3571e53040
patches for easier mirroring, to eliminate a special copy, to make www.freebsd.org/security a full copy of security.freebsd.org and be eventually be the same. For now files are just sitting there. The symlinks are missing. Discussed on: www (repository location) Discussed with: simon (so)
114 lines
4.2 KiB
Text
114 lines
4.2 KiB
Text
-----BEGIN PGP SIGNED MESSAGE-----
|
|
|
|
=============================================================================
|
|
FreeBSD-SA-98:03 Security Advisory
|
|
FreeBSD, Inc.
|
|
|
|
Topic: Problems with TTCP
|
|
|
|
Category: core
|
|
Module: kernel
|
|
Announced: 1998-05-14, revised at 1998-05-18
|
|
Affects: FreeBSD 2.1.*
|
|
FreeBSD 2.2.*,
|
|
FreeBSD-2.2-stable before 1998/05/14 and
|
|
FreeBSD-3.0-current before 1998/05/05 suffer from this problem.
|
|
Corrected: FreeBSD-3.0-current as of 1998/05/14
|
|
FreeBSD-2.2-stable as of 1998/05/05
|
|
FreeBSD-2.1-stable as of 1998/05/18
|
|
FreeBSD only: No. Any other system incorporating TTCP extentions may be
|
|
affected.
|
|
|
|
Patches: ftp://ftp.freebsd.org/pub/FreeBSD/CERT/patches/SA-98:03/
|
|
|
|
I. Background
|
|
|
|
|
|
RFC 1644 provides an extension to TCP called TCP Extensions for
|
|
Transactions, or shortly T/TCP. It provides a way of bypassing
|
|
the standard three-way handshake found in TCP, thus speeding up
|
|
transactions.
|
|
T/TCP has been incorporated in FreeBSD since FreeBSD 2.0.5.
|
|
|
|
II. Problem Description
|
|
|
|
An accelerated open is initiated by a client by sending a new
|
|
TCP option, called CC, to the server. The kernel keeps a
|
|
special cache for each host it communicated with, among others
|
|
containing the value of the last CC option used by the client.
|
|
A new accelerated open is allowed when the CC sent is larger
|
|
than the one in the per-host cache. Thus one can spoof complete
|
|
connections.
|
|
|
|
III. Impact
|
|
|
|
The hole can be used to obtain unauthorized acces to the system
|
|
by spoofing connections to the r*-services. This can only be
|
|
done in the case where an .rhost file and/or a host.equiv file
|
|
is used as the sole method of authentication.
|
|
|
|
IV. Workaround
|
|
|
|
Disable all r-* services. Note that setting the kernel variable
|
|
net.inet.tcp.rfc1644 to 0 does not solve the problem. This
|
|
variable controls whether the system will initiate rfc1644
|
|
based connections and does not affect the ability to receive
|
|
such connections.
|
|
|
|
V. Solution
|
|
|
|
|
|
Apply the following patch, rebuild your kernel, install it
|
|
and reboot your system. The patch is valid for 2.1.* systems,
|
|
for 2.1-stable, for 2.2.* systems, for 2.2-stable and for 3.0-current.
|
|
|
|
The patch below can be found on
|
|
ftp://ftp.freebsd.org/pub/FreeBSD/CERT/patches/SA-98:03/
|
|
|
|
|
|
Index: tcp_input.c
|
|
===================================================================
|
|
RCS file: /home/ncvs/src/sys/netinet/tcp_input.c,v
|
|
retrieving revision 1.74
|
|
retrieving revision 1.77
|
|
diff -u -r1.74 -r1.77
|
|
--- tcp_input.c 1998/04/24 10:08:57 1.74
|
|
+++ tcp_input.c 1998/05/18 17:11:24 1.77
|
|
@@ -680,7 +680,9 @@
|
|
* - otherwise do a normal 3-way handshake.
|
|
*/
|
|
if ((to.to_flag & TOF_CC) != 0) {
|
|
- if (taop->tao_cc != 0 && CC_GT(to.to_cc, taop->tao_cc)) {
|
|
+ if (((tp->t_flags & TF_NOPUSH) != 0) &&
|
|
+ taop->tao_cc != 0 && CC_GT(to.to_cc, taop->tao_cc)) {
|
|
+
|
|
taop->tao_cc = to.to_cc;
|
|
tp->t_state = TCPS_ESTABLISHED;
|
|
|
|
|
|
|
|
=============================================================================
|
|
FreeBSD, Inc.
|
|
|
|
Web Site: http://www.freebsd.org/
|
|
Confidential contacts: security-officer@freebsd.org
|
|
Security notifications: security-notifications@freebsd.org
|
|
Security public discussion: freebsd-security@freebsd.org
|
|
PGP Key: ftp://ftp.freebsd.org/pub/FreeBSD/CERT/public_key.asc
|
|
|
|
Notice: Any patches in this document may not apply cleanly due to
|
|
modifications caused by digital signature or mailer software.
|
|
Please reference the URL listed at the top of this document
|
|
for original copies of all patches if necessary.
|
|
=========================================================================
|
|
|
|
-----BEGIN PGP SIGNATURE-----
|
|
Version: 2.6.3ia
|
|
Charset: noconv
|
|
|
|
iQCVAwUBNWBuSFUuHi5z0oilAQG0WwP+KUCgtui/1BAz4DbtAcm5sodoTVpzhQyG
|
|
NOfhKKgoopaMtbFFVTtCaC3+QL8xqsQX3GfcF1QRn16KDojLmG2em0yrA6Ad4Mwn
|
|
Jup5U4Vur5CQSOuhyZAnRIBeTdC2nCraWee/tGxoiamximqI/bZKpjn/4HwB0XVh
|
|
ZwvupaQ4y9c=
|
|
=n3/i
|
|
-----END PGP SIGNATURE-----
|