3571e53040
patches for easier mirroring, to eliminate a special copy, to make www.freebsd.org/security a full copy of security.freebsd.org and be eventually be the same. For now files are just sitting there. The symlinks are missing. Discussed on: www (repository location) Discussed with: simon (so)
123 lines
4.7 KiB
Text
123 lines
4.7 KiB
Text
-----BEGIN PGP SIGNED MESSAGE-----
|
|
|
|
=============================================================================
|
|
FreeBSD-SA-02:42.resolv Security Advisory
|
|
The FreeBSD Project
|
|
|
|
Topic: buffer overrun in resolver
|
|
|
|
Category: core
|
|
Module: libc
|
|
Announced: 2002-11-12
|
|
Credits: KOZUKA Masahiro <kozuka@masahiro.mbox.media.kyoto-u.ac.jp>,
|
|
Mark Andrews <mark.andrews@isc.org>
|
|
Affects: All releases prior to 4.7-RELEASE
|
|
Corrected: 2002-09-22 12:20:23 2002 UTC (RELENG_4)
|
|
2002-10-23 14:48:21 2002 UTC (RELENG_4_6)
|
|
2002-10-23 14:50:52 2002 UTC (RELENG_4_5)
|
|
FreeBSD only: NO
|
|
|
|
I. Background
|
|
|
|
The resolver implements functions for making, sending and interpreting
|
|
query and reply messages with Internet domain name servers.
|
|
Hostnames, IP addresses, and other information are queried using the
|
|
resolver.
|
|
|
|
II. Problem Description
|
|
|
|
Several libc functions --- including getaddrinfo(), gethostbyname(),
|
|
getnetbyname(), and others --- utilize the DNS resolver functions
|
|
res_search, res_query, and/or res_send. These resolver functions all
|
|
return the length of the query response received, which may be larger
|
|
than the buffer supplied to hold the response. When this is the case,
|
|
the resolver-calling function may attempt to read and parse data
|
|
beyond the bounds of the buffer it supplied.
|
|
|
|
III. Impact
|
|
|
|
A malicious attacker could spoof DNS queries with specially crafted
|
|
responses that will not fit in the supplied buffer. This might cause
|
|
some applications to fail (denial-of-service).
|
|
|
|
IV. Workaround
|
|
|
|
There is no known workaround.
|
|
|
|
V. Solution
|
|
|
|
Do one of the following:
|
|
|
|
1) Upgrade your vulnerable system to 4.7-RELEASE or 4.7-STABLE; or to
|
|
the RELENG_4_7, RELENG_4_6 (4.6-RELEASE-p4), or RELENG_4_5
|
|
(4.5-RELEASE-p22) security branch dated after the correction date.
|
|
|
|
2) To patch your present system:
|
|
|
|
The following patch has been verified to apply to FreeBSD 4.5 and
|
|
FreeBSD 4.6 systems.
|
|
|
|
a) Download the relevant patch from the location below, and verify the
|
|
detached PGP signature using your PGP utility.
|
|
|
|
# fetch ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-02:42/resolv.patch
|
|
# fetch ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-02:42/resolv.patch.asc
|
|
|
|
b) Execute the following commands as root:
|
|
|
|
# cd /usr/src
|
|
# patch < /path/to/patch
|
|
|
|
c) Recompile the operating system as described in
|
|
<URL:http://www.freebsd.org/doc/handbook/makeworld.html>.
|
|
|
|
Note that any statically linked applications that are not part of
|
|
the base system (i.e. from the Ports Collection or other 3rd-party
|
|
sources) must be recompiled.
|
|
|
|
All affected applications must be restarted for them to use the
|
|
corrected library. Though not required, rebooting may be the easiest
|
|
way to accomplish this.
|
|
|
|
VI. Correction details
|
|
|
|
The following list contains the revision numbers of each file that was
|
|
corrected in FreeBSD.
|
|
|
|
Path Revision
|
|
Branch
|
|
- -------------------------------------------------------------------------
|
|
src/lib/libc/net/getaddrinfo.c
|
|
RELENG_4 1.9.2.11
|
|
RELENG_4_6 1.9.2.9.2.1
|
|
RELENG_4_5 1.9.2.8.4.1
|
|
src/lib/libc/net/gethostbydns.c
|
|
RELENG_4 1.27.2.3
|
|
RELENG_4_6 1.27.10.2
|
|
RELENG_4_5 1.27.8.2
|
|
src/lib/libc/net/getnetbydns.c
|
|
RELENG_4 1.13.2.3
|
|
RELENG_4_6 1.13.2.1.8.2
|
|
RELENG_4_5 1.13.2.1.6.2
|
|
src/lib/libc/net/name6.c
|
|
RELENG_4 1.6.2.7
|
|
RELENG_4_6 1.6.2.5.8.2
|
|
RELENG_4_5 1.6.2.5.6.2
|
|
src/lib/libc/net/res_mkquery.c
|
|
RELENG_4 1.15.2.2
|
|
RELENG_4_6 1.15.2.1.6.1
|
|
RELENG_4_5 1.15.2.1.4.1
|
|
- -------------------------------------------------------------------------
|
|
|
|
VII. References
|
|
|
|
<URL:http://www.kb.cert.org/vuls/id/738331>
|
|
-----BEGIN PGP SIGNATURE-----
|
|
Version: GnuPG v1.2.1 (FreeBSD)
|
|
|
|
iQCVAwUBPdF49FUuHi5z0oilAQHQyQQAq4hmcQAMIRiQNS9auxWO+Q+xKZyDwpE/
|
|
Pm3SnkJ6TBQGqoYGioDKN1b4P1jPNWsfm8RKO2GLogLYjwl5VfrEhYJAqj/MvxzM
|
|
poDp2PE7EEGk/yXfnTOOdMcBQjqYev+iUYUfvY9tgXbl83O/0iPlxtCHyfbxDQFy
|
|
aICe2zMdmX8=
|
|
=BceR
|
|
-----END PGP SIGNATURE-----
|