139 lines
4.9 KiB
Text
139 lines
4.9 KiB
Text
-----BEGIN PGP SIGNED MESSAGE-----
|
|
Hash: SHA512
|
|
|
|
=============================================================================
|
|
FreeBSD-EN-16:03.ypclnt Errata Notice
|
|
The FreeBSD Project
|
|
|
|
Topic: YP/NIS client library critical bug
|
|
|
|
Category: core
|
|
Module: ypclnt
|
|
Announced: 2016-01-14
|
|
Credits: Ravi Pokala,
|
|
Lakshmi Narasimhan Sundararajan,
|
|
Fred Lewis,
|
|
Pushkar Kothavade
|
|
Affects: All supported versions of FreeBSD.
|
|
Corrected: 2015-12-21 14:32:29 UTC (stable/10, 10.2-STABLE)
|
|
2016-01-14 09:10:46 UTC (releng/10.2, 10.2-RELEASE-p9)
|
|
2016-01-14 09:11:16 UTC (releng/10.1, 10.1-RELEASE-p26)
|
|
2016-01-13 05:32:24 UTC (stable/9, 9.3-STABLE)
|
|
2016-01-14 09:11:26 UTC (releng/9.3, 9.3-RELEASE-p33)
|
|
|
|
For general information regarding FreeBSD Errata Notices and Security
|
|
Advisories, including descriptions of the fields above, security
|
|
branches, and the following sections, please visit
|
|
<URL:https://security.FreeBSD.org/>.
|
|
|
|
I. Background
|
|
|
|
The YP/NIS subsystem allows network management of passwd, group, netgroup,
|
|
hosts, services, rpc, bootparams and ethers file entries. The ypclnt suite
|
|
provides an interface to the YP subsystem.
|
|
|
|
The standard NIS protocol limits its database entries to YPMAXRECORD (1024
|
|
characters).
|
|
|
|
II. Problem Description
|
|
|
|
There is a bug with the NIS client library, which can lead to an infinite
|
|
loop.
|
|
|
|
III. Impact
|
|
|
|
A server that is deliberately configured to violate the NIS/YP protocol can
|
|
cause a FreeBSD NIS client to be stuck forever.
|
|
|
|
IV. Workaround
|
|
|
|
No workaround is available, but systems that are not configured to use
|
|
NIS/YP are not affected.
|
|
|
|
V. Solution
|
|
|
|
Perform one of the following:
|
|
|
|
1) Upgrade your system to a supported FreeBSD stable or release / security
|
|
branch (releng) dated after the correction date.
|
|
|
|
A reboot is recommended.
|
|
|
|
2) To update your system via a binary patch:
|
|
|
|
Systems running a RELEASE version of FreeBSD on the i386 or amd64
|
|
platforms can be updated via the freebsd-update(8) utility:
|
|
|
|
# freebsd-update fetch
|
|
# freebsd-update install
|
|
|
|
A reboot is recommended.
|
|
|
|
3) To update your system via a source code patch:
|
|
|
|
The following patches have been verified to apply to the applicable
|
|
FreeBSD release branches.
|
|
|
|
a) Download the relevant patch from the location below, and verify the
|
|
detached PGP signature using your PGP utility.
|
|
|
|
# fetch https://security.FreeBSD.org/patches/EN-16:03/yplib.patch
|
|
# fetch https://security.FreeBSD.org/patches/EN-16:03/yplib.patch.asc
|
|
# gpg --verify yplib.patch.asc
|
|
|
|
b) Apply the patch. Execute the following commands as root:
|
|
|
|
# cd /usr/src
|
|
# patch < /path/to/patch
|
|
|
|
c) Recompile the operating system using buildworld and installworld as
|
|
described in <URL:https://www.FreeBSD.org/handbook/makeworld.html>.
|
|
|
|
A reboot is recommended.
|
|
|
|
VI. Correction details
|
|
|
|
The following list contains the correction revision numbers for each
|
|
affected branch.
|
|
|
|
Branch/path Revision
|
|
- -------------------------------------------------------------------------
|
|
stable/9/ r293804
|
|
releng/9.3/ r293896
|
|
stable/10/ r292547
|
|
releng/10.1/ r293894
|
|
releng/10.2/ r293893
|
|
- -------------------------------------------------------------------------
|
|
|
|
To see which files were modified by a particular revision, run the
|
|
following command, replacing NNNNNN with the revision number, on a
|
|
machine with Subversion installed:
|
|
|
|
# svn diff -cNNNNNN --summarize svn://svn.freebsd.org/base
|
|
|
|
Or visit the following URL, replacing NNNNNN with the revision number:
|
|
|
|
<URL:https://svnweb.freebsd.org/base?view=revision&revision=NNNNNN>
|
|
|
|
VII. References
|
|
|
|
<URL:https://reviews.freebsd.org/D4095>
|
|
|
|
The latest revision of this advisory is available at
|
|
<URL:https://security.FreeBSD.org/advisories/FreeBSD-EN-16:03.ypclnt.asc>
|
|
-----BEGIN PGP SIGNATURE-----
|
|
|
|
iQIcBAEBCgAGBQJWl2j1AAoJEO1n7NZdz2rnRZQP/iZq/xlDFZrxwpW4S0GimmmK
|
|
CdB9yE8rITW2XRWIaTW+fj4aqQ8cvD3IpqtgPe1wCXe69XgmICPwwBh/zNB4w0qu
|
|
xmyihP6/2qTLatIq886StqXRkS+05U5y4VoEwFaRkBCy3IWDVXgM41DsRhOuYq3y
|
|
Y72VNeJFSuD+qb0i0B56PpPhaVd7hyEgvuXLXxi3l/BiUMD9t4Z36W8a2IPrF1wa
|
|
wviTB6cr614dzH+Jou+d9ffKoD6TWeZtbcf1jrw12YVBJhPx3vCqPVJGerGRUwVF
|
|
TeD4cUyHmY1nRa4zssKJcbAbgbYGtumRZTysa50eXBVsd7MTloZk0o8Angr6uGeR
|
|
rRo8Sop8PbwWm81Zykb4lIBOVUB4TsEfMjusKhgcJ5kmd+gK8z1ZzE/ZlOes2UJ8
|
|
eH+LOEKjux3c9UKkz6RDWinM277J5fhZ5Zi6jO6n/LrJRKiqKud6VeHQLOElXye7
|
|
/8KFqCaym8JpZ0P3Cywid+2EyqjlNwvsZleDs8EE/d1+60yX+Qm2j+BKAfqhSyLD
|
|
a9TimJTsEMA47Rf3af2lx1q4bnrKJVSBGhNaNzDHe5UIge0FAt8uUwgL/yIDpBlS
|
|
/5TtnD3F30B34482sAf4u/WW/1ipppIFEe8i6d9uwIGjG9Z5eVVom2FJbAHHdVA6
|
|
w8xVZil5irkB2fdI1DOi
|
|
=A4Qy
|
|
-----END PGP SIGNATURE-----
|