164 lines
6.5 KiB
Text
164 lines
6.5 KiB
Text
-----BEGIN PGP SIGNED MESSAGE-----
|
|
Hash: SHA512
|
|
|
|
=============================================================================
|
|
FreeBSD-SA-15:24.rpcbind Security Advisory
|
|
The FreeBSD Project
|
|
|
|
Topic: rpcbind(8) remote denial of service [REVISED]
|
|
|
|
Category: core
|
|
Module: rpcbind
|
|
Announced: 2015-09-29, revised on 2015-10-02
|
|
Affects: All supported versions of FreeBSD.
|
|
Corrected: 2015-10-02 16:36:16 UTC (stable/10, 10.2-STABLE)
|
|
2015-10-02 16:37:06 UTC (releng/10.2, 10.2-RELEASE-p5)
|
|
2015-10-02 16:37:06 UTC (releng/10.1, 10.1-RELEASE-p22)
|
|
2015-10-02 16:36:16 UTC (stable/9, 9.3-STABLE)
|
|
2015-10-02 16:37:06 UTC (releng/9.3, 9.3-RELEASE-p28)
|
|
CVE Name: CVE-2015-7236
|
|
|
|
For general information regarding FreeBSD Security Advisories,
|
|
including descriptions of the fields above, security branches, and the
|
|
following sections, please visit <URL:https://security.FreeBSD.org/>.
|
|
|
|
0. Revision history
|
|
|
|
v1.0 2015-09-29 Initial release.
|
|
v1.1 2015-10-02 Revised patch to address a regression related to NIS usage
|
|
|
|
I. Background
|
|
|
|
Sun RPC is a remote procedure call framework which allows clients to invoke
|
|
procedures in a server process over a network transparently.
|
|
|
|
The rpcbind(8) utility is a server that converts RPC program numbers into
|
|
universal addresses. It must be running on the host to be able to make RPC
|
|
calls on a server on that machine.
|
|
|
|
The Sun RPC framework uses a netbuf structure to represent the transport
|
|
specific form of a universal transport address. The structure is expected
|
|
to be opaque to consumers. In the current implementation, the structure
|
|
contains a pointer to a buffer that holds the actual address.
|
|
|
|
II. Problem Description
|
|
|
|
In rpcbind(8), netbuf structures are copied directly, which would result in
|
|
two netbuf structures that reference to one shared address buffer. When one
|
|
of the two netbuf structures is freed, access to the other netbuf structure
|
|
would result in an undefined result that may crash the rpcbind(8) daemon.
|
|
|
|
III. Impact
|
|
|
|
A remote attacker who can send specifically crafted packets to the rpcbind(8)
|
|
daemon can cause it to crash, resulting in a denial of service condition.
|
|
|
|
IV. Workaround
|
|
|
|
No workaround is available, but systems that do not provide the rpcbind(8)
|
|
service to untrusted systems, or do not provide any RPC services are not
|
|
vulnerable. On FreeBSD, typical RPC based services includes NIS and NFS.
|
|
|
|
Alternatively, rpcbind(8) can be configured to bind on specific IP
|
|
address(es) by using the '-h' option. This may be used to reduce the attack
|
|
vector when the system has multiple network interfaces and when some of them
|
|
would face an untrusted network.
|
|
|
|
V. Solution
|
|
|
|
Perform one of the following:
|
|
|
|
1) Upgrade your vulnerable system to a supported FreeBSD stable or
|
|
release / security branch (releng) dated after the correction date.
|
|
|
|
Restart the applicable daemons, or reboot the system. Because rpcbind(8)
|
|
is an essential service to all RPC service daemons, these daemons may also
|
|
need to be restarted.
|
|
|
|
2) To update your vulnerable system via a binary patch:
|
|
|
|
Systems running a RELEASE version of FreeBSD on the i386 or amd64
|
|
platforms can be updated via the freebsd-update(8) utility:
|
|
|
|
# freebsd-update fetch
|
|
# freebsd-update install
|
|
|
|
Restart the applicable daemons, or reboot the system. Because rpcbind(8)
|
|
is an essential service to all RPC service daemons, these daemons may also
|
|
need to be restarted.
|
|
|
|
3) To update your vulnerable system via a source code patch:
|
|
|
|
The following patches have been verified to apply to the applicable
|
|
FreeBSD release branches.
|
|
|
|
a) Download the relevant patch from the location below, and verify the
|
|
detached PGP signature using your PGP utility.
