6705d61482
Fix OpenSSL NULL pointer deference vulnerability. [SA-14:09] Add pkg bootstrapping, configuration and public keys. [EN-14:03] Improve build repeatability for kldxref(8). [EN-14:04] Fix data corruption with ciss(4). [EN-14:05]
180 lines
6.9 KiB
Text
180 lines
6.9 KiB
Text
-----BEGIN PGP SIGNED MESSAGE-----
|
|
Hash: SHA512
|
|
|
|
=============================================================================
|
|
FreeBSD-EN-14:03.pkg Errata Notice
|
|
The FreeBSD Project
|
|
|
|
Topic: pkg bootstrapping, configuration and public keys
|
|
|
|
Category: core, packages
|
|
Module: pkg
|
|
Announced: 2014-05-13
|
|
Credits: Baptiste Daroussin, Bryan Drewery
|
|
Affects: All versions of FreeBSD prior to 10.0-RELEASE
|
|
Corrected: 2014-04-15 23:40:47 UTC (stable/8, 8.4-STABLE)
|
|
2014-05-13 23:24:32 UTC (releng/8.4, 8.4-RELEASE-p10)
|
|
2014-03-11 14:48:44 UTC (stable/9, 9.2-STABLE)
|
|
2014-05-13 23:24:14 UTC (releng/9.2, 9.2-RELEASE-p6)
|
|
2014-05-13 23:24:14 UTC (releng/9.1, 9.1-RELEASE-p13)
|
|
|
|
For general information regarding FreeBSD Errata Notices and Security
|
|
Advisories, including descriptions of the fields above, security
|
|
branches, and the following sections, please visit
|
|
<URL:http://security.freebsd.org/>.
|
|
|
|
I. Background
|
|
|
|
The pkg(7) utility is the new package management tool for FreeBSD. The
|
|
FreeBSD project has provided official pkg(7) packages since October 2013
|
|
and signed packages since the pkg-1.2 release in November 2013. The
|
|
signature checking requires known public keys to be installed locally.
|
|
The repository configuration must be installed as well.
|
|
|
|
The base system also includes a pkg(7) bootstrap tool that installs the
|
|
latest real pkg(7) package. The bootstrap tool knows where to find the
|
|
official pkg(7) package but once that is installed the real pkg(7) will
|
|
not know where to find official packages, nor have the known public key
|
|
for signature checking.
|
|
|
|
The bootstrap tool was also improved in 10.0-RELEASE to check the
|
|
signature on the pkg(7) package it is installing.
|
|
|
|
II. Problem Description
|
|
|
|
Only FreeBSD 10.0 has been released with the official repository
|
|
configuration, known public keys, and a bootstrap tool that checks the
|
|
signature of the pkg(7) package it is installing.
|
|
|
|
To allow packages to be used on a system, the configuration must be
|
|
manually setup and keys securely fetched and installed to the proper
|
|
location.
|
|
|
|
III. Impact
|
|
|
|
Releases before 10.0 require manual configuration. Manually configuring the
|
|
pkg(7) signatures could result in insecurely installing the keys or leaving
|
|
the signature checking disabled.
|
|
|
|
The bootstrap tool is not secure on releases prior to 10.0 due to not checking
|
|
the signature and could result in having an unofficial pkg(7) installed due to
|
|
MITM attacks.
|
|
|
|
IV. Workaround
|
|
|
|
To securely install pkg(7) on releases prior to 10.0, install it from ports
|
|
obtained from a secure portsnap checkout:
|
|
|
|
# portsnap fetch extract
|
|
# echo "WITH_PKGNG=yes" >> /etc/make.conf
|
|
# make -C /usr/ports/ports-mgmt/pkg install clean
|
|
|
|
If this is an existing system it may be converted to pkg(7) as well by running:
|
|
|
|
# pkg2ng
|
|
|
|
After this is done /usr/ports may be removed if no longer required.
|
|
|
|
To workaround the configuration and keys being missed, apply the solution in
|
|
this Errata.
|
|
|
|
V. Solution
|
|
|
|
No solution is provided for pkg(7) bootstrap signature checking on releases prior
|
|
to 10.0. Upgrading to 10.0 or stable/9 after r263038 will suffice.
|
|
|
|
To install the configuration and public key in a secure means, perform one of
|
|
the following:
|
|
|
|
1) Upgrade your system to a supported FreeBSD stable or release / security
|
|
branch (releng) dated after the correction date.
|
|
|
|
2) To update your present system via a source code patch:
|
|
|
|
The following patches have been verified to apply to the applicable
|
|
FreeBSD release branches.
|
|
|
|
a) Download the relevant patch from the location below, and verify the
|
|
detached PGP signature using your PGP utility.
