149 lines
5.8 KiB
Text
149 lines
5.8 KiB
Text
-----BEGIN PGP SIGNED MESSAGE-----
|
|
Hash: SHA512
|
|
|
|
=============================================================================
|
|
FreeBSD-SA-15:20.expat Security Advisory
|
|
The FreeBSD Project
|
|
|
|
Topic: Multiple integer overflows in expat (libbsdxml) XML parser
|
|
|
|
Category: contrib
|
|
Module: libbsdxml
|
|
Announced: 2015-08-18
|
|
Affects: All supported versions of FreeBSD.
|
|
Corrected: 2015-08-18 19:30:05 UTC (stable/10, 10.2-STABLE)
|
|
2015-08-18 19:30:35 UTC (releng/10.1, 10.1-RELEASE-p18)
|
|
2015-08-18 19:30:17 UTC (releng/10.2, 10.2-RC3-p1)
|
|
2015-08-18 19:30:17 UTC (releng/10.2, 10.2-RELEASE-p1)
|
|
2015-08-18 19:30:05 UTC (stable/9, 9.3-STABLE)
|
|
2015-08-18 19:30:35 UTC (releng/9.3, 9.3-RELEASE-p23)
|
|
CVE Name: CVE-2015-1283
|
|
|
|
For general information regarding FreeBSD Security Advisories,
|
|
including descriptions of the fields above, security branches, and the
|
|
following sections, please visit <URL:https://security.FreeBSD.org/>.
|
|
|
|
I. Background
|
|
|
|
Expat is an XML parser library written in C. It is a stream-oriented
|
|
parser in which an application registers handlers for things the parser
|
|
might find in the XML document (like start tags).
|
|
|
|
The FreeBSD base system ships libexpat as libbsdxml for components that
|
|
need to parse XML data. Some of these applications use the XML parser
|
|
on trusted data from the kernel, for instance the geom(8) configuration
|
|
utilities, while other applications, like tar(1), cpio(1), svnlite(1)
|
|
and unbound-anchor(8), may use the XML parser on input from network or
|
|
the user.
|
|
|
|
II. Problem Description
|
|
|
|
Multiple integer overflows have been discovered in the XML_GetBuffer()
|
|
function in the expat library.
|
|
|
|
III. Impact
|
|
|
|
The integer overflows may be exploited by using specifically crafted XML
|
|
data and lead to infinite loop, or a heap buffer overflow, which results
|
|
in a Denial of Service condition, or enables remote attackers to execute
|
|
arbitrary code.
|
|
|
|
IV. Workaround
|
|
|
|
No workaround is available, but the problem is only exploitable when the
|
|
affected system needs to process data from an untrusted source.
|
|
|
|
Because the library is used by many third party applications, we advise
|
|
system administrators to check and make sure that they have the latest
|
|
expat version as well, and restart all third party services, or reboot
|
|
the system.
|
|
|
|
V. Solution
|
|
|
|
Perform one of the following:
|
|
|
|
1) Upgrade your vulnerable system to a supported FreeBSD stable or
|
|
release / security branch (releng) dated after the correction date.
|
|
|
|
A reboot is not required after updating the base system.
|
|
|
|
2) To update your vulnerable system via a binary patch:
|
|
|
|
Systems running a RELEASE version of FreeBSD on the i386 or amd64
|
|
platforms can be updated via the freebsd-update(8) utility:
|
|
|
|
# freebsd-update fetch
|
|
# freebsd-update install
|
|
|
|
A reboot is not required after updating the base system.
|
|
|
|
3) To update your vulnerable system via a source code patch:
|
|
|
|
The following patches have been verified to apply to the applicable
|
|
FreeBSD release branches.
|
|
|
|
a) Download the relevant patch from the location below, and verify the
|
|
detached PGP signature using your PGP utility.
