advanced security techniques developed by the security research community have often failed to transition to off-the-shelf systems. The Community-Based Open Source Security (CBOSS) initiative will address these challenges through close collaboration with the FreeBSD developer community. FreeBSD is an advanced, high-performance operating system widely used by Internet Service Providers (ISPs), and as the basis for embedded network products including routers and firewalls, due to its scalability, ease of management, and cost effective operation. The system has also formed the basis for substantial parts of Apple's Mac OS X next generation operating system, as well as products from a variety of other operating system vendors. NAI Labs, in cooperation with a number of key FreeBSD developers, will enhance the FreeBSD operating system to offer several new security services, as well as improved assurance, providing a direct technology transfer path for security research. This will include the development or porting of specific security technologies, including NAI Labs' LOMAC, development of highly integrated file system and device extensibility services to support security features, network stack hardening, kernel security model extensibility allowing tightly integrated mandatory access control, and application security work. Several of these components are based on or contribute to work performed as part of the TrustedBSD Project, a project which seeks to introduce trusted operating system functionality into the FreeBSD operating system. The Composable High Assurance Trusted Systems (CHATS) program at DARPA will focus on the development of the tools and technology that enable the core systems and network services to protect themselves from the introduction and execution of malicious code and other attack techniques and methods. These tools and technologies aim to provide the high assurance trusted operating systems the security services needed to achieve comprehensive secure highly distributed mission critical information systems for the DoD. This program seeks to enhance the existing approach to development and acquisition of high assurance trusted operating systems technology by advancing the security functionality, security services, and the state of assurance in current open-source operating systems and developing a long-term architectural framework for future trusted operating systems. For more information on NAI Labs, please see: http://www.nailabs.com/ For more information on the CBOSS initiative, please see: http://opensource.nailabs.com/news/20010709-cboss.html http://opensource.nailabs.com/initiatives/cboss/ This is the moderated mailing list freebsd-announce. The list contains announcements of new FreeBSD capabilities, important events and project milestones. See also the FreeBSD Web pages at http://www.freebsd.org To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-announce" in the body of the message From owner-freebsd-announce Mon Jul 9 9:30:12 2001 Delivered-To: freebsd-announce@freebsd.org Received: from freefall.freebsd.org (freefall.freebsd.org [216.136.204.21]) by hub.freebsd.org (Postfix) with ESMTP id D4EBC37B40A; Mon, 9 Jul 2001 09:30:00 -0700 (PDT) (envelope-from security-advisories@FreeBSD.org) Received: (from kris@localhost) by freefall.freebsd.org (8.11.3/8.11.3) id f69GU0k91455; Mon, 9 Jul 2001 09:30:00 -0700 (PDT) (envelope-from security-advisories@FreeBSD.org) Date: Mon, 9 Jul 2001 09:30:00 -0700 (PDT) Message-Id: <200107091630.f69GU0k91455@freefall.freebsd.org> X-Authentication-Warning: freefall.freebsd.org: kris set sender to security-advisories@FreeBSD.org using -f From: FreeBSD Security Advisories To: FreeBSD Security Advisories Subject: FreeBSD Ports Security Advisory FreeBSD-SA-01:41.hanterm Reply-To: security-advisories@FreeBSD.org Sender: owner-freebsd-announce@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.org -----BEGIN PGP SIGNED MESSAGE----- ============================================================================= FreeBSD-SA-01:41 Security Advisory FreeBSD, Inc. Topic: hanterm ports allow local root compromise Category: ports Module: ko-hanterm, ko-hanterm-xf Announced: 2001-07-09 Credits: ksecurity@iland.co.kr Affects: Ports collection prior to the correction date. Corrected: 2001-05-29 Vendor status: Contacted FreeBSD only: NO I. Background hanterm is a modified version of xterm which