From owner-freebsd-announce@FreeBSD.ORG Mon Jun 6 20:59:15 2005 Return-Path: X-Original-To: announce@freebsd.org Delivered-To: freebsd-announce@FreeBSD.ORG Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 65DEB16A41C for ; Mon, 6 Jun 2005 20:59:15 +0000 (GMT) (envelope-from chrisc@daemonnews.org) Received: from sccrmhc14.comcast.net (sccrmhc14.comcast.net [204.127.202.59]) by mx1.FreeBSD.org (Postfix) with ESMTP id 20C2143D48 for ; Mon, 6 Jun 2005 20:59:14 +0000 (GMT) (envelope-from chrisc@daemonnews.org) Received: from [192.168.1.100] (c-24-2-88-99.hsd1.ut.comcast.net[24.2.88.99]) by comcast.net (sccrmhc14) with SMTP id <2005060620591401400dnr6ke>; Mon, 6 Jun 2005 20:59:14 +0000 Mime-Version: 1.0 (Apple Message framework v622) Content-Transfer-Encoding: 7bit Message-Id: <6b829e3db1c58318f9d6dc433184bea6@daemonnews.org> Content-Type: text/plain; charset=US-ASCII; format=flowed To: announce@freebsd.org From: Chris Coleman Date: Mon, 6 Jun 2005 14:59:13 -0600 X-Mailer: Apple Mail (2.622) X-Mailman-Approved-At: Tue, 07 Jun 2005 12:15:52 +0000 Cc: Subject: [FreeBSD-Announce] BSD Binary Updates X-BeenThere: freebsd-announce@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: "Project Announcements \[moderated\]" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 06 Jun 2005 20:59:15 -0000 BSDupdates.com is pleased to announce the availability of Binary Security updates and Binary upgrades for FreeBSD. Binary updates are an easy way to upgrade and update your FreeBSD computer. More information on the capabilities of this project can be found here: http://ezine.daemonnews.org/200502/support.html A support forum for this project has been setup here: http://support.daemonnews.org/index.php?c=12 The majority of the proceeds from this project will go to support BSD in the following ways: * Set donations to BSD foundations * Funding of BSD developers * Free Binary Security Updates * BSD advertising and advocacy * Project Overhead If you are looking for a way to give back to the BSD projects as well as get something in return, please stop by and check out the project. Also, please let us keep us informed as to features and enhancements you would like to see as this project progresses. -Chris Coleman From owner-freebsd-announce@FreeBSD.ORG Thu Jun 9 10:30:13 2005 Return-Path: X-Original-To: freebsd-announce@freebsd.org Delivered-To: freebsd-announce@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id B0F9216A41C; Thu, 9 Jun 2005 10:30:13 +0000 (GMT) (envelope-from security-advisories@freebsd.org) Received: from freefall.freebsd.org (freefall.freebsd.org [216.136.204.21]) by mx1.FreeBSD.org (Postfix) with ESMTP id 6609B43D49; Thu, 9 Jun 2005 10:30:13 +0000 (GMT) (envelope-from security-advisories@freebsd.org) Received: from freefall.freebsd.org (cperciva@localhost [127.0.0.1]) by freefall.freebsd.org (8.13.3/8.13.3) with ESMTP id j59AUD7A072835; Thu, 9 Jun 2005 10:30:13 GMT (envelope-from security-advisories@freebsd.org) Received: (from cperciva@localhost) by freefall.freebsd.org (8.13.3/8.13.1/Submit) id j59AUDSE072823; Thu, 9 Jun 2005 10:30:13 GMT (envelope-from security-advisories@freebsd.org) Date: Thu, 9 Jun 2005 10:30:13 GMT Message-Id: <200506091030.j59AUDSE072823@freefall.freebsd.org> X-Authentication-Warning: freefall.freebsd.org: cperciva set sender to security-advisories@freebsd.org using -f From: FreeBSD Security Advisories To: FreeBSD Security Advisories Precedence: bulk Cc: Subject: [FreeBSD-Announce] FreeBSD Security Advisory FreeBSD-SA-05:10.tcpdump X-BeenThere: freebsd-announce@freebsd.org X-Mailman-Version: 2.1.5 Reply-To: security-advisories@freebsd.org List-Id: "Project Announcements \[moderated\]" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 09 Jun 2005 10:30:13 -0000 -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ============================================================================= FreeBSD-SA-05:10.tcpdump Security Advisory The FreeBSD Project Topic: Infinite loops in tcpdump protocol decoding Category: contrib Module: tcpdump Announced: 2005-06-09 Credits: "Vade 79", Simon L. Nielsen Affects: FreeBSD 5.3-RELEASE and FreeBSD 5.4-RELEASE Corrected: 2005-06-08 21:26:27 UTC (RELENG_5, 5.4-STABLE) 2005-06-08 21:27:44 UTC (RELENG_5_4, 5.4-RELEASE-p2) 2005-06-08 21:29:15 UTC (RELENG_5_3, 5.3-RELEASE-p16) CVE Name: CAN-2005-1267, CAN-2005-1278, CAN-2005-1279, CAN-2005-1280 For general information regarding FreeBSD Security Advisories, including descriptions of the fields above, security branches, and the following sections, please visit . I. Background The tcpdump utility is used to capture and examine network traffic. II. Problem Description Several tcpdump protocol decoders contain programming errors which can cause them to go into infinite loops. III. Impact An attacker can inject specially crafted packets into the network which, when processed by tcpdump, could lead to a denial-of-service. After the attack, tcpdump would no longer capture traffic, and would potentially use all available processor time. IV. Workaround No workaround is available. V. Solution Perform one of the following: 1) Upgrade your vulnerable system to 5-STABLE, or to the RELENG_5_4 or RELENG_5_3 security branch dated after the correction date. 2) To patch your present system: The following patches have been verified to apply to FreeBSD 5.3 and 5.4 systems. a) Download the relevant patch from the location below, and verify the detached PGP signature using your PGP utility. # fetch ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-05:10/tcpdump.patch # fetch ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-05:10/tcpdump.patch.asc b) Execute the following commands as root: # cd /usr/src # patch < /path/to/patch # cd /usr/src/usr.sbin/tcpdump/tcpdump # make obj && make depend && make && make install VI. Correction details The following list contains the revision numbers of each file that was corrected in FreeBSD. Branch Revision Path - ------------------------------------------------------------------------- RELENG_5 src/contrib/tcpdump/print-bgp.c 1.1.1.5.2.1 src/contrib/tcpdump/print-isoclns.c 1.12.2.1 src/contrib/tcpdump/print-ldp.c 1.1.1.1.2.1 src/contrib/tcpdump/print-rsvp.c 1.1.1.1.2.1 RELENG_5_4 src/UPDATING 1.342.2.24.2.11 src/sys/conf/newvers.sh 1.62.2.18.2.7 src/contrib/tcpdump/print-bgp.c 1.1.1.5.6.1 src/contrib/tcpdump/print-isoclns.c 1.12.6.1 src/contrib/tcpdump/print-ldp.c 1.1.1.1.6.1 src/contrib/tcpdump/print-rsvp.c 1.1.1.1.6.1 RELENG_5_3 src/UPDATING 1.342.2.13.2.19 src/sys/conf/newvers.sh 1.62.2.15.2.21 src/contrib/tcpdump/print-bgp.c 1.1.1.5.4.1 src/contrib/tcpdump/print-isoclns.c 1.12.4.1 src/contrib/tcpdump/print-ldp.c 1.1.1.1.4.1 src/contrib/tcpdump/print-rsvp.c 1.1.1.1.4.1 - ------------------------------------------------------------------------- VII. References http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-1267 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-1278 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-1279 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-1280 http://marc.theaimsgroup.com/?l=bugtraq&m=111454406222040 http://marc.theaimsgroup.com/?l=bugtraq&m=111454461300644 The latest revision of this advisory is available at ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-05:10.tcpdump.asc -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.1 (FreeBSD) iD8DBQFCqBbUFdaIBMps37IRAlxdAJ9AsT7o5k1woMpE3DlC+HBebZlLKACfYFjD 0VOBWDzUFdR8IErJEYU2+9w= =1cKJ -----END PGP SIGNATURE----- From owner-freebsd-announce@FreeBSD.ORG Thu Jun 9 10:30:19 2005 Return-Path: X-Original-To: freebsd-announce@freebsd.org Delivered-To: freebsd-announce@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id EFA1416A428; Thu, 9 Jun 2005 10:30:19 +0000 (GMT) (envelope-from security-advisories@freebsd.org) Received: from freefall.freebsd.org (freefall.freebsd.org [216.136.204.21]) by mx1.FreeBSD.org (Postfix) with ESMTP id 83CFB43D4C; Thu, 9 Jun 2005 10:30:19 +0000 (GMT) (envelope-from security-advisories@freebsd.org) Received: from freefall.freebsd.org (cperciva@localhost [127.0.0.1]) by freefall.freebsd.org (8.13.3/8.13.3) with ESMTP id j59AUJdR073045; Thu, 9 Jun 2005 10:30:19 GMT (envelope-from security-advisories@freebsd.org) Received: (from cperciva@localhost) by freefall.freebsd.org (8.13.3/8.13.1/Submit) id j59AUJuI073041; Thu, 9 Jun 2005 10:30:19 GMT (envelope-from security-advisories@freebsd.org) Date: Thu, 9 Jun 2005 10:30:19 GMT Message-Id: <200506091030.j59AUJuI073041@freefall.freebsd.org> X-Authentication-Warning: freefall.freebsd.org: cperciva set sender to security-advisories@freebsd.org using -f From: FreeBSD Security Advisories To: FreeBSD Security Advisories Precedence: bulk Cc: Subject: [FreeBSD-Announce] FreeBSD Security Advisory FreeBSD-SA-05:11.gzip X-BeenThere: freebsd-announce@freebsd.org X-Mailman-Version: 2.1.5 Reply-To: security-advisories@freebsd.org List-Id: "Project Announcements \[moderated\]" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 09 Jun 2005 10:30:20 -0000 -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ============================================================================= FreeBSD-SA-05:11.gzip Security Advisory The FreeBSD Project Topic: gzip directory traversal and permission race vulnerabilities Category: contrib Module: gzip Announced: 2005-06-09 Credits: Ulf Harnhammar, Imran Ghory Affects: All FreeBSD releases Corrected: 2005-06-08 21:26:27 UTC (RELENG_5, 5.4-STABLE) 2005-06-08 21:27:44 UTC (RELENG_5_4, 5.4-RELEASE-p2) 2005-06-08 21:29:15 UTC (RELENG_5_3, 5.3-RELEASE-p16) 2005-06-08 21:29:53 UTC (RELENG_4, 4.11-STABLE) 2005-06-08 21:30:43 UTC (RELENG_4_11, 4.11-RELEASE-p10) 2005-06-08 21:31:16 UTC (RELENG_4_10, 4.10-RELEASE-p15) CVE Name: CAN-2005-0988, CAN-2005-1228 For general information regarding FreeBSD Security Advisories, including descriptions of the fields above, security branches, and the following sections, please visit . I. Background gzip is a file compression utility. II. Problem Description Two problems related to extraction of files exist in gzip: The first problem is that gzip does not properly sanitize filenames containing "/" when uncompressing files using the -N command line option. The second problem is that gzip does not set permissions on newly extracted files until after the file has been created and the file descriptor has been closed. III. Impact The first problem can allow an attacker to overwrite arbitrary local files when uncompressing a file using the -N command line option. The second problem can allow a local attacker to change the permissions of arbitrary local files, on the same partition as the one the user is uncompressing a file on, by removing the file the user is uncompressing and replacing it with a hardlink before the uncompress operation is finished. IV. Workaround Do not use the -N command line option on untrusted files and do not uncompress files in directories where untrusted