3571e53040
patches for easier mirroring, to eliminate a special copy, to make www.freebsd.org/security a full copy of security.freebsd.org and be eventually be the same. For now files are just sitting there. The symlinks are missing. Discussed on: www (repository location) Discussed with: simon (so)
126 lines
5 KiB
Text
126 lines
5 KiB
Text
-----BEGIN PGP SIGNED MESSAGE-----
|
|
|
|
=============================================================================
|
|
FreeBSD-SA-02:26.accept Security Advisory
|
|
The FreeBSD Project
|
|
|
|
Topic: Remote denial-of-service when using accept filters
|
|
|
|
Category: core
|
|
Module: kernel
|
|
Announced: 2002-05-29
|
|
Credits: Mike Silbersack <silby@FreeBSD.org>
|
|
Affects: FreeBSD 4.5-RELEASE
|
|
FreeBSD 4-STABLE after 2001-11-22 and prior to the
|
|
correction date
|
|
Corrected: 2002-05-21 18:03:16 UTC (RELENG_4)
|
|
2002-05-28 18:27:55 UTC (RELENG_4_5)
|
|
FreeBSD only: YES
|
|
|
|
I. Background
|
|
|
|
FreeBSD features an accept_filter(9) mechanism which allows an
|
|
application to request that the kernel pre-process incoming connections.
|
|
For example, the accf_http(9) accept filter prevents accept(2) from
|
|
returning until a full HTTP request has been buffered.
|
|
|
|
No accept filters are enabled by default. A system administrator must
|
|
either compile the FreeBSD kernel with a particular accept filter
|
|
option (such as ACCEPT_FILTER_HTTP) or load the filter using
|
|
kldload(8) in order to utilize accept filters.
|
|
|
|
II. Problem Description
|
|
|
|
In the process of adding a syncache to FreeBSD, mechanisms to remove
|
|
entries from the incomplete listen queue were removed, as only sockets
|
|
undergoing accept filtering now use the incomplete queue.
|
|
|
|
III. Impact
|
|
|
|
By simply connecting to a socket using accept filtering and holding a
|
|
few hundred sockets open (~190 with the default backlog value), one
|
|
may deny access to a service. In addition to malicious users, this
|
|
affect has also been reported to be caused by worms such as Code Red
|
|
which generate URLs that do not meet the http accept filter's
|
|
criteria.
|
|
|
|
Systems are not affected by this bug unless they have enabled accept
|
|
filters in the kernel and are utilizing an application configured to
|
|
take advantage of this feature. Apache (versions 1.3.14 and later) is
|
|
the only application known to utilize accept filters by default.
|
|
|
|
IV. Workaround
|
|
|
|
Do not use accept filters. If you have enabled the ACCEPT_FILTER_DATA
|
|
or ACCEPT_FILTER_HTTP options in your kernel, remove these options and
|
|
recompile your kernel as described in
|
|
<URL:http://www.freebsd.org/handbook/kernelconfig.html> and reboot the
|
|
system. If you have loaded one of the kernel accept filters by using
|
|
kldload(8), then you must modify your startup scripts not to load
|
|
these modules and reboot your system. You may list loaded kernel
|
|
modules by using kldstat(8). If loaded, the HTTP accept filter will
|
|
be listed as `accf_http.ko', and the Data accept filter will be listed
|
|
as `accf_data.ko'.
|
|
|
|
For affected versions of Apache, accept filters may be disabled either
|
|
by adding the directive ``AcceptFilter off'' to your configuration
|
|
file, or via a compile-time option, depending upon the version.
|
|
Please see the Apache documentation for details.
|
|
|
|
V. Solution
|
|
|
|
1) Upgrade your vulnerable system to 4.5-STABLE; or to the RELENG_4_5
|
|
(4.5-RELEASE-p6) security branch dated after the respective correction
|
|
dates.
|
|
|
|
2) To patch your present system:
|
|
|
|
The following patch has been verified to apply to FreeBSD 4.5-RELEASE
|
|
and 4.5-STABLE systems.
|
|
|
|
a) Download the relevant patch from the location below, and verify the
|
|
detached PGP signature using your PGP utility.
|
|
|
|
# fetch ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-02:26/accept.patch
|
|
# fetch ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-02:26/accept.patch.asc
|
|
|
|
b) Execute the following commands as root:
|
|
|
|
# cd /usr/src
|
|
# patch < /path/to/patch
|
|
|
|
c) Recompile your kernel as described in
|
|
<URL:http://www.freebsd.org/handbook/kernelconfig.html> and reboot the
|
|
system.
|
|
|
|
VI. Correction details
|
|
|
|
The following list contains the revision numbers of each file that was
|
|
corrected in FreeBSD.
|
|
|
|
Path Revision
|
|
Branch
|
|
- -------------------------------------------------------------------------
|
|
src/sys/kern/uipc_socket.c
|
|
RELENG_4 1.68.2.21
|
|
RELENG_4_5 1.68.2.17.2.1
|
|
src/sys/kern/uipc_socket2.c
|
|
RELENG_4 1.55.2.15
|
|
RELENG_4_5 1.55.2.10.2.1
|
|
src/sys/conf/newvers.sh
|
|
RELENG_4_5 1.44.2.20.2.7
|
|
- -------------------------------------------------------------------------
|
|
|
|
VII. References
|
|
|
|
<URL:http://www.freebsd.org/cgi/cvsweb.cgi/src/sys/kern/uipc_socket.c?rev=1.116&content-type=text/x-cvsweb-markup>
|
|
<URL:http://www.freebsd.org/cgi/cvsweb.cgi/src/sys/kern/uipc_socket2.c?rev=1.87&content-type=text/x-cvsweb-markup>
|
|
-----BEGIN PGP SIGNATURE-----
|
|
Version: GnuPG v1.0.7 (FreeBSD)
|
|
|
|
iQCVAwUBPPUCC1UuHi5z0oilAQFApAP6ApvgOydr72UHKHXiRZnGxiwBhpyVE+mH
|
|
5xdDP45s0GaUChA7GLbpv0hLL5syNPMavo7ygRuqD6pHFA0xpVn3hUXtLh09dhwS
|
|
YTDWrC2VL9QJmFWIxMNzo0OXD1uDBrlGEk3Ew0jWT2ewe46QW1czpPYCeGg4Bx+i
|
|
+FzEQ9V4D8k=
|
|
=W+BP
|
|
-----END PGP SIGNATURE-----
|