146 lines
5.6 KiB
Text
146 lines
5.6 KiB
Text
-----BEGIN PGP SIGNED MESSAGE-----
|
|
Hash: SHA512
|
|
|
|
=============================================================================
|
|
FreeBSD-SA-16:29.bspatch Security Advisory
|
|
The FreeBSD Project
|
|
|
|
Topic: Heap overflow vulnerability in bspatch
|
|
|
|
Category: core
|
|
Module: bsdiff
|
|
Announced: 2016-10-10
|
|
Affects: All supported versions of FreeBSD.
|
|
2016-09-22 21:05:21 UTC (stable/11, 11.0-STABLE)
|
|
2016-09-27 19:36:12 UTC (releng/11.0, 11.0-RELEASE-p1)
|
|
2016-09-22 21:16:54 UTC (stable/10, 10.3-STABLE)
|
|
2016-10-10 07:18:54 UTC (releng/10.3, 10.3-RELEASE-p10)
|
|
2016-10-10 07:18:54 UTC (releng/10.2, 10.2-RELEASE-p23)
|
|
2016-10-10 07:18:54 UTC (releng/10.1, 10.1-RELEASE-p40)
|
|
2016-09-23 01:52:06 UTC (stable/9, 9.3-STABLE)
|
|
2016-10-10 07:19:16 UTC (releng/9.3, 9.3-RELEASE-p48)
|
|
|
|
For general information regarding FreeBSD Security Advisories,
|
|
including descriptions of the fields above, security branches, and the
|
|
following sections, please visit <URL:https://security.FreeBSD.org/>.
|
|
|
|
I. Background
|
|
|
|
The bspatch utility generates newfile from oldfile and patchfile where
|
|
patchfile is a binary patch built by bsdiff(1).
|
|
|
|
II. Problem Description
|
|
|
|
The implementation of bspatch is susceptible to integer overflows with
|
|
carefully crafted input, potentially allowing an attacker who can control
|
|
the patch file to write at arbitrary locations in the heap. This issue
|
|
was partially addressed in FreeBSD-SA-16:25.bspatch, but some possible
|
|
integer overflows remained.
|
|
|
|
III. Impact
|
|
|
|
An attacker who can control the patch file can cause a crash or run arbitrary
|
|
code under the credentials of the user who runs bspatch, in many cases, root.
|
|
|
|
IV. Workaround
|
|
|
|
No workaround is available.
|
|
|
|
V. Solution
|
|
|
|
Upgrade your vulnerable system to a supported FreeBSD stable or
|
|
release / security branch (releng) dated after the correction date.
|
|
|
|
No reboot is needed.
|
|
|
|
Perform one of the following:
|
|
|
|
1) To update your vulnerable system via a binary patch:
|
|
|
|
Systems running a RELEASE version of FreeBSD on the i386 or amd64
|
|
platforms can be updated via the freebsd-update(8) utility.
|
|
|
|
Because this vulnerability exists in bspatch, a component used by
|
|
freebsd-update, a special procedure must be followed to safely update.
|
|
First, truncate bspatch to a zero byte file:
|
|
|
|
# :> /usr/bin/bspatch
|
|
|
|
FreeBSD-update will fall back to replacing bspatch, rather than applying
|
|
a binary patch. Proceed with FreeBSD-update as usual:
|
|
|
|
# freebsd-update fetch
|
|
# freebsd-update install
|
|
|
|
No reboot is needed.
|
|
|
|
2) To update your vulnerable system via a source code patch:
|
|
|
|
The following patches have been verified to apply to the applicable
|
|
FreeBSD release branches.
|
|
|
|
a) Download the relevant patch from the location below, and verify the
|
|
detached PGP signature using your PGP utility.
