From owner-freebsd-announce Mon Aug 19 5:56:33 2002 Delivered-To: freebsd-announce@freebsd.org Received: from mx1.FreeBSD.org (mx1.FreeBSD.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 516B937B401; Mon, 19 Aug 2002 05:56:24 -0700 (PDT) Received: from freefall.freebsd.org (freefall.FreeBSD.org [216.136.204.21]) by mx1.FreeBSD.org (Postfix) with ESMTP id 38F2443E6A; Mon, 19 Aug 2002 05:56:23 -0700 (PDT) (envelope-from security-advisories@freebsd.org) Received: from freefall.freebsd.org (nectar@localhost [127.0.0.1]) by freefall.freebsd.org (8.12.4/8.12.4) with ESMTP id g7JCuNJU018791; Mon, 19 Aug 2002 05:56:23 -0700 (PDT) (envelope-from security-advisories@freebsd.org) Received: (from nectar@localhost) by freefall.freebsd.org (8.12.4/8.12.4/Submit) id g7JCuNpx018789; Mon, 19 Aug 2002 05:56:23 -0700 (PDT) Date: Mon, 19 Aug 2002 05:56:23 -0700 (PDT) Message-Id: <200208191256.g7JCuNpx018789@freefall.freebsd.org> X-Authentication-Warning: freefall.freebsd.org: nectar set sender to security-advisories@freebsd.org using -f From: FreeBSD Security Advisories To: FreeBSD Security Advisories Subject: FreeBSD Security Advisory FreeBSD-SA-02:38.signed-error Reply-To: security-advisories@freebsd.org Sender: owner-freebsd-announce@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.org -----BEGIN PGP SIGNED MESSAGE----- ============================================================================= FreeBSD-SA-02:38.signed-error Security Advisory The FreeBSD Project Topic: Boundary checking errors involving signed integers Category: core Module: sys Announced: 2002-08-19 Credits: Silvio Cesare Affects: All releases of FreeBSD up to and including 4.6.1-RELEASE-p10 Corrected: 2002-08-13 02:42:32 UTC (RELENG_4) 2002-08-13 12:12:36 UTC (RELENG_4_6) 2002-08-13 12:13:05 UTC (RELENG_4_5) 2002-08-13 12:13:49 UTC (RELENG_4_4) FreeBSD only: YES I. Background The issue described in this advisory affects the accept(2), getsockname(2), and getpeername(2) system calls, and the vesa(4) FBIO_GETPALETTE ioctl(2). II. Problem Description A few system calls were identified that contained assumptions that a given argument was always a positive integer, while in fact the argument was handled as a signed integer. As a result, the boundary checking code would fail if the system call were entered with a negative argument. III. Impact The affected system calls could be called with large negative arguments, causing the kernel to return a large portion of kernel memory. Such memory might contain sensitive information, such as portions of the file cache or terminal buffers. This information might be directly useful, or it might be leveraged to obtain elevated privileges in some way. For example, a terminal buffer might include a user-entered password. IV. Workaround None. V. Solution 1) Upgrade your vulnerable system to 4.6.2-RELEASE or 4.6-STABLE; or to any of the RELENG_4_6 (4.6.1-RELEASE-p11), RELENG_4_5 (4.5-RELEASE-p19), or RELENG_4_4 (4.4-RELEASE-p26) security branches dated after the respective correction dates. 2) To patch your present system: a) Download the relevant patch from the location below, and verify the detached PGP signature using your PGP utility. The following patch has been tested to apply to all FreeBSD 4.x releases. # fetch ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-02:38/signed-error.patch # fetch ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-02:38/signed-error.patch.asc b) Apply the patch. # cd /usr/src # patch < /path/to/patch c) Recompile your kernel as described in and reboot the system. VI. Correction details The following list contains the revision numbers of each file that was corrected in FreeBSD. Path Revision Branch - ------------------------------------------------------------------------- src/sys/i386/isa/vesa.c RELENG_4 1.32.2.1 RELENG_4_6 1.32.10.1 RELENG_4_5 1.32.8.1 RELENG_4_4 1.32.6.1 src/sys/kern/uipc_syscalls.c RELENG_4 1.65.2.12 RELENG_4_6 1.65.2.9.6.1 RELENG_4_5 1.65.2.9.4.1 RELENG_4_4 1.65.2.9.2.1 src/sys/conf/newvers.sh RELENG_4_6 1.44.2.23.2.16 RELENG_4_5 1.44.2.20.2.20 RELENG_4_4 1.44.2.17.2.25 - ------------------------------------------------------------------------- -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.7 (FreeBSD) iQCVAwUBPWDpxFUuHi5z0oilAQHCWgP+PmomqbDBiBHKG6JWrx8Kz8M6gnrg4omw w/vH5uK2lHGL6ZGecwvhJOTbV4bKXt1C1dKoUyA7WH7l9nQi+1CrZwT/D5mkteU+ XEqtNfRhiaDokj/5I8MA0OM80+jryeAimxYDEi2vm315RIOMeR/sdP7m7H2vl9cZ V8rt/2zD2wc= =LpMd -----END PGP SIGNATURE----- This is the moderated mailing list freebsd-announce. The list contains announcements of new FreeBSD capabilities, important events and project milestones. See also the FreeBSD Web pages at http://www.freebsd.org To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-announce" in the body of the message From owner-freebsd-announce Tue Aug 20 11:44:32 2002 Delivered-To: freebsd-announce@freebsd.org Received: from mx1.FreeBSD.org (mx1.FreeBSD.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id DAC1937B400 for ; Mon, 19 Aug 2002 09:52:03 -0700 (PDT) Received: from vnode.vmunix.com (vnode.vmunix.com [209.112.4.20]) by mx1.FreeBSD.org (Postfix) with ESMTP id 7E9F743E70 for ; Mon, 19 Aug 2002 09:52:03 -0700 (PDT) (envelope-from chrisc@vmunix.com) Received: by vnode.vmunix.com (Postfix, from userid 1005) id C1E6527; Mon, 19 Aug 2002 12:52:02 -0400 (EDT) Received: from localhost (localhost [127.0.0.1]) by vnode.vmunix.com (Postfix) with ESMTP id B5DBC49A15 for ; Mon, 19 Aug 2002 12:52:02 -0400 (EDT) Date: Mon, 19 Aug 2002 12:52:02 -0400 (EDT) From: Chris Coleman To: announce@freebsd.org Subject: FreeBSD 4.6.2 Security Update CDs Message-ID: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Sender: owner-freebsd-announce@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.org In light of the recent release of FreeBSD 4.6.2 and the numerous security and bug fixes that it incorporates over 4.6-RELEASE, we have decided to make a 2CD Security Update set available for order. We will also be updating the 4.6-RELEASE 4CD CD sets to 4.6.2-RELEASE as well. You can pre-order the CD sets at http://www.bsdmall.com/fbsd462update.html Full CD sets can be ordered here: http://www.bsdmall.com/freebsd462.html Current bsdmall CD subscribers will receive the security update automatically at a reduced price. Chris Coleman Editor in Chief Daemon News E-Zine http://www.daemonnews.org Print Magazine http://magazine.daemonnews.org BSD Mall http://www.bsdmall.com This is the moderated mailing list freebsd-announce. The list contains announcements of new FreeBSD capabilities, important events and project milestones. See also the FreeBSD Web pages at http://www.freebsd.org To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-announce" in the body of the message