|
|
|
|
[FreeBSD 9.2]
|
|
# fetch http://security.FreeBSD.org/patches/EN-14:03/pkg-en-releng-9.2.patch
|
|
# fetch http://security.FreeBSD.org/patches/EN-14:10/pkg-en-releng-9.2.patch.asc
|
|
# gpg --verify pkg-en-releng-9.2.patch.asc
|
|
|
|
[FreeBSD 9.1]
|
|
# fetch http://security.FreeBSD.org/patches/EN-14:03/pkg-en-releng-9.1.patch
|
|
# fetch http://security.FreeBSD.org/patches/EN-14:10/pkg-en-releng-9.1.patch.asc
|
|
# gpg --verify pkg-en-releng-9.1.patch.asc
|
|
|
|
[FreeBSD 8.4]
|
|
# fetch http://security.FreeBSD.org/patches/EN-14:03/pkg-en-releng-8.4.patch
|
|
# fetch http://security.FreeBSD.org/patches/EN-14:03/pkg-en-releng-8.4.patch.asc
|
|
# gpg --verify pkg-en-releng-8.4.patch.asc
|
|
|
|
b) Execute the following commands as root:
|
|
|
|
# cd /usr/src
|
|
# patch < /path/to/patch
|
|
# cd /usr/src/etc/pkg
|
|
# mkdir -p /etc/pkg /usr/share/keys/pkg/trusted /usr/share/keys/pkg/revoked
|
|
# make install
|
|
# cd /usr/src/share/keys/pkg
|
|
# make install
|
|
|
|
3) To update your system via a binary patch:
|
|
|
|
Systems running a RELEASE version of FreeBSD on the i386 or amd64
|
|
platforms can be updated via the freebsd-update(8) utility:
|
|
|
|
# freebsd-update fetch
|
|
# freebsd-update install
|
|
|
|
VI. Correction details
|
|
|
|
The following list contains the revision numbers of each file that was
|
|
corrected in FreeBSD.
|
|
|
|
Branch/path Revision
|
|
- -------------------------------------------------------------------------
|
|
stable/8/ r264519
|
|
releng/8.4/ r265989
|
|
stable/9/ r263937 (*)
|
|
releng/9.1/ r265988
|
|
releng/9.2/ r265988
|
|
- -------------------------------------------------------------------------
|
|
|
|
(*) The actual required changeset consists a series of changes, including
|
|
r263023,r258550,r263050,r263053 and r263937.
|
|
|
|
To see which files were modified by a particular revision, run the
|
|
following command, replacing NNNNNN with the revision number, on a
|
|
machine with Subversion installed:
|
|
|
|
# svn diff -cNNNNNN --summarize svn://svn.freebsd.org/base
|
|
|
|
Or visit the following URL, replacing NNNNNN with the revision number:
|
|
|
|
<URL:http://svnweb.freebsd.org/base?view=revision&revision=NNNNNN>
|
|
|
|
VII. References
|
|
|
|
The latest revision of this Errata Notice is available at
|
|
http://security.FreeBSD.org/advisories/FreeBSD-EN-14:03.pkg.asc
|
|
-----BEGIN PGP SIGNATURE-----
|
|
Version: GnuPG v2.0.22 (FreeBSD)
|
|
|
|
iQIcBAEBCgAGBQJTcq5IAAoJEO1n7NZdz2rnPgsP/i1EV9g4qXg9v6HvakiFFKrv
|
|
51810uJe/Eo9iujDT1TpwuYJuFQPzkW+h4JRvapaSLAMxeLsYqxj8WDuKz0eU6sW
|
|
WjaPv6LZWUG91jHbFr3uEAgLLvkc86kMI/hfSmzq5FY7gsisEKoyfdraR2E63jtp
|
|
BFARxAq9hnddck5zZiX7wCOMtvCVrvrSsozft1p885AUra+Tg9F1RuUloS0CYddD
|
|
FtUb1dPMshkHlqHqC1wGzRfBVFgX7NnXfnxIi2St1ft0tEDKIL+HQgnjU2CwKbK7
|
|
S9ioLYbbUhyo6edpS/4+y5gJ1kVLvlelY4myBHUkSOMJrsxoIBCTuXjdnO9PL5gr
|
|
qpS9R6TQEMF5auEG5aIOwfu5t8wqczAfC4zVzbm4UPakRYPFS0NfvkDGW2Gno7Yh
|
|
iOur/JFLUOqbV9i8UwssS8OzG0cr8EzbZ3iLkVPqt1Cxuxxpx8+NYiYV3F0PMxB8
|
|
iImoOD1BY0lS3x0gqgeZb5ssBk988aVq1cmbrUuriHuKLK/uvSaFHlGXprQyQmTn
|
|
4FEFmMNTCSMbYy3J2daEajUroiZVcBEjORPFR8QYtncRgbzB6u/AjVIo+3Uk/0hj
|
|
paC8dvBikmT7ity3b7YoOvJIJn62XVqrq9srkYowkDuLJ1E8zQqmR2eZUOmf5vG1
|
|
u3zAXa3xup1ginA9Wi6O
|
|
=UI84
|
|
-----END PGP SIGNATURE-----
|