|
|
|
|
# fetch https://security.FreeBSD.org/patches/SA-16:29/bspatch.patch
|
|
# fetch https://security.FreeBSD.org/patches/SA-16:29/bspatch.patch.asc
|
|
# gpg --verify bspatch.patch.asc
|
|
|
|
b) Apply the patch. Execute the following commands as root:
|
|
|
|
# cd /usr/src
|
|
# patch < /path/to/patch
|
|
|
|
c) Recompile the operating system using buildworld and installworld as
|
|
described in <URL:https://www.FreeBSD.org/handbook/makeworld.html>.
|
|
|
|
VI. Correction details
|
|
|
|
The following list contains the correction revision numbers for each
|
|
affected branch.
|
|
|
|
Branch/path Revision
|
|
- -------------------------------------------------------------------------
|
|
stable/9/ r306222
|
|
releng/9.3/ r306942
|
|
stable/10/ r306215
|
|
releng/10.1/ r306941
|
|
releng/10.2/ r306941
|
|
releng/10.3/ r306941
|
|
stable/11/ r306213
|
|
releng/11.0/ r306379
|
|
- -------------------------------------------------------------------------
|
|
|
|
To see which files were modified by a particular revision, run the
|
|
following command, replacing NNNNNN with the revision number, on a
|
|
machine with Subversion installed:
|
|
|
|
# svn diff -cNNNNNN --summarize svn://svn.freebsd.org/base
|
|
|
|
Or visit the following URL, replacing NNNNNN with the revision number:
|
|
|
|
<URL:https://svnweb.freebsd.org/base?view=revision&revision=NNNNNN>
|
|
|
|
VII. References
|
|
|
|
<URL:https://gist.github.com/anonymous/e48209b03f1dd9625a992717e7b89c4f>
|
|
|
|
The latest revision of this advisory is available at
|
|
<URL:https://security.FreeBSD.org/advisories/FreeBSD-SA-16:29.bspatch.asc>
|
|
-----BEGIN PGP SIGNATURE-----
|
|
Version: GnuPG v2.1.13 (FreeBSD)
|
|
|
|
iQIcBAEBCgAGBQJX+0OmAAoJEO1n7NZdz2rnMHQQALyzQ6rIFLMV+qfIKr/dxUmv
|
|
frrY3rE8GbHNI6UYnlB7T97SZBVG2lOGpUO7sGNzsqAol+aBEn44mX88ijCQk+mc
|
|
pIHcbwACkAG6u5c6nyelHAa3ZLc8PkPbNaryjfc9Y0vZxGFKI5ETpdN1nFxUBKRA
|
|
eGt4h4GW3ZxHTkc3DDogDM6kBds3DYAnQjnqvkH6QesM/cMIdnU2NMjIrYDdtcsJ
|
|
Mp92PqRl8/qCZxcpfoHSl3S190Dmu9KNjEwXdk8gvtr7aTe/OG9fcIOAwIJHMi/n
|
|
E3tojTrSGLl0v9yuznG8rU0Hr6VyFNRv9i5QhPEQF4ZQ0HT2/naV0v/THMB1JdeR
|
|
8rszvO8HIdYkKEYPEp4RZ+QWJX36xK0ZOA0BSF3+OW6VYMIEB+iMvK1xAlGWmyJq
|
|
D6f5AQuw559o4MNZ9gh1tXl+PXjYHvwSOrHb1EZ7mDZ3zVarn8TwUjxaE2ILIhjW
|
|
wS+wqbxZt1eENfKbhLHxSavIE+Bi59ab/iymmOFtFdgDDDpQhzx13MUFM17v270g
|
|
1OCXnx7HLMIr5ibndJBQbjPmZT0InMM9856Hij8UhcFjyFpytCJie7sVcDFG9nNp
|
|
z3VXrSIdEIA5MwaD6MYGW8nUfBwQnD/rSh6t2Tt4qz24FPk9K9pbzpb8CDIOImiF
|
|
GnLZXJQlgmJ55XOa0EgR
|
|
=uRNW
|
|
-----END PGP SIGNATURE-----
|