users have write access. V. Solution Perform one of the following: 1) Upgrade your vulnerable system to 4-STABLE or 5-STABLE, or to the RELENG_5_4, RELENG_5_3, RELENG_4_11, or RELENG_4_10 security branch dated after the correction date. 2) To patch your present system: The following patches have been verified to apply to FreeBSD 4.10, 4.11, 5.3, and 5.4 systems. a) Download the relevant patch from the location below, and verify the detached PGP signature using your PGP utility. # fetch ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-05:11/gzip.patch # fetch ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-05:11/gzip.patch.asc b) Execute the following commands as root: # cd /usr/src # patch < /path/to/patch # cd /usr/src/gnu/usr.bin/gzip # make obj && make depend && make && make install VI. Correction details The following list contains the revision numbers of each file that was corrected in FreeBSD. Branch Revision Path - ------------------------------------------------------------------------- RELENG_4 src/gnu/usr.bin/gzip/gzip.c 1.10.2.1 RELENG_4_11 src/UPDATING 1.73.2.91.2.11 src/sys/conf/newvers.sh 1.44.2.39.2.14 src/gnu/usr.bin/gzip/gzip.c 1.10.26.1 RELENG_4_10 src/UPDATING 1.73.2.90.2.16 src/sys/conf/newvers.sh 1.44.2.34.2.17 src/gnu/usr.bin/gzip/gzip.c 1.10.24.1 RELENG_5 src/gnu/usr.bin/gzip/gzip.c 1.11.2.1 RELENG_5_4 src/UPDATING 1.342.2.24.2.11 src/sys/conf/newvers.sh 1.62.2.18.2.7 src/gnu/usr.bin/gzip/gzip.c 1.11.6.1 RELENG_5_3 src/UPDATING 1.342.2.13.2.19 src/sys/conf/newvers.sh 1.62.2.15.2.21 src/gnu/usr.bin/gzip/gzip.c 1.11.4.1 - ------------------------------------------------------------------------- VII. References http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0988 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-1228 http://marc.theaimsgroup.com/?l=bugtraq&m=111271860708210 http://marc.theaimsgroup.com/?l=bugtraq&m=111402732406477 The latest revision of this advisory is available at ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-05:11.gzip.asc -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.1 (FreeBSD) iD8DBQFCqBbGFdaIBMps37IRAttLAJ41WPmKXczZAZgrBGBP1GorSM7E1gCfc8w9 KFbns+zs2umrId0mCg1SjVk= =6MzW -----END PGP SIGNATURE----- From owner-freebsd-announce@FreeBSD.ORG Thu Jun 9 10:30:27 2005 Return-Path: X-Original-To: freebsd-announce@freebsd.org Delivered-To: freebsd-announce@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 0A8E416A420; Thu, 9 Jun 2005 10:30:27 +0000 (GMT) (envelope-from security-advisories@freebsd.org) Received: from freefall.freebsd.org (freefall.freebsd.org [216.136.204.21]) by mx1.FreeBSD.org (Postfix) with ESMTP id 8651243D53; Thu, 9 Jun 2005 10:30:26 +0000 (GMT) (envelope-from security-advisories@freebsd.org) Received: from freefall.freebsd.org (cperciva@localhost [127.0.0.1]) by freefall.freebsd.org (8.13.3/8.13.3) with ESMTP id j59AUQ76073610; Thu, 9 Jun 2005 10:30:26 GMT (envelope-from security-advisories@freebsd.org) Received: (from cperciva@localhost) by freefall.freebsd.org (8.13.3/8.13.1/Submit) id j59AUQkj073607; Thu, 9 Jun 2005 10:30:26 GMT (envelope-from security-advisories@freebsd.org) Date: Thu, 9 Jun 2005 10:30:26 GMT Message-Id: <200506091030.j59AUQkj073607@freefall.freebsd.org> X-Authentication-Warning: freefall.freebsd.org: cperciva set sender to security-advisories@freebsd.org using -f From: FreeBSD Security Advisories To: FreeBSD Security Advisories Precedence: bulk Cc: Subject: [FreeBSD-Announce] FreeBSD Security Advisory FreeBSD-SA-05:12.bind9 X-BeenThere: freebsd-announce@freebsd.org X-Mailman-Version: 2.1.5 Reply-To: security-advisories@freebsd.org List-Id: "Project Announcements \[moderated\]" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 09 Jun 2005 10:30:27 -0000 -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ============================================================================= FreeBSD-SA-05:12.bind9 Security Advisory The FreeBSD Project Topic: BIND 9 DNSSEC remote denial of service vulnerability Category: core Module: bind9 Announced: 2005-06-09 Credits: Internet Systems Consortium Affects: FreeBSD 5.3 Corrected: 2005-03-23 18:16:29 UTC (RELENG_5, 5.3-STABLE) 2005-06-08 21:29:15 UTC (RELENG_5_3, 5.3-RELEASE-p16) CVE Name: CAN-2005-0034 For general information regarding FreeBSD Security Advisories, including descriptions of the fields above, security branches, and the following sections, please visit . I. Background BIND 9 is an implementation of the Domain Name System (DNS) protocols. The named(8) daemon is the Internet domain name server. DNS Security Extensions (DNSSEC) are additional protocol options that add authentication and integrity to the DNS protocols. DNSSEC is not enabled by default in any FreeBSD release. A system administrator must take special action to enable DNSSEC. II. Problem Description A DNSSEC-related validator function in BIND 9.3.0 contains an inappropriate internal consistency test. When this test is triggered, named(8) will exit. III. Impact On systems with DNSSEC enabled, a remote attacker may be able to inject a specially crafted packet that will cause the internal consistency test to trigger, and named(8) to terminate. As a result, the name server will no longer be available to service requests. IV. Workaround DNSSEC is not enabled by default, and the "dnssec-enable" directive is not normally present. If DNSSEC has been enabled, disable it by changing the "dnssec-enable" directive to "dnssec-enable no;" in the named.conf(5) configuration file. V. Solution Perform one of the following: 1) Upgrade your vulnerable system to 5-STABLE, or to the RELENG_5_3 security branch dated after the correction date. 2) To patch your present system: The following patches have been verified to apply to FreeBSD 5.3 systems. a) Download the relevant patch from the location below, and verify the detached PGP signature using your PGP utility. # fetch ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-05:12/bind9.patch # fetch ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-05:12/bind9.patch.asc b) Execute the following commands as root: # cd /usr/src/ # patch < /path/to/patch # cd /usr/src/lib/bind # make obj && make depend && make && make install # cd /usr/src/usr.sbin/named # make obj && make depend && make && make install VI. Correction details The following list contains the revision numbers of each file that was corrected in FreeBSD. Branch Revision Path - ------------------------------------------------------------------------- RELENG_5 src/contrib/bind9/lib/dns/validator.c 1.1.1.1.2.2 RELENG_5_3 src/UPDATING 1.342.2.13.2.19 src/sys/conf/newvers.sh 1.62.2.15.2.21 src/contrib/bind9/lib/dns/validator.c 1.1.1.1.2.1.2.1 - ------------------------------------------------------------------------- VII. References http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0034 http://www.kb.cert.org/vuls/id/938617 http://www.isc.org/index.pl?/sw/bind/bind-security.php http://www.isc.org/index.pl?/sw/bind/bind9.php The latest revision of this advisory is available at ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-05:12.bind9.asc -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.1 (FreeBSD) iD8DBQFCqBbfFdaIBMps37IRAiphAKCG8CX6eNFMNQYhahAER4gFVFc54wCfRZye 2C6LIcrq47xn5SRRV3T9ZL4= =gFcD -----END PGP SIGNATURE-----