140 lines
5.3 KiB
Text
140 lines
5.3 KiB
Text
-----BEGIN PGP SIGNED MESSAGE-----
|
|
Hash: SHA512
|
|
|
|
=============================================================================
|
|
FreeBSD-SA-15:04.igmp Security Advisory
|
|
The FreeBSD Project
|
|
|
|
Topic: Integer overflow in IGMP protocol
|
|
|
|
Category: core
|
|
Module: igmp
|
|
Announced: 2015-02-25; Last revised on 2015-04-07
|
|
Credits: Mateusz Kocielski, Logicaltrust,
|
|
Marek Kroemeke, and 22733db72ab3ed94b5f8a1ffcde850251fe6f466
|
|
Affects: All supported versions of FreeBSD.
|
|
Corrected: 2015-04-07 20:20:24 UTC (stable/10, 10.1-STABLE)
|
|
2015-04-07 20:21:01 UTC (releng/10.1, 10.1-RELEASE-p9)
|
|
2015-04-07 20:20:44 UTC (stable/9, 9.3-STABLE)
|
|
2015-04-07 20:21:23 UTC (releng/9.3, 9.3-RELEASE-p13)
|
|
2015-04-07 20:20:44 UTC (stable/8, 8.4-STABLE)
|
|
2015-04-07 20:21:23 UTC (releng/8.4, 8.4-RELEASE-p27)
|
|
CVE Name: CVE-2015-1414
|
|
|
|
For general information regarding FreeBSD Security Advisories,
|
|
including descriptions of the fields above, security branches, and the
|
|
following sections, please visit <URL:https://security.FreeBSD.org/>.
|
|
|
|
0. Revision history
|
|
|
|
v1.0 2015-02-25 Initial release.
|
|
v1.1 2015-04-07 Revised patch to address a potential overflow issue.
|
|
|
|
I. Background
|
|
|
|
IGMP is a control plane protocol used by IPv4 hosts and routers to propagate
|
|
multicast group membership information. IGMP version 3 is implemented on
|
|
FreeBSD.
|
|
|
|
II. Problem Description
|
|
|
|
An integer overflow in computing the size of IGMPv3 data buffer can result
|
|
in a buffer which is too small for the requested operation.
|
|
|
|
III. Impact
|
|
|
|
An attacker who can send specifically crafted IGMP packets could cause a
|
|
denial of service situation by causing the kernel to crash.
|
|
|
|
IV. Workaround
|
|
|
|
Block incoming IGMP packets by protecting your host/networks with a firewall.
|
|
|
|
V. Solution
|
|
|
|
Perform one of the following:
|
|
|
|
1) Upgrade your vulnerable system to a supported FreeBSD stable or
|
|
release / security branch (releng) dated after the correction date.
|
|
|
|
2) To update your vulnerable system via a binary patch:
|
|
|
|
Systems running a RELEASE version of FreeBSD on the i386 or amd64
|
|
platforms can be updated via the freebsd-update(8) utility:
|
|
|
|
# freebsd-update fetch
|
|
# freebsd-update install
|
|
|
|
3) To update your vulnerable system via a source code patch:
|
|
|
|
The following patches have been verified to apply to the applicable
|
|
FreeBSD release branches.
|
|
|
|
a) Download the relevant patch from the location below, and verify the
|
|
detached PGP signature using your PGP utility.
|
|
|
|
# fetch https://security.FreeBSD.org/patches/SA-15:04/igmp.patch
|
|
# fetch https://security.FreeBSD.org/patches/SA-15:04/igmp.patch.asc
|
|
# gpg --verify igmp.patch.asc
|
|
|
|
# fetch https://security.FreeBSD.org/patches/SA-15:04/igmp-errata.patch
|
|
# fetch https://security.FreeBSD.org/patches/SA-15:04/igmp-errata.patch.asc
|
|
# gpg --verify igmp-errata.patch.asc
|
|
|
|
b) Apply the patch. Execute the following commands as root:
|
|
|
|
# cd /usr/src
|
|
# patch < /path/to/patch
|
|
|
|
c) Recompile your kernel as described in
|
|
<URL:https://www.FreeBSD.org/handbook/kernelconfig.html> and reboot the
|
|
system.
|
|
|
|
VI. Correction details
|
|
|
|
The following list contains the correction revision numbers for each
|
|
affected branch.
|
|
|
|
Branch/path Revision
|
|
- -------------------------------------------------------------------------
|
|
stable/8/ r281231
|
|
releng/8.4/ r281233
|
|
stable/9/ r281231
|
|
releng/9.3/ r281233
|
|
stable/10/ r281230
|
|
releng/10.1/ r281232
|
|
- -------------------------------------------------------------------------
|
|
|
|
To see which files were modified by a particular revision, run the
|
|
following command, replacing NNNNNN with the revision number, on a
|
|
machine with Subversion installed:
|
|
|
|
# svn diff -cNNNNNN --summarize svn://svn.freebsd.org/base
|
|
|
|
Or visit the following URL, replacing NNNNNN with the revision number:
|
|
|
|
<URL:https://svnweb.freebsd.org/base?view=revision&revision=NNNNNN>
|
|
|
|
VII. References
|
|
|
|
<URL:https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1414>
|
|
|
|
The latest revision of this advisory is available at
|
|
<URL:https://security.FreeBSD.org/advisories/FreeBSD-SA-15:04.igmp.asc>
|
|
-----BEGIN PGP SIGNATURE-----
|
|
Version: GnuPG v2.1.2 (FreeBSD)
|
|
|
|
iQIcBAEBCgAGBQJVJD39AAoJEO1n7NZdz2rnewwQAN9xI01nzOO71Q7qP7xDq+wu
|
|
RW2C+2A4viIZIId1od6GiDY7Qpigy1CMwHsae6qJ62R+D5F2x9vANV4U6AS44oNy
|
|
2jDwbrByM7QQ3qeCh8NzCUvOwPuXyKsAGKV73t3QPk0leKdbqUyjTooWJtZAv0dN
|
|
VgQ4VCQh+2ZlxjMT0igUScmCVqOncRUm33xKBLeTif5LZHi/afkR6CToMlACOvl3
|
|
syJNhEeM+zYU9XLzb90hAjvqn1xLDkoS4qJNbrekj0/dI0jkgZdk18QAualwWgeZ
|
|
i39Da6IQ4wCn8Sx9o8pc8NdtzHn37rmOcdzBIodzxa1vALmNhDWuBpIIysffsZvf
|
|
ewVdI83pabRdZZxO1YAPjJi34CTXmvwf8Hit/hh0n1AO21lhr0NhwQzEn7gmLqSh
|
|
JZYg46k6tNGy6qUa1NU/ywja0kLCG0KdR1FO9IKaN6TCgB30bpndGq1Y0esX1Mo8
|
|
5xq/P/KoNPE9BzifyhbDBt77eEmfpiKIuQXQVP3B1n3KEDDUlSSeiz3x0h9ZOjfm
|
|
vLb1hinfp1RPC4S72a0Zts6r60aee9dMWd/DvC8RqWQqEE0PUamipL2ClzBmOpTK
|
|
F9b2y9776hfPV/mvGUwS7H63mAMJkMOTDGZn3WWIT3Dmr6Eru0/t1XXqCPB4cNUl
|
|
uf5sxNtEDjXadkeM20lu
|
|
=y2yR
|
|
-----END PGP SIGNATURE-----
|