From owner-freebsd-security@FreeBSD.ORG  Sun Aug 10 23:33:16 2003
Return-Path: <owner-freebsd-security@FreeBSD.ORG>
Delivered-To: freebsd-security@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id E215B37B401
	for <security@freebsd.org>; Sun, 10 Aug 2003 23:33:16 -0700 (PDT)
Received: from mx1.tekgenesis.net (server1.cluster1.tekgenesis.net
	[64.235.250.21])
	by mx1.FreeBSD.org (Postfix) with ESMTP id 5625343F85
	for <security@freebsd.org>; Sun, 10 Aug 2003 23:33:16 -0700 (PDT)
	(envelope-from wiz@mx1.tekgenesis.net)
Received: by mx1.tekgenesis.net (Postfix, from userid 1000)
	id 33E11B8B6; Sun, 10 Aug 2003 20:33:16 -1000 (HST)
Date: Sun, 10 Aug 2003 20:33:16 -1000
From: Jason Dambrosio <jason@wiz.cx>
To: FreeBSD Security Advisories <security@freebsd.org>
Message-ID: <20030811063316.GA85000@tekgenesis.net>
References: <200308110257.h7B2v6YJ061278@freefall.freebsd.org>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <200308110257.h7B2v6YJ061278@freefall.freebsd.org>
User-Agent: Mutt/1.4i
Subject: Re: FreeBSD Security Advisory FreeBSD-SA-03:09.signal
X-BeenThere: freebsd-security@freebsd.org
X-Mailman-Version: 2.1.1
Precedence: list
List-Id: Security issues [members-only posting]
	<freebsd-security.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-security>,
	<mailto:freebsd-security-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-security>
List-Post: <mailto:freebsd-security@freebsd.org>
List-Help: <mailto:freebsd-security-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-security>,
	<mailto:freebsd-security-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Mon, 11 Aug 2003 06:33:17 -0000

On Sun, Aug 10, 2003 at 07:57:06PM -0700, FreeBSD Security Advisories wrote:
> II.  Problem Description
> 
> Some mechanisms for causing a signal to be sent did not properly
> validate the signal number, in some cases allowing the kernel to
> attempt to deliver a negative or out-of-range signal number.  Such
> errors were present in the ptrace(2) system call and the `spigot'
> video capture device driver.
> 
> The error in ptrace(2) was introduced in FreeBSD version 4.2-RELEASE
> (4-STABLE dated Oct 26 04:34:41 2000 UTC).

...

> IV.  Workaround
> 
> There is no workaround for the local denial-of-service attack.

    Wouldn't a possible workaround be, to load a kld module that would
replace the ptrace(2) system call with a patched one? I remember doing
such a trick for modifying other system calls using kld modules...

Jason