supports Korean language entry and display. It is included in the FreeBSD ports collection in two versions: ko-hanterm and ko-hanterm-xf. II. Problem Description The hanterm binary is installed with setuid root permissions, but contains insecure code which allows unprivileged local users to obtain root access on the local system. The hanterm ports are not installed by default, nor is it "part of FreeBSD" as such: it is part of the FreeBSD ports collection, which contains over 5400 third-party applications in a ready-to-install format. The ports collections shipped with FreeBSD 4.3 contain this problem since it was discovered after the release. FreeBSD makes no claim about the security of these third-party applications, although an effort is underway to provide a security audit of the most security-critical ports. III. Impact Unprivileged local users can obtain root access on the local system. If you have not chosen to install the ko-hanterm or ko-hanterm-xf ports/packages, then your system is not vulnerable to this problem. IV. Workaround 1) Deinstall the ko-hanterm and ko-hanterm-xf ports/packages, if you have installed them. 2) Remove the setuid root permission from the /usr/X11R6/bin/hanterm file. Execute the following command as root: # chmod u-s /usr/X11R6/bin/hanterm V. Solution One of the following: 1) Upgrade your entire ports collection and rebuild the ko-hanterm/ko-hanterm-xf ports. 2) Deinstall the old package and install a new package dated after the correction date, obtained from: [i386] ko-hanterm: ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/i386/packages-4-stable/korean/ko-hanterm-3.1.5_1.tgz ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/i386/packages-5-current/korean/ko-hanterm-3.1.5_1.tgz ko-hanterm-xf: ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/i386/packages-4-stable/korean/ko-hanterm-xf-19_1.tgz ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/i386/packages-5-current/korean/ko-hanterm-xf-19_1.tgz [alpha] Packages are not automatically generated for the alpha architecture at this time due to lack of build resources. 3) download a new port skeleton for the ko-hanterm/ko-hanterm-xf port from: http://www.freebsd.org/ports/ and use it to rebuild the port. 4) Use the portcheckout utility to automate option (3) above. The portcheckout port is available in /usr/ports/devel/portcheckout or the package can be obtained from: ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/i386/packages-3-stable/devel/portcheckout-2.0.tgz ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/i386/packages-4-stable/devel/portcheckout-2.0.tgz ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/alpha/packages-4-stable/devel/portcheckout-2.0.tgz ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/i386/packages-5-current/devel/portcheckout-2.0.tgz ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/alpha/packages-5-current/devel/portcheckout-2.0.tgz -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.6 (FreeBSD) Comment: For info see http://www.gnupg.org iQCVAwUBO0lzS1UuHi5z0oilAQGuXwP9EZWLrlaxYZYBBFLASErm2PjTSgazT/8c EyrxNw33Qal+xecxopeS3p/3Cf9x/Y0cH53ZMJoId6MaWJSwQOWlVqNC/ehjm2tx NPfLu3eR1JhguFoQ0YRHnMBvX1KBRfVQnfoa7HFd1vPeKEqsaXBvRz8HSurpgNml nUXVwvklmPc= =W5bd -----END PGP SIGNATURE----- This is the moderated mailing list freebsd-announce. The list contains announcements of new FreeBSD capabilities, important events and project milestones. See also the FreeBSD Web pages at http://www.freebsd.org To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-announce" in the body of the message From owner-freebsd-announce Tue Jul 10 7: 2:34 2001 Delivered-To: freebsd-announce@freebsd.org Received: from freefall.freebsd.org (freefall.freebsd.org [216.136.204.21]) by hub.freebsd.org (Postfix) with ESMTP id 4907737B401; Tue, 10 Jul 2001 07:02:26 -0700 (PDT) (envelope-from security-advisories@FreeBSD.org) Received: (from jedgar@localhost) by freefall.freebsd.org (8.11.3/8.11.3) id f6AE2MU63568; Tue, 10 Jul 2001 07:02:22 -0700 (PDT) (envelope-from security-advisories@FreeBSD.org) Date: Tue, 10 Jul 2001 07:02:22 -0700 (PDT) Message-Id: <200107101402.f6AE2MU63568@freefall.freebsd.org> X-Authentication-Warning: freefall.freebsd.org: jedgar set sender to security-advisories@FreeBSD.org using -f From: FreeBSD Security Advisories To: FreeBSD Security Advisories Subject: FreeBSD Security Advisory FreeBSD-SA-01: Reply-To: