From owner-freebsd-security@freebsd.org Mon Mar 9 18:40:30 2020 Return-Path: Delivered-To: freebsd-security@mailman.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mailman.nyi.freebsd.org (Postfix) with ESMTP id 26AF8269D83 for ; Mon, 9 Mar 2020 18:40:30 +0000 (UTC) (envelope-from SRS0=NaQJ=42=quip.cz=000.fbsd@elsa.codelab.cz) Received: from elsa.codelab.cz (elsa.codelab.cz [94.124.105.4]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id 48bn8r3vvvz4Zjc for ; Mon, 9 Mar 2020 18:40:28 +0000 (UTC) (envelope-from SRS0=NaQJ=42=quip.cz=000.fbsd@elsa.codelab.cz) Received: from elsa.codelab.cz (localhost [127.0.0.1]) by elsa.codelab.cz (Postfix) with ESMTP id 7301128429; Mon, 9 Mar 2020 19:40:25 +0100 (CET) Received: from illbsd.quip.test (ip-62-24-92-232.net.upcbroadband.cz [62.24.92.232]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by elsa.codelab.cz (Postfix) with ESMTPSA id A82A828422; Mon, 9 Mar 2020 19:40:22 +0100 (CET) Subject: Re: Critical PPP Daemon Flaw To: Eugene Grosbein , Cy Schubert , freebsd-security@freebsd.org References: <13df3361-87b6-c6c1-e79d-2bbdd0146518@quip.cz> <5FD9E59C-1B15-4B07-AA5E-1B6F40CBDD08@cschubert.com> From: Miroslav Lachman <000.fbsd@quip.cz> Message-ID: <0898efde-0d5e-68a0-6969-ec096f19a5da@quip.cz> Date: Mon, 9 Mar 2020 19:40:22 +0100 User-Agent: Mozilla/5.0 (X11; FreeBSD amd64; rv:52.0) Gecko/20100101 Firefox/52.0 SeaMonkey/2.49.3 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit X-Rspamd-Queue-Id: 48bn8r3vvvz4Zjc X-Spamd-Bar: +++ Authentication-Results: mx1.freebsd.org; dkim=none; dmarc=none; spf=none (mx1.freebsd.org: domain of SRS0=NaQJ=42=quip.cz=000.fbsd@elsa.codelab.cz has no SPF policy when checking 94.124.105.4) smtp.mailfrom=SRS0=NaQJ=42=quip.cz=000.fbsd@elsa.codelab.cz X-Spamd-Result: default: False [3.85 / 15.00]; ARC_NA(0.00)[]; RCVD_VIA_SMTP_AUTH(0.00)[]; FROM_HAS_DN(0.00)[]; RCPT_COUNT_THREE(0.00)[3]; TO_DN_SOME(0.00)[]; IP_SCORE(0.84)[ip: (0.30), ipnet: 94.124.104.0/21(0.15), asn: 42000(3.64), country: CZ(0.09)]; MIME_GOOD(-0.10)[text/plain]; RCVD_TLS_LAST(0.00)[]; DMARC_NA(0.00)[quip.cz]; AUTH_NA(1.00)[]; NEURAL_SPAM_MEDIUM(0.94)[0.944,0]; RCVD_COUNT_THREE(0.00)[3]; TO_MATCH_ENVRCPT_SOME(0.00)[]; NEURAL_SPAM_LONG(0.87)[0.872,0]; RCVD_IN_DNSWL_NONE(0.00)[4.105.124.94.list.dnswl.org : 127.0.10.0]; R_SPF_NA(0.00)[]; FORGED_SENDER(0.30)[000.fbsd@quip.cz,SRS0=NaQJ=42=quip.cz=000.fbsd@elsa.codelab.cz]; R_DKIM_NA(0.00)[]; MIME_TRACE(0.00)[0:+]; ASN(0.00)[asn:42000, ipnet:94.124.104.0/21, country:CZ]; FROM_NEQ_ENVFROM(0.00)[000.fbsd@quip.cz,SRS0=NaQJ=42=quip.cz=000.fbsd@elsa.codelab.cz]; MID_RHS_MATCH_FROM(0.00)[] X-BeenThere: freebsd-security@freebsd.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Security issues \[members-only posting\]" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 09 Mar 2020 18:40:30 -0000 Eugene Grosbein wrote on 2020/03/09 18:15: > 09.03.2020 20:49, Cy Schubert wrote: > >> On March 9, 2020 4:23:10 AM PDT, Miroslav Lachman <000.fbsd@quip.cz> wrote: >>> I don't know if FreeBSD is vulnerable or not. There are main Linux >>> distros and NetBSD listed in the article. >>> >>> https://thehackernews.com/2020/03/ppp-daemon-vulnerability.html >>> >>> The vulnerability, tracked as CVE-2020-8597 [1] with CVSS Score 9.8, >>> can >>> be exploited by unauthenticated attackers to remotely execute arbitrary >>> >>> code on affected systems and take full control over them. >>> >>> [1] https://www.kb.cert.org/vuls/id/782301/ >> Probably not. Ours is a different codebase from NetBSD. >> I haven't looked at what Red Hat has, no comment about theirs. >> However it would be prudent to verify our pppd isn't also vulnerable. > > We have not pppd at all, in any supported branch. > > We had pppd(8) and ppp(4) kernel driver used by pppd upto FreeBSD 7 > and they did panic kernel if used with MPSAFE knob enabled, because ppp(4) was not mp-safe. > Due to that reason (and nobody updated the driver), both of ppp(4) and pppd(8) were removed before 8.0-RELEASE. > > We have net/mpd5 daemon that can be used instead of pppd and mpd5 is not vulnerable > due to its completely different code base including part parsing EAP messages. > > And, of course, we have ppp(8) "user-ppp" utility. Thank you for the clarification! Kind regards Miroslav Lachman