3571e53040
patches for easier mirroring, to eliminate a special copy, to make www.freebsd.org/security a full copy of security.freebsd.org and be eventually be the same. For now files are just sitting there. The symlinks are missing. Discussed on: www (repository location) Discussed with: simon (so)
124 lines
4.2 KiB
Text
124 lines
4.2 KiB
Text
-----BEGIN PGP SIGNED MESSAGE-----
|
|
|
|
=============================================================================
|
|
FreeBSD-SA-00:63 Security Advisory
|
|
FreeBSD, Inc.
|
|
|
|
Topic: getnameinfo function allows remote denial of service
|
|
|
|
Category: core
|
|
Module: libc
|
|
Announced: 2000-11-01
|
|
Credits: Pavel Kankovsky <peak@argo.troja.mff.cuni.cz>
|
|
Affects: FreeBSD 4.x (all releases prior to 4.2), 4.1.1-STABLE prior
|
|
to the correction date.
|
|
Corrected: 2000/09/25 (FreeBSD 4.1.1-STABLE)
|
|
FreeBSD only: NO
|
|
|
|
I. Background
|
|
|
|
The getnameinfo() function is part of the protocol-independent
|
|
resolver library from the KAME project.
|
|
|
|
II. Problem Description
|
|
|
|
An off-by-one error exists in the processing of DNS hostnames which
|
|
allows a long DNS hostname to crash the getnameinfo() function when an
|
|
address resolution of the hostname is performed (e.g. in response to a
|
|
connection to a service which makes use of getnameinfo()).
|
|
|
|
Under the following conditions, this bug can be used as a denial of
|
|
service attack against vulnerable services:
|
|
|
|
* The attacker must control their DNS server.
|
|
* The service must be run as a persistent daemon (i.e. running
|
|
"standalone", not spawned as-needed from a supervisor process such
|
|
as inetd)
|
|
* The daemon must perform the getnameinfo() call on the remote
|
|
hostname prior to forking a child process to handle the connection
|
|
(otherwise it is just the child process which dies, and the parent
|
|
remains running).
|
|
* The daemon is not automatically restarted by a "watchdog" process.
|
|
|
|
All released versions of FreeBSD 4.x prior to the correction date
|
|
including 4.0, 4.1, and 4.1.1 are vulnerable to this problem, but it
|
|
was fixed in the 4.1.1-STABLE branch prior to the release of FreeBSD
|
|
4.2-RELEASE. The FreeBSD 3.x branch is unaffected since it does not
|
|
include the KAME code.
|
|
|
|
Note that this vulnerability is not believed to pose a vulnerability
|
|
for any servers included in the FreeBSD base system. It is only a
|
|
potential problem for certain third party servers fulfilling the above
|
|
conditions (none of which are currently known). Therefore the impact
|
|
on the vast majority of FreeBSD systems is expected to be nonexistent.
|
|
|
|
III. Impact
|
|
|
|
Remote users may be able to cause a very small class of network
|
|
servers to terminate abnormally, causing a denial of service
|
|
condition.
|
|
|
|
IV. Workaround
|
|
|
|
None practical.
|
|
|
|
V. Solution
|
|
|
|
One of the following:
|
|
|
|
1) Upgrade your vulnerable FreeBSD 4.x system to 4.1.1-STABLE after
|
|
the correction date.
|
|
|
|
2) Apply the patch below and recompile the relevant files:
|
|
|
|
Either save this advisory to a file, or download the patch and
|
|
detached PGP signature from the following locations, and verify the
|
|
signature using your PGP utility.
|
|
|
|
ftp://ftp.freebsd.org/pub/FreeBSD/CERT/patches/SA-00:63/getnameinfo.patch
|
|
ftp://ftp.freebsd.org/pub/FreeBSD/CERT/patches/SA-00:63/getnameinfo.patch.asc
|
|
|
|
Execute the following commands as root:
|
|
|
|
# cd /usr/src/lib/libc
|
|
# patch -p < /path/to/patch_or_advisory
|
|
# make depend && make all install
|
|
|
|
Patch for vulnerable systems:
|
|
|
|
--- net/getnameinfo.c 2000/07/05 05:09:17 1.5
|
|
+++ net/getnameinfo.c 2000/09/25 23:04:36 1.6
|
|
@@ -154,12 +153,12 @@
|
|
(flags & NI_DGRAM) ? "udp" : "tcp");
|
|
}
|
|
if (sp) {
|
|
- if (strlen(sp->s_name) > servlen)
|
|
+ if (strlen(sp->s_name) + 1 > servlen)
|
|
return ENI_MEMORY;
|
|
strcpy(serv, sp->s_name);
|
|
} else {
|
|
snprintf(numserv, sizeof(numserv), "%d", ntohs(port));
|
|
- if (strlen(numserv) > servlen)
|
|
+ if (strlen(numserv) + 1 > servlen)
|
|
return ENI_MEMORY;
|
|
strcpy(serv, numserv);
|
|
}
|
|
@@ -253,7 +252,7 @@
|
|
*p = '\0';
|
|
}
|
|
#endif
|
|
- if (strlen(hp->h_name) > hostlen) {
|
|
+ if (strlen(hp->h_name) + 1 > hostlen) {
|
|
freehostent(hp);
|
|
return ENI_MEMORY;
|
|
}
|
|
-----BEGIN PGP SIGNATURE-----
|
|
Version: GnuPG v1.0.4 (FreeBSD)
|
|
Comment: For info see http://www.gnupg.org
|
|
|
|
iQCVAwUBOgCgVlUuHi5z0oilAQGqfwP/SYLG0yD0uR4wdPHy5S9eXH4HqtNrVpF7
|
|
NlN3iMjHrzIDqeFSYoRTbMEhrbTTGMWYIEadadW9zjlnHfGNRniYx2oOhm+0tqsI
|
|
C3wlqsGAo2GXsXfr1hOpcVc1GqLhsK3oLgz9RRMoMlRWJ+K0bHHLwKlB9uEoxPJ2
|
|
X/WHJ//RQXI=
|
|
=YFwv
|
|
-----END PGP SIGNATURE-----
|