security-advisories@FreeBSD.org Sender: owner-freebsd-announce@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.org -----BEGIN PGP SIGNED MESSAGE----- ============================================================================= FreeBSD-SA-01:42 Security Advisory FreeBSD, Inc. Topic: signal handling during exec may allow local root compromise Category: core Module: kernel Announced: 2001-07-10 Credits: Georgi Guninski Affects: All released versions of FreeBSD 4.x, FreeBSD 4.3-STABLE prior to the correction date. Corrected: 2001-07-09 FreeBSD only: Yes I. Background When a process forks, it inherits the parent's signals. When the process execs, the kernel clears the signal handlers because they are not valid in the new address space. II. Problem Description A flaw exists in FreeBSD signal handler clearing that would allow for some signal handlers to remain in effect after the exec. Most of the signals were cleared, but some signal hanlders were not. This allowed an attacker to execute arbitrary code in the context of a setuid binary. All versions of 4.x prior to the correction date including and 4.3-RELEASE are vulnerable to this problem. The problem has been corrected by copying the inherited signal handlers and resetting the signals instead of sharing the signal handlers. III. Impact Local users may be able to gain increased privileges on the local system. IV. Workaround Do not allow untrusted users to gain access to the local system. V. Solution One of the following: 1) Upgrade your vulnerable FreeBSD system to 4.3-STABLE after the correction date. 2) To patch your present system: download the relevant patch from the below location, and execute the following commands as root: [FreeBSD 4.1, 4.2, and 4.3 base systems] This patch has been verified to apply to FreeBSD 4.1, 4.2, and 4.3 only. It may or may not apply to older releases. # fetch ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-01:42/signal-4.3.patch # fetch ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-01:42/signal-4.3.patch.asc Verify the detached PGP signature using your PGP utility. # cd /usr/src/sys/kern # patch -p < /path/to/patch [ Recompile your kernel as described in http://www.freebsd.org/handbook/kernelconfig.html and reboot the system ] -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.6 (FreeBSD) Comment: FreeBSD: The Power To Serve iQCVAwUBO0sBrlUuHi5z0oilAQF4nAP/Wi8RsYGjJQ7NgP/+FwMs8/lekAJ9iEan 3Ph7xpsFEhJFWhCfrhmM71fMnOwpZ5kijztSOEko7TMRzTtG+dZLKcCKmVg+a1dT SJmm2SJp3NE1nlYVqSH1vfVeVcJI5rtAQ33gTPhiL5U26AMr4wep/Elv1p/Shb/D CUpueXr6tEE= =n74Z -----END PGP SIGNATURE----- This is the moderated mailing list freebsd-announce. The list contains announcements of new FreeBSD capabilities, important events and project milestones. See also the FreeBSD Web pages at http://www.freebsd.org To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-announce" in the body of the message From owner-freebsd-announce Tue Jul 10 7:37:27 2001 Delivered-To: freebsd-announce@freebsd.org Received: from freefall.freebsd.org (freefall.freebsd.org [216.136.204.21]) by hub.freebsd.org (Postfix) with ESMTP id 335D437B403; Tue, 10 Jul 2001 07:37:23 -0700 (PDT) (envelope-from security-advisories@FreeBSD.org) Received: (from jedgar@localhost) by freefall.freebsd.org (8.11.3/8.11.3) id f6AEbNQ74336; Tue, 10 Jul 2001 07:37:23 -0700 (PDT) (envelope-from security-advisories@FreeBSD.org) Date: Tue, 10 Jul 2001 07:37:23 -0700 (PDT) Message-Id: <200107101437.f6AEbNQ74336@freefall.freebsd.org> X-Authentication-Warning: freefall.freebsd.org: jedgar set sender to security-advisories@FreeBSD.org using -f From: FreeBSD Security Advisories To: FreeBSD Security Advisories Subject: FreeBSD Ports Security Advisory FreeBSD-SA-01:43.fetchmail Reply-To: security-advisories@FreeBSD.org Sender: owner-freebsd-announce@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.org -----BEGIN PGP SIGNED MESSAGE----- ============================================================================= FreeBSD-SA-01:43 Security Advisory FreeBSD, Inc. Topic: fetchmail contains potentially exploitable buffer overflow Category: ports Module: fetchmail Announced: 2001-07-10 Credits: Wolfram Kleff Affects: Ports collection prior to the correction date. Corrected: 2001-06-15 Vendor status: Updated version released FreeBSD only: NO I. Background fetchmail is a program used to retrieve email from POP and IMAP servers. II. Problem