132 lines
5 KiB
Text
132 lines
5 KiB
Text
-----BEGIN PGP SIGNED MESSAGE-----
|
|
Hash: SHA512
|
|
|
|
=============================================================================
|
|
FreeBSD-SA-18:15.bootpd Security Advisory
|
|
The FreeBSD Project
|
|
|
|
Topic: bootpd buffer overflow
|
|
|
|
Category: core
|
|
Module: bootpd
|
|
Announced: 2018-12-19
|
|
Credits: Reno Robert
|
|
Affects: All supported versions of FreeBSD.
|
|
Corrected: 2018-12-19 18:17:59 UTC (stable/12, 12.0-STABLE)
|
|
2018-12-19 18:21:07 UTC (releng/12.0, 12.0-RELEASE-p1)
|
|
2018-12-19 18:19:15 UTC (stable/11, 11.2-STABLE)
|
|
2018-12-19 18:22:25 UTC (releng/11.2, 11.2-RELEASE-p7)
|
|
CVE Name: CVE-2018-17161
|
|
|
|
For general information regarding FreeBSD Security Advisories,
|
|
including descriptions of the fields above, security branches, and the
|
|
following sections, please visit <URL:https://security.FreeBSD.org/>.
|
|
|
|
I. Background
|
|
|
|
The bootpd utility implements an Internet Bootstrap Protocol (BOOTP)
|
|
server as defined in RFC951, RFC1532, and RFC1533.
|
|
|
|
II. Problem Description
|
|
|
|
Due to insufficient validation of network-provided data it may be possible
|
|
for a malicious attacker to craft a bootp packet which could cause a stack
|
|
buffer overflow.
|
|
|
|
III. Impact
|
|
|
|
It is possible that the buffer overflow could lead to a Denial of Service
|
|
or remote code execution.
|
|
|
|
IV. Workaround
|
|
|
|
Firewall rules may be used to limit reception of bootp packets to only
|
|
trusted networks or hosts. Note that the bootp protocol is typically
|
|
limited to a common layer 2 broadcast domain, although the bootpgw gateway
|
|
can forward bootp requests and responses between subnets.
|
|
|
|
V. Solution
|
|
|
|
Upgrade your vulnerable system to a supported FreeBSD stable or
|
|
release / security branch (releng) dated after the correction date.
|
|
Restart bootpd if it is running in standalone mode.
|
|
|
|
Perform one of the following:
|
|
|
|
1) To update your vulnerable system via a binary patch:
|
|
|
|
Systems running a RELEASE version of FreeBSD on the i386 or amd64
|
|
platforms can be updated via the freebsd-update(8) utility:
|
|
|
|
# freebsd-update fetch
|
|
# freebsd-update install
|
|
|
|
2) To update your vulnerable system via a source code patch:
|
|
|
|
The following patches have been verified to apply to the applicable
|
|
FreeBSD release branches.
|
|
|
|
a) Download the relevant patch from the location below, and verify the
|
|
detached PGP signature using your PGP utility.
|
|
|
|
# fetch https://security.FreeBSD.org/patches/SA-18:15/bootpd.patch
|
|
# fetch https://security.FreeBSD.org/patches/SA-18:15/bootpd.patch.asc
|
|
# gpg --verify bootpd.patch.asc
|
|
|
|
b) Apply the patch. Execute the following commands as root:
|
|
|
|
# cd /usr/src
|
|
# patch < /path/to/patch
|
|
|
|
c) Recompile the operating system using buildworld and installworld as
|
|
described in <URL:https://www.FreeBSD.org/handbook/makeworld.html>.
|
|
|
|
Restart the applicable daemons, or reboot the system.
|
|
|
|
VI. Correction details
|
|
|
|
The following list contains the correction revision numbers for each
|
|
affected branch.
|
|
|
|
Branch/path Revision
|
|
- -------------------------------------------------------------------------
|
|
stable/12/ r342228
|
|
releng/12.0/ r342230
|
|
stable/11/ r348229
|
|
releng/11.2/ r342231
|
|
- -------------------------------------------------------------------------
|
|
|
|
To see which files were modified by a particular revision, run the
|
|
following command, replacing NNNNNN with the revision number, on a
|
|
machine with Subversion installed:
|
|
|
|
# svn diff -cNNNNNN --summarize svn://svn.freebsd.org/base
|
|
|
|
Or visit the following URL, replacing NNNNNN with the revision number:
|
|
|
|
<URL:https://svnweb.freebsd.org/base?view=revision&revision=NNNNNN>
|
|
|
|
VII. References
|
|
|
|
<URL:https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-17161>
|
|
|
|
The latest revision of this advisory is available at
|
|
<URL:https://security.FreeBSD.org/advisories/FreeBSD-SA-18:15.bootpd.asc>
|
|
-----BEGIN PGP SIGNATURE-----
|
|
|
|
iQKTBAEBCgB9FiEE/A6HiuWv54gCjWNV05eS9J6n5cIFAlwane5fFIAAAAAALgAo
|
|
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldEZD
|
|
MEU4NzhBRTVBRkU3ODgwMjhENjM1NUQzOTc5MkY0OUVBN0U1QzIACgkQ05eS9J6n
|
|
5cKfzg/+PhmA1AKfXFSkeJJPvdF/7hjKpWaCdVAyUZsuWH5L1Tmb4Lc/pLjw22Ba
|
|
Xh/sAKik6pa/nVTZCBgAqoCqmV8CdhScwvRZdVSP5CQ9vnM+6fFcybP0aCZOmiJC
|
|
NGAE8nIBdazqWJfNM9HUSIbdqEOtMlVcyE0Ni/TxzcAFdzFowfDnyRm1wqI4zhM7
|
|
YL7pU0kTYJfydjK540rHB1tNBaYHSJ/6ckK3tkjwjVgMsQwNSizKrPsqycoMlMmD
|
|
TqQMfDwU8W/jFLsr7OZE66eQBysSiuzYAv3IsipL+50SYgS0aoo3LwKrCcYGN6c/
|
|
S/0SOfNHDgd/7wregI5adKqWJceaqZCVedSVLm6ZaG1Vt3alIjczX9D7wIjuXPlD
|
|
AkSKa0HnmSwDC8yWLJYMxuny7vy3uBAUnPiwIT3RrsDC0b28/uwNPbeSbG0Wrf9F
|
|
21PDMfeCPc2Vr/TVj9uSIo20pNtVhy+tGbx1Ilsgi3POa3n7pTOuFWHMzQVe3rZA
|
|
DLYEbliPxpq9NFJ/2UZQg25weOD5ygwaYZnbsXAMY47D4kteeQOjzomgiacVhE56
|
|
oT8z804nGgGdCe4LpiHihDVzCbBvvuEPw9Edffzm7EWykpy7qn/aJQehfPfcfbeA
|
|
dvQ5khiLr0rMUeg9HU6oHu8+Lp4X+wQc3lCF2rXe+oqRierywec=
|
|
=jlRR
|
|
-----END PGP SIGNATURE-----
|