|
|
|
|
# fetch https://security.FreeBSD.org/patches/SA-15:20/expat.patch
|
|
# fetch https://security.FreeBSD.org/patches/SA-15:20/expat.patch.asc
|
|
# gpg --verify expat.patch.asc
|
|
|
|
b) Apply the patch. Execute the following commands as root:
|
|
|
|
# cd /usr/src
|
|
# patch < /path/to/patch
|
|
|
|
c) Recompile the operating system using buildworld and installworld as
|
|
described in <URL:https://www.FreeBSD.org/handbook/makeworld.html>.
|
|
|
|
The FreeBSD base system do not install daemons that uses the library,
|
|
therefore, a reboot is not required after updating the base system.
|
|
|
|
VI. Correction details
|
|
|
|
The following list contains the correction revision numbers for each
|
|
affected branch.
|
|
|
|
Branch/path Revision
|
|
- -------------------------------------------------------------------------
|
|
stable/9/ r286900
|
|
releng/9.3/ r286902
|
|
stable/10/ r286900
|
|
releng/10.1/ r286902
|
|
releng/10.2/ r286901
|
|
- -------------------------------------------------------------------------
|
|
|
|
To see which files were modified by a particular revision, run the
|
|
following command, replacing NNNNNN with the revision number, on a
|
|
machine with Subversion installed:
|
|
|
|
# svn diff -cNNNNNN --summarize svn://svn.freebsd.org/base
|
|
|
|
Or visit the following URL, replacing NNNNNN with the revision number:
|
|
|
|
<URL:https://svnweb.freebsd.org/base?view=revision&revision=NNNNNN>
|
|
|
|
VII. References
|
|
|
|
<URL:https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1283>
|
|
|
|
The latest revision of this advisory is available at
|
|
<URL:https://security.FreeBSD.org/advisories/FreeBSD-SA-15:20.expat.asc>
|
|
-----BEGIN PGP SIGNATURE-----
|
|
Version: GnuPG v2.1.7 (FreeBSD)
|
|
|
|
iQIcBAEBCgAGBQJV05AOAAoJEO1n7NZdz2rnRPUP/2L0kectacl6IWOOeGFt6QgG
|
|
eRjZ6F53GqOYG3eW6tM71y+Vbeld+HkcMMgsckO4PM1vJg9AbKEJ56DmvGvFQepC
|
|
TBBcbg++VHOB2jilKh/meOiF0sUqwcpSTwOdRREfWTAMXNS5te7kcpuykZoi4R1x
|
|
LupCmRxQtM3taztw0AA/5AVRurmy+i6P9xuUnhGULyCcoi56VI1WvrpTk2KHbi7V
|
|
T5f/Xwf2hPfznJVoxvPjY9YoOlD2Fql0Dc51clJOQ82l9VVD+lP4ISoJmwLqFPKA
|
|
K4ZpiutMkoLda1er4lNaxsH4Ec7Oey4Dx2xpq1/JmQ9tP98Mtq4oaXNZAGminlET
|
|
rNoLOWR72Gg+NEh7Y+Yuu0K3zFmzLLm1pMjYfuIUaseT2qY7CE+qwm58kG6NvC53
|
|
fF+BwofOSaVNX/uzQnbP0iMJbewKXpqNO21CkdaapZVG+sXn8BZF3S1QDAWPaNwV
|
|
cJT9agijNG6pNUESNZcgY0ow/n4B8J+wWwA1KWzBgbedzj0yG8rsmulkCZEpt1hU
|
|
4uHR62Ktvd2IecoRn2gptA6SkpxHHJhzG8uKvDFq9vvzZko31rc3ttLI/Bb5P1QZ
|
|
wqn1hp1sy9hEpoGxFQlYJj4msahR4P7vTt+0cN4dSVwwg08Xbq1TL4b077BR1ZbR
|
|
ymv8Cnwn7Kg5NRBS2GBD
|
|
=4h4f
|
|
-----END PGP SIGNATURE-----
|