3571e53040
patches for easier mirroring, to eliminate a special copy, to make www.freebsd.org/security a full copy of security.freebsd.org and be eventually be the same. For now files are just sitting there. The symlinks are missing. Discussed on: www (repository location) Discussed with: simon (so)
92 lines
3.2 KiB
Text
92 lines
3.2 KiB
Text
-----BEGIN PGP SIGNED MESSAGE-----
|
|
|
|
=============================================================================
|
|
FreeBSD-SA-01:28 Security Advisory
|
|
FreeBSD, Inc.
|
|
|
|
Topic: timed allows remote denial of service
|
|
|
|
Category: core
|
|
Module: timed
|
|
Announced: 2001-03-12
|
|
Credits: Discovered during internal source code auditing
|
|
Affects: All released versions of FreeBSD 3.x, 4.x.
|
|
FreeBSD 3.5-STABLE prior to the correction date.
|
|
FreeBSD 4.2-STABLE prior to the correction date.
|
|
Corrected: 2001-03-10 (FreeBSD 3.5-STABLE)
|
|
2001-01-07 (FreeBSD 4.2-STABLE)
|
|
FreeBSD only: NO
|
|
|
|
I. Background
|
|
|
|
timed(8) is a server for the Time Synchronisation Protocol, for
|
|
synchronising the system clocks of multiple clients.
|
|
|
|
II. Problem Description
|
|
|
|
Malformed packets sent to the timed daemon could cause it to crash,
|
|
thereby denying service to clients if timed is not run under a
|
|
watchdog process which causes it to automatically restart in the event
|
|
of a failure. The timed daemon is not run in this way in the default
|
|
invocation from /etc/rc.conf using the timed_enable variable.
|
|
|
|
The timed daemon is not enabled by default, and its use is not
|
|
recommended (FreeBSD includes ntpd(8), the network time protocol
|
|
daemon, which provides superior functionality).
|
|
|
|
All versions of FreeBSD 3.x and 4.x prior to the correction date
|
|
including 3.5.1-RELEASE and 4.2-RELEASE are vulnerable to this
|
|
problem, if they have been configued to run timed. It was corrected
|
|
prior to the forthcoming release of FreeBSD 4.3.
|
|
|
|
III. Impact
|
|
|
|
Remote users can cause the timed daemon to crash, denying service to
|
|
clients.
|
|
|
|
IV. Workaround
|
|
|
|
Implement packet filtering at perimeter firewalls or on the local
|
|
machine using ipfw(8)/ipf(8) to prevent untrusted users from
|
|
connecting to the timed service. The timed daemon listens on UDP port
|
|
525 by default.
|
|
|
|
V. Solution
|
|
|
|
Upgrade your vulnerable FreeBSD system to 3.5-STABLE or 4.2-STABLE
|
|
after the respective correction dates.
|
|
|
|
To patch your present system: download the relevant patch from the
|
|
below location, and execute the following commands as root:
|
|
|
|
# fetch ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-01:28/timed.patch
|
|
# fetch ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-01:28/timed.patch.asc
|
|
|
|
This patch has been verified to apply to FreeBSD 4.2-RELEASE and
|
|
FreeBSD 3.5.1-RELEASE. It may or may not apply to older releases.
|
|
|
|
Verify the detached PGP signature using your PGP utility.
|
|
|
|
# cd /usr/src/usr.sbin/timed/timed
|
|
# patch -p < /path/to/patch
|
|
# make depend && make all install
|
|
|
|
Kill and restart timed to cause the changes to take effect. If you
|
|
have started timed with non-standard options (e.g. by setting
|
|
timed_flags in /etc/rc.conf) then the below command will need to be
|
|
modified appropriately.
|
|
|
|
# killall -KILL timed
|
|
# /usr/sbin/timed
|
|
|
|
|
|
-----BEGIN PGP SIGNATURE-----
|
|
Version: GnuPG v1.0.4 (FreeBSD)
|
|
Comment: For info see http://www.gnupg.org
|
|
|
|
iQCVAwUBOq1emVUuHi5z0oilAQEYEwP/cPNMQO7LjlEs2/MyxJwVKpQLRzmprJjQ
|
|
i2QpXEvkZgXSxAcIh15jNsR1TPwUnzCRWHZ5touw0DxTbTbMsnzRVx0/P5jGmQCT
|
|
6n5Z11puyEg336zET+tGhVnEt9Ybm7Z/h7Et+njVRTVqbe2AtpFeSbI5NXlZCgs6
|
|
ZUYxdLUhfPM=
|
|
=Dw88
|
|
-----END PGP SIGNATURE-----
|