Description The fetchmail port, versions prior to fetchmail-5.8.6, contains a potentially exploitable buffer overflow when rewriting headers longer than 512 bytes. This problem may allow remote users to cause fetchmail to crash and potentially execute arbitrary code as the user running fetchmail. The fetchmail port is not installed by default, nor is it "part of FreeBSD" as such: it is part of the FreeBSD ports collection, which contains over 5400 third-party applications in a ready-to-install format. The ports collection shipped with FreeBSD 4.3 is vulnerable to this problem since it was discovered after its release. FreeBSD makes no claim about the security of these third-party applications, although an effort is underway to provide a security audit of the most security-critical ports. III. Impact Remote users using specially crafted email messages may be able to cause fetchmail to crash and potentially execute arbitrary code as the user running fetchmail. If you have not chosen to install the fetchmail port/package, then your system is not vulnerable to this problem. IV. Workaround Deinstall the fetchmail port/package if you have installed it. V. Solution One of the following: 1) Upgrade your entire ports collection and rebuild the fetchmail port. 2) Deinstall the old package and install a new package dated after the correction date, obtained from the following directories: [i386] ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/i386/packages-4-stable/mail/fetchmail-5.8.6.tgz ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/i386/packages-5-current/mail/fetchmail-5.8.6.tgz [alpha] Packages are not automatically generated for the alpha architecture at this time due to lack of build resources. 3) download a new port skeleton for the fetchmail port from: http://www.freebsd.org/ports/ and use it to rebuild the port. 4) Use the portcheckout utility to automate option (3) above. The portcheckout port is available in /usr/ports/devel/portcheckout or the package can be obtained from: ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/i386/packages-4-stable/devel/portcheckout-2.0.tgz ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/i386/packages-5-current/devel/portcheckout-2.0.tgz -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.6 (FreeBSD) Comment: FreeBSD: The Power To Serve iQCVAwUBO0sNt1UuHi5z0oilAQH3NAP/aozGB400MgGyT/mndBk39Y1tD1aPR1AN yDUG+ddeiskXWjR2UNUd3hqQNJ/8LNMqty8MYOVDB+4S+Pvk4MS2iXcW/4r8yPuT 2V0FfHos3ytxk/mujf7IlVhwp3fnGCFJpFJatgbhUUoU8gakl8BfR87zT77RbiDQ OuGG+fpBKEw= =zCcz -----END PGP SIGNATURE----- This is the moderated mailing list freebsd-announce. The list contains announcements of new FreeBSD capabilities, important events and project milestones. See also the FreeBSD Web pages at http://www.freebsd.org To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-announce" in the body of the message From owner-freebsd-announce Tue Jul 10 7:37:38 2001 Delivered-To: freebsd-announce@freebsd.org Received: from freefall.freebsd.org (freefall.freebsd.org [216.136.204.21]) by hub.freebsd.org (Postfix) with ESMTP id 3E8AA37B401; Tue, 10 Jul 2001 07:37:28 -0700 (PDT) (envelope-from security-advisories@FreeBSD.org) Received: (from jedgar@localhost) by freefall.freebsd.org (8.11.3/8.11.3) id f6AEbSP74342; Tue, 10 Jul 2001 07:37:28 -0700 (PDT) (envelope-from security-advisories@FreeBSD.org) Date: Tue, 10 Jul 2001 07:37:28 -0700 (PDT) Message-Id: <200107101437.f6AEbSP74342@freefall.freebsd.org> X-Authentication-Warning: freefall.freebsd.org: jedgar set sender to security-advisories@FreeBSD.org using -f From: FreeBSD Security Advisories To: FreeBSD Security Advisories Subject: FreeBSD Ports Security Advisory FreeBSD-SA-01:44.gnupg Reply-To: security-advisories@FreeBSD.org Sender: owner-freebsd-announce@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.org -----BEGIN PGP SIGNED MESSAGE----- ============================================================================= FreeBSD-SA-01:44 Security Advisory FreeBSD, Inc. Topic: gnupg contains format string vulnerability Category: ports Module: gnupg Announced: 2001-07-10 Credits: fish stiqz Affects: Ports collection prior to the correction date. Corrected: 2001-05-30 Vendor status: Updated version released FreeBSD only: NO I. Background GnuPG is an implementation of the PGP digital signature/encryption protocol II. Problem Description The gnupg port, versions prior to