|
|
|
|
# fetch https://security.FreeBSD.org/patches/SA-15:24/rpcbind.patch
|
|
# fetch https://security.FreeBSD.org/patches/SA-15:24/rpcbind.patch.asc
|
|
# gpg --verify rpcbind.patch.asc
|
|
|
|
# fetch https://security.FreeBSD.org/patches/SA-15:24/rpcbind-00.patch
|
|
# fetch https://security.FreeBSD.org/patches/SA-15:24/rpcbind-00.patch.asc
|
|
# gpg --verify rpcbind-00.patch.asc
|
|
|
|
b) Apply the patch. Execute the following commands as root:
|
|
|
|
# cd /usr/src
|
|
# patch < /path/to/patch
|
|
|
|
c) Recompile the operating system using buildworld and installworld as
|
|
described in <URL:https://www.FreeBSD.org/handbook/makeworld.html>.
|
|
|
|
Restart the applicable daemons, or reboot the system.
|
|
|
|
VI. Correction details
|
|
|
|
The following list contains the correction revision numbers for each
|
|
affected branch.
|
|
|
|
Branch/path Revision
|
|
- -------------------------------------------------------------------------
|
|
stable/9/ r288511
|
|
releng/9.3/ r288512
|
|
stable/10/ r288511
|
|
releng/10.1/ r288512
|
|
releng/10.2/ r288512
|
|
- -------------------------------------------------------------------------
|
|
|
|
To see which files were modified by a particular revision, run the
|
|
following command, replacing NNNNNN with the revision number, on a
|
|
machine with Subversion installed:
|
|
|
|
# svn diff -cNNNNNN --summarize svn://svn.freebsd.org/base
|
|
|
|
Or visit the following URL, replacing NNNNNN with the revision number:
|
|
|
|
<URL:https://svnweb.freebsd.org/base?view=revision&revision=NNNNNN>
|
|
|
|
VII. References
|
|
|
|
<URL:https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7236>
|
|
|
|
<URL:https://bugzilla.suse.com/show_bug.cgi?id=946204>
|
|
|
|
The latest revision of this advisory is available at
|
|
<URL:https://security.FreeBSD.org/advisories/FreeBSD-SA-15:24.rpcbind.asc>
|
|
-----BEGIN PGP SIGNATURE-----
|
|
Version: GnuPG v2.1.8 (FreeBSD)
|
|
|
|
iQIcBAEBCgAGBQJWDrUCAAoJEO1n7NZdz2rnYU0QAL5iWj6a9z50ZGTDJLuE0+Zw
|
|
gDyW9gggo0eBPPuYCOpLr4IIt+0B0AvCVHJKCCc5r7DMptuBDAUtWHeyhvRH4XmU
|
|
rGnweLqI3AzfCSq+CnFV/meJEs+6EaaEGXEarMl+/3YysEMkNEOqO5dEryNaDjK+
|
|
+jF+d2Xv13RZ+i2aDWwteQW+8LLdzhYHXWWM9NV70TubPITyq7iL5TXLTKlfRJKP
|
|
eOyphNeV/x+hpAL8zq5Kyu0AS8FoMWjR1rD/OtumraCI0zJsAxonZTY95WqM7Jl9
|
|
mQwrsxvxUTUmLm+CieNEAAmFMiMBBRv6JeucvVn7I59dIFDSTo2REsVzc+y4zTta
|
|
5PJyy6txlwFSrsNiJrn8aklF3voYQMYuE08jRiHAOqNqGwMuPjDjysMfiK/a1WZM
|
|
7XKgSjQwGjX3ZEk9XIWqE3DjKjpyW24rceNL/AM1gRv4Hw9UDMQLlzoAh6RM8F/3
|
|
GwiU6I5DuXIV942JX25ciHLfCkhoCyE9aEMR90ICQUgxV5xix0PpU5pukPgM9rZN
|
|
CeKKbX3v7GfmIy3oWNc3yby6guqZbWbeDimiyz6WboWVvmiZOTPTjtMLuXLbcaSQ
|
|
KbidUmkNU8SDzHMGXJypZ4DX9wlLFK2Wv3anaQsE/hxwgNPKpSMEZujysJ0tyTc9
|
|
F4iUcG0fCsWryp8DydvE
|
|
=J1ex
|
|
-----END PGP SIGNATURE-----
|