126 lines
4.6 KiB
Text
126 lines
4.6 KiB
Text
-----BEGIN PGP SIGNED MESSAGE-----
|
|
Hash: SHA512
|
|
|
|
=============================================================================
|
|
FreeBSD-SA-14:27.stdio Security Advisory
|
|
The FreeBSD Project
|
|
|
|
Topic: Buffer overflow in stdio
|
|
|
|
Category: core
|
|
Module: libc
|
|
Announced: 2014-12-10
|
|
Credits: Adrian Chadd and Alfred Perlstein, Norse Corporation
|
|
Affects: FreeBSD 10.1
|
|
Corrected: 2014-12-10 08:24:02 UTC (stable/10, 10.1-STABLE)
|
|
2014-12-10 08:35:55 UTC (releng/10.1, 10.1-RELEASE-p1)
|
|
CVE Name: CVE-2014-8611
|
|
|
|
For general information regarding FreeBSD Security Advisories,
|
|
including descriptions of the fields above, security branches, and the
|
|
following sections, please visit <URL:http://security.FreeBSD.org/>.
|
|
|
|
I. Background
|
|
|
|
The standard I/O library provides a simple and efficient buffered stream
|
|
I/O interface. The library writes buffered data when it is full or when
|
|
the application explicitly request so by calling the fflush(3) function.
|
|
|
|
II. Problem Description
|
|
|
|
A programming error in the standard I/O library's __sflush() function could
|
|
erroneously adjust the buffered stream's internal state even when no write
|
|
actually occurred in the case when write(2) system call returns an error.
|
|
|
|
III. Impact
|
|
|
|
The accounting mismatch would accumulate, if the caller does not check for
|
|
stream status and will eventually lead to a heap buffer overflow.
|
|
|
|
Such overflows may lead to data corruption or the execution of arbitrary
|
|
code at the privilege level of the calling program.
|
|
|
|
IV. Workaround
|
|
|
|
No workaround is available.
|
|
|
|
V. Solution
|
|
|
|
Perform one of the following:
|
|
|
|
1) Upgrade your vulnerable system to a supported FreeBSD stable or
|
|
release / security branch (releng) dated after the correction date.
|
|
|
|
2) To update your vulnerable system via a binary patch:
|
|
|
|
Systems running a RELEASE version of FreeBSD on the i386 or amd64
|
|
platforms can be updated via the freebsd-update(8) utility:
|
|
|
|
# freebsd-update fetch
|
|
# freebsd-update install
|
|
|
|
3) To update your vulnerable system via a source code patch:
|
|
|
|
The following patches have been verified to apply to the applicable
|
|
FreeBSD release branches.
|
|
|
|
a) Download the relevant patch from the location below, and verify the
|
|
detached PGP signature using your PGP utility.
|
|
|
|
# fetch http://security.FreeBSD.org/patches/SA-14:27/stdio.patch
|
|
# fetch http://security.FreeBSD.org/patches/SA-14:27/stdio.patch.asc
|
|
# gpg --verify stdio.patch.asc
|
|
|
|
b) Apply the patch. Execute the following commands as root:
|
|
|
|
# cd /usr/src
|
|
# patch < /path/to/patch
|
|
|
|
c) Recompile the operating system using buildworld and installworld as
|
|
described in <URL:http://www.FreeBSD.org/handbook/makeworld.html>.
|
|
|
|
Reboot the system.
|
|
|
|
VI. Correction details
|
|
|
|
The following list contains the correction revision numbers for each
|
|
affected branch.
|
|
|
|
Branch/path Revision
|
|
- -------------------------------------------------------------------------
|
|
stable/10/ r275667
|
|
releng/10.1/ r275670
|
|
- -------------------------------------------------------------------------
|
|
|
|
To see which files were modified by a particular revision, run the
|
|
following command, replacing NNNNNN with the revision number, on a
|
|
machine with Subversion installed:
|
|
|
|
# svn diff -cNNNNNN --summarize svn://svn.freebsd.org/base
|
|
|
|
Or visit the following URL, replacing NNNNNN with the revision number:
|
|
|
|
<URL:http://svnweb.freebsd.org/base?view=revision&revision=NNNNNN>
|
|
|
|
VII. References
|
|
|
|
<URL:http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8611>
|
|
|
|
The latest revision of this advisory is available at
|
|
<URL:http://security.FreeBSD.org/advisories/FreeBSD-SA-14:27.stdio.asc>
|
|
-----BEGIN PGP SIGNATURE-----
|
|
|
|
iQIcBAEBCgAGBQJUiA11AAoJEO1n7NZdz2rnZLMP/ic0j0lykvkZ4x39Th4vUIX7
|
|
SCqROB8zxKj8qA3QlXhusaJA9o9hAPX8HA99ZVbDyugz0m4ST0t6JAYL+w3eVYZm
|
|
RpEszshxi7rwUXaoue99lk0JnP2ssZbNZn5y4Z0XCYvingfP7Um6tOG0XqUs+N45
|
|
Mivhuz+JKaFSYG4WwrSIr2pNpn6XnDeGoihtuXOkinBv8Ga3xHyuTY+30vUnEEH+
|
|
Vr2MftHMm3Wo87OM1XhrTQS5jYzD8u0xgwKjcf0/+6Q+iXzLDkk8MfCE1W9SP7FE
|
|
zas1MHxWeV5AICAX0CUI/9R2Zgymi/xJksw4BNZsDyGnOvIRdcMv+0KOWnCn42mk
|
|
HCm2NTyvUM2Cgjbj5T4yICQBEi5dI6WiTp2yKTKQOiqDsszUW1NyqGQdYPfyjjMS
|
|
kQA5RTdGVxwxp8FMnJGvYdlVRZgx5BAI8znhlxxqKs25uhbOnn+zKm+rA2XnLLMk
|
|
sg2V/E906vldjLw8ddvNKm5oy0UkezBj0J1NOgkpN3atvUB8X2H251h2n51+oAbE
|
|
FSd4qqN70vwHdOmIGNrjWZpOqSJzeGs5JjbaxMpo6MoIWJz2zrK2WLiFVWZGohgh
|
|
9TGU6Ubs/yTLLfu1jTDAMl1dbZd1lChmycKRuqTpe56keOlHghquCMxhogWY0PQE
|
|
nE47N3BP/KCtuQw1uxuK
|
|
=F9uH
|
|
-----END PGP SIGNATURE-----
|