gnupg-1.0.6, contains a format string vulnerability. If gnupg attempts to decrypt a file whose filename does not end in '.gpg', the filename is copied to the prompt string, allowing a user-supplied format string. This may allow a malicious user to cause arbitrary code to be executed as the user running gnupg. The gnupg port is not installed by default, nor is it "part of FreeBSD" as such: it is part of the FreeBSD ports collection, which contains over 5400 third-party applications in a ready-to-install format. The ports collection shipped with FreeBSD 4.3 is vulnerable to this problem since it was discovered after its release. FreeBSD makes no claim about the security of these third-party applications, although an effort is underway to provide a security audit of the most security-critical ports. III. Impact A malicious user supplying a file to be decrypted by the target user running gnupg may be able to craft a filename causing arbitrary code to be executed as the user running gnupg. If you have not chosen to install the gnupg port/package, then your system is not vulnerable to this problem. IV. Workaround Deinstall the gnupg port/package if you have installed it. V. Solution One of the following: 1) Upgrade your entire ports collection and rebuild the gnupg port. 2) Deinstall the old package and install a new package dated after the correction date, obtained from the following directories: [i386] ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/i386/packages-4-stable/security/gnupg-1.0.6_1.tgz ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/i386/packages-5-current/security/gnupg-1.0.6_1.tgz [alpha] Packages are not automatically generated for the alpha architecture at this time due to lack of build resources. 3) download a new port skeleton for the gnupg port from: http://www.freebsd.org/ports/ and use it to rebuild the port. 4) Use the portcheckout utility to automate option (3) above. The portcheckout port is available in /usr/ports/devel/portcheckout or the package can be obtained from: ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/i386/packages-4-stable/devel/portcheckout-2.0.tgz ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/i386/packages-5-current/devel/portcheckout-2.0.tgz -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.6 (FreeBSD) Comment: FreeBSD: The Power To Serve iQCVAwUBO0sNuVUuHi5z0oilAQEnPAP/XadCoa6avlv67LottE8OKLdxSbMRgVXL haBWIyZTMSLRiwgfiQS1riDXslCT8rI8piXSv5HI1zjT7OgkV6zXXRP2pez/EdLe H9sHUJMZNYP1VRfUUlxkmwfelT9cgD2Di3y9vrDouZTt4B5wEGgrzeNeQq1eFNlc 7SvBBZsxEZQ= =g1DW -----END PGP SIGNATURE----- This is the moderated mailing list freebsd-announce. The list contains announcements of new FreeBSD capabilities, important events and project milestones. See also the FreeBSD Web pages at http://www.freebsd.org To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-announce" in the body of the message From owner-freebsd-announce Tue Jul 10 7:37:45 2001 Delivered-To: freebsd-announce@freebsd.org Received: from freefall.freebsd.org (freefall.freebsd.org [216.136.204.21]) by hub.freebsd.org (Postfix) with ESMTP id 494D537B403; Tue, 10 Jul 2001 07:37:33 -0700 (PDT) (envelope-from security-advisories@FreeBSD.org) Received: (from jedgar@localhost) by freefall.freebsd.org (8.11.3/8.11.3) id f6AEbXo74349; Tue, 10 Jul 2001 07:37:33 -0700 (PDT) (envelope-from security-advisories@FreeBSD.org) Date: Tue, 10 Jul 2001 07:37:33 -0700 (PDT) Message-Id: <200107101437.f6AEbXo74349@freefall.freebsd.org> X-Authentication-Warning: freefall.freebsd.org: jedgar set sender to security-advisories@FreeBSD.org using -f From: FreeBSD Security Advisories To: FreeBSD Security Advisories Subject: FreeBSD Ports Security Advisory FreeBSD-SA-01:45.samba Reply-To: security-advisories@FreeBSD.org Sender: owner-freebsd-announce@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.org -----BEGIN PGP SIGNED MESSAGE----- ============================================================================= FreeBSD-SA-01:45 Security Advisory FreeBSD, Inc. Topic: samba Category: ports Module: samba Announced: 2001-07-10 Credits: Michal Zalewski Affects: Ports collection prior to the correction date. Corrected: 2001-06-23 Vendor status: Updated version released FreeBSD only: NO I. Background Samba is an implementation of the Server Message Block (SMB) protocol. II. Problem Description The samba ports, versions prior to samba-2.0.10, samba-devel-2.2.0a, and ja-samba-2.0.9.j1.0_1, fail to properly validate NetBIOS names. By sending a specially crafted NetBIOS name containing unix path characters, a remote user may be able to cause the samba server to write the log files to arbitrary locations on the local filesystems. If samba is configured to use the '%m' macro in the 'log file' directive, the NetBIOS name will be substituted without sanity checking. This will allow the remote user to insert arbitrary paths given the 15 character NetBIOS name limit. However, if a local user can create symlinks accessible via this problem, a remote user may be able to append to any arbitrary file or filesystem. The samba port is not installed by default, nor is it "part of FreeBSD" as such: it is part of the FreeBSD ports collection, which contains over 5400 third-party applications in a ready-to-install format. The ports collection shipped with FreeBSD 4.3 is vulnerable to this problem since it was discovered after its release. FreeBSD makes no claim about the security of these third-party applications, although an effort is underway to provide a security audit of the most security-critical ports. III. Impact Remote users using specially crafted NetBIOS names may be able to insert arbitrary paths in log file names, causing log files to be written in unintended and inappropriate locations. If a local user can create symlinks accessible via this problem, a remote user may be able to append to any arbitrary file or filesystem. If you have not chosen to install the samba port/package, then your system is not vulnerable to this problem. IV. Workaround Remove all occurrences of the %m macro from smb.conf. Replacing the %m macro with the %I macro (replaced with the IP address of the client machine) is the recommended workaround for most sites. V. Solution One of the following: 1) Upgrade your entire ports collection and rebuild the samba port. 2) Deinstall the old package and install a new package dated after the correction date, obtained from the following directories: [i386] ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/i386/packages-4-stable/net/samba-2.0.10.tgz ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/i386/packages-5-current/net/samba-2.0.10.tgz ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/i386/packages-4-stable/net/samba-2.2.0a.tgz ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/i386/packages-5-current/net/samba-2.2.0a.tgz ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/i386/packages-4-stable/japanese/ja-samba-2.0.9.j1.0_1.tgz ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/i386/packages-5-current/japanese/ja-samba-2.0.9.j1.0_1.tgz [alpha] Packages are not automatically generated for the alpha architecture at this time due to lack of build resources. 3) download a new port skeleton for the samba port from: http://www.freebsd.org/ports/ and use it to rebuild the port. 4) Use the portcheckout utility to automate option (3) above. The portcheckout port is available in /usr/ports/devel/portcheckout or the package can be obtained from: ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/i386/packages-4-stable/devel/portcheckout-2.0.tgz ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/i386/packages-5-current/devel/portcheckout-2.0.tgz -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.6 (FreeBSD) Comment: FreeBSD: The Power To Serve iQCVAwUBO0sNulUuHi5z0oilAQGpUwP9FbgICIWlBI0KeUpp6YHwXUfQejJuls63 lP9lnN25B+aSgXNvXQKaSVgQrWXY7AjdX2hhp/zShIUoDTYt4rVQyByUH4Zdl704 HMzyX7+CiQ4tzG2lXwdHL1Bb1kVHtqX84GTpt+NlnUGSYYzTr/+wKHv04z1nIQ11 Z0Nrmj64Coo= =VgXS -----END PGP SIGNATURE----- This is the moderated mailing list freebsd-announce. The list contains announcements of new FreeBSD capabilities, important events and project milestones. See also the FreeBSD Web pages at http://www.freebsd.org To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-announce" in the body of the message From owner-freebsd-announce Tue Jul 10 7:37:49 2001 Delivered-To: freebsd-announce@freebsd.org Received: from freefall.freebsd.org (freefall.freebsd.org [216.136.204.21]) by hub.freebsd.org (Postfix) with ESMTP id 5594637B405; Tue, 10 Jul 2001 07:37:38 -0700 (PDT) (envelope-from security-advisories@FreeBSD.org) Received: (from jedgar@localhost) by freefall.freebsd.org (8.11.3/8.11.3) id f6AEbcT74355; Tue, 10 Jul 2001 07:37:38 -0700 (PDT) (envelope-from security-advisories@FreeBSD.org) Date: Tue, 10 Jul 2001 07:37:38 -0700 (PDT) Message-Id: <200107101437.f6AEbcT74355@freefall.freebsd.org> X-Authentication-Warning: freefall.freebsd.org: jedgar set sender to security-advisories@FreeBSD.org using -f From: FreeBSD Security Advisories To: FreeBSD Security Advisories Subject: FreeBSD Ports Security Advisory FreeBSD-SA-01:46.w3m Reply-To: security-advisories@FreeBSD.org Sender: owner-freebsd-announce@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.org -----BEGIN PGP SIGNED MESSAGE----- ============================================================================= FreeBSD-SA-01:46 Security Advisory FreeBSD, Inc. Topic: w3m contains remotely exploitable buffer overflow Category: ports Module: w3m Announced: 2001-07-10 Credits: OGASAWARA Satoshi (LAC / s.ogaswr@lac.co.jp) KOBAYASHI Shigehiro (LAC / sigehiro@lac.co.jp) Affects: Ports collection prior to the correction date. Corrected: 2001-06-19 Vendor status: Updated version released FreeBSD only: NO I. Background w3m is a console-based web browser. II. Problem Description The w3m port, versions prior to w3m-0.2.1_1, contains a buffer overflow in the parsing of MIME headers. A malicious server which is visited by a user with the w3m browser can exploit the browser security holes in order to execute arbitrary code on the local machine as the local user. The w3m port is not installed by default, nor is it "part of FreeBSD" as such: it is part of the FreeBSD ports collection, which contains over 5400 third-party applications in a ready-to-install format. The ports collection shipped with FreeBSD 4.3 is vulnerable to this problem since it was discovered after its release. FreeBSD makes no claim about the security of these third-party applications, although an effort is underway to provide a security audit of the most security-critical ports. III. Impact A malicious server which is visited by a user with the w3m browser can exploit the browser security holes in order to execute arbitrary code as the local user. If you have not chosen to install the w3m port/package, then your system is not vulnerable to this problem. IV. Workaround Deinstall the w3m port/package if you have installed it. V. Solution One of the following: 1) Upgrade your entire ports collection and rebuild the w3m port. 2) Deinstall the old package and install a new package dated after the correction date, obtained from the following directories: [i386] ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/i386/packages-4-stable/www/w3m-ssl-0.2.1_1.tgz ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/i386/packages-5-current/www/w3m-ssl-0.2.1_1.tgz ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/i386/packages-4-stable/www/w3m-ssl-0.2.1_1.tgz ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/i386/packages-5-current/www/w3m-ssl-0.2.1_1.tgz [alpha] Packages are not automatically generated for the alpha architecture at this time due to lack of build resources. 3) download a new port skeleton for the w3m port from: http://www.freebsd.org/ports/ and use it to rebuild the port. 4) Use the portcheckout utility to automate option (3) above. The portcheckout port is available in /usr/ports/devel/portcheckout or the package can be obtained from: ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/i386/packages-4-stable/devel/portcheckout-2.0.tgz ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/i386/packages-5-current/devel/portcheckout-2.0.tgz -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.6 (FreeBSD) Comment: FreeBSD: The Power To Serve iQCVAwUBO0sQOFUuHi5z0oilAQG5DAP9EbxSc5vGjRnQCV5Nvs2x5pF/ZHvErLab 164B1fsx02DGCJ6wxi/7Di68DM6BoQ+LTSuWvC0f1HXEhUSa9F9+tDjl+bZ+8Mn8 3p0x3mT1wjajkW0ejOuochFnnQv0Yhwdx2Wc7UhtFyQOKTElNbt5/yN0XnFvjVtj h7/liv1MgbE= =a/OU -----END PGP SIGNATURE----- This is the moderated mailing list freebsd-announce. The list contains announcements of new FreeBSD capabilities, important events and project milestones. See also the FreeBSD Web pages at http://www.freebsd.org To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-announce" in the body of the message From owner-freebsd-announce Tue Jul 10 7:37:53 2001 Delivered-To: freebsd-announce@freebsd.org Received: from freefall.freebsd.org (freefall.freebsd.org [216.136.204.21]) by hub.freebsd.org (Postfix) with ESMTP id 621E037B401; Tue, 10 Jul 2001 07:37:43 -0700 (PDT) (envelope-from security-advisories@FreeBSD.org) Received: (from jedgar@localhost) by freefall.freebsd.org (8.11.3/8.11.3) id f6AEbhf74373; Tue, 10 Jul 2001 07:37:43 -0700 (PDT) (envelope-from security-advisories@FreeBSD.org) Date: Tue, 10 Jul 2001 07:37:43 -0700 (PDT) Message-Id: <200107101437.f6AEbhf74373@freefall.freebsd.org> X-Authentication-Warning: freefall.freebsd.org: jedgar set sender to security-advisories@FreeBSD.org using -f From: FreeBSD Security Advisories To: FreeBSD Security Advisories Subject: FreeBSD Ports Security Advisory FreeBSD-SA-01:47.xinetd Reply-To: security-advisories@FreeBSD.org Sender: owner-freebsd-announce@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.org -----BEGIN PGP SIGNED MESSAGE----- ============================================================================= FreeBSD-SA-01:47 Security Advisory FreeBSD, Inc. Topic: xinetd contains multiple vulnerabilities Category: ports Module: xinetd Announced: 2001-07-10 Credits: zen-parse@gmx.net Affects: Ports collection prior to the correction date. Corrected: 2001-06-30 Vendor status: Updated version released FreeBSD only: NO I. Background xinetd is a replacement for inetd, the internet super-server. II. Problem Description The xinetd port, versions prior to xinetd-2.3.0, contains a potentially exploitable buffer overflow in the logging routines. If xinetd is configured to log the userid of remote clients obtained via the RFC1413 ident service, a remote user may be able to cause xinetd to crash by returning a specially-crafted ident response. This may also potentially execute arbitrary code as the user running xinetd, normally root. In addition, xinetd used a default umask of 0. This may inadvertently cause applications started by xinetd to create world-writable files unless the applications explicitely set the umask. The xinetd port is not installed by default, nor is it "part of FreeBSD" as such: it is part of the FreeBSD ports collection, which contains over 5400 third-party applications in a ready-to-install format. The ports collection shipped with FreeBSD 4.3 is vulnerable to this problem since it was discovered after its release. FreeBSD makes no claim about the security of these third-party applications, although an effort is underway to provide a security audit of the most security-critical ports. III. Impact Remote users may be able to cause xinetd to crash and potentially execute arbitrary code as the user running xinetd. Processes started by xinetd may inadvertently use a umask of 0, causing files created by these processes to by world-writable. If you have not chosen to install the xinetd port/package, then your system is not vulnerable to this problem. IV. Workaround Deinstall the xinetd port/package if you have installed it. V. Solution One of the following: 1) Upgrade your entire ports collection and rebuild the xinetd port. 2) Deinstall the old package and install a new package dated after the correction date, obtained from the following directories: [i386] ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/i386/packages-4-stable/security/xinetd-2.3.0.tgz ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/i386/packages-5-current/security/xinetd-2.3.0.tgz [alpha] Packages are not automatically generated for the alpha architecture at this time due to lack of build resources. 3) download a new port skeleton for the xinetd port from: http://www.freebsd.org/ports/ and use it to rebuild the port. 4) Use the portcheckout utility to automate option (3) above. The portcheckout port is available in /usr/ports/devel/portcheckout or the package can be obtained from: ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/i386/packages-4-stable/devel/portcheckout-2.0.tgz ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/i386/packages-5-current/devel/portcheckout-2.0.tgz -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.6 (FreeBSD) Comment: FreeBSD: The Power To Serve iQCVAwUBO0sPDlUuHi5z0oilAQFOnAQAnzylUXvLsBiT2F5Mfwn94nd/r7nrP1WI a7hVwyXSYlfBXRFzsyUQsn1ED/t6mNzDKAiztZ7ZzsIfLxgcy7vFyzWmJSqEx6kk pPYzx2KXxB6FXbrSoX1Q4a5WgqWONgFEcG1Vua3nVmApdF0gy8XWinV9I0VWdlVY hQjelLjBi1U= =umCA -----END PGP SIGNATURE----- This is the moderated mailing list freebsd-announce. The list contains announcements of new FreeBSD capabilities, important events and project milestones. See also the FreeBSD Web pages at http://www.freebsd.org To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-announce" in the body of the message