From owner-freebsd-announce Sun Nov 1 06:56:31 1998 Return-Path: Received: (from majordom@localhost) by hub.freebsd.org (8.8.8/8.8.8) id GAA16754 for freebsd-announce-outgoing; Sun, 1 Nov 1998 06:56:31 -0800 (PST) (envelope-from owner-freebsd-announce@FreeBSD.ORG) Received: (from mailman@localhost) by hub.freebsd.org (8.8.8/8.8.8) id GAA16750 for freebsd-announce; Sun, 1 Nov 1998 06:56:31 -0800 (PST) (envelope-from mailman) Date: Sun, 1 Nov 1998 06:56:31 -0800 (PST) From: Handles majordomo bounced mail Message-Id: <199811011456.GAA16750@hub.freebsd.org> To: freebsd-announce Subject: FreeBSD Real-Quick(TM) NewsLetter Volume #1 Issue #6 Sender: owner-freebsd-announce@FreeBSD.ORG Precedence: bulk Reply-To: postmaster@FreeBSD.ORG X-Loop: FreeBSD.org FreeBSD Real-Quick(TM) NewsLetter. Things Happening in FreeBSD. Volume #1 Issue #6 October 1998 Release Information: FreeBSD 3.0 RELEASE is out! :-) Order your Copy today from: http://www.cdrom.com The current stable release is 2.2.7-RELEASE, with FreeBSD 2.2.8 due for release November 30. FreeBSD in the News: 24-Oct-98 ftp.freebsd.org (aka ftp.cdrom.com), a P6/200 with 1GB of RAM and half a TB of RAID-5 storage, served up 724GB of data--a new one day record. See the previous record at: http://www.crl.com/wccdromrcd.html 01-Nov-98 New Record: 759 of data. FreeBSD Advocacy: http://www.unix-vs-nt.org/ http://www.dvl-software.com/freebsd/ http://www.cnet.com/Content/Reviews/Compare/AltOS/ss04.html http://www.irish-times.com/irish%2Dtimes/paper/1998/1012/cmp2.html FreeBSD RELEASE/SNAP finder Database: http://www.itworks.com.au/~gavin/FBSDsites.php3 Commercial FreeBSD Products: You may want to have a look at Zeus (http://www.zeus.co.uk/) all of their server products are available for FreeBSD. Tony Ballardie and BT Laboratories, UK are pleased to announce an alpha level source code release of Core Based Trees multicast routing demon "cbtd" plus associated kernel patches for FreeBSD 2.2.[67]. The ftp download is from ftp://ftp.labs.bt.com/Internet-Research/cbt-2.0.tar.gz Feedback please to :- graeme.brown@bt-sys.bt.co.uk ballardie@dial.pipex.com BSD Online Magazine: The DaemonNews needs people to format articles from text to HTML. E-mail: editors@daemonnews.org Articles: article@daemonnews.org $$$Money$$$ for Free Software Projects: The Free Software Bazaar at http://visar.csustan.edu/bazaar/ lets people put up bounties for free software projects. Please check it out. This is an (at least) monthly Newsletter, published only by E-mail. Archived copies can be found at: http://www.freebsd.org/news/qnewsletter.html If you have anything you would like to see in the next edition, please send e-mail to fbsd-book@vmunix.com -Chris Coleman This is the moderated mailing list freebsd-announce. The list contains announcements of new FreeBSD capabilities, important events and project milestones. See also the FreeBSD Web pages at http://www.freebsd.org To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-announce" in the body of the message From owner-freebsd-announce Wed Nov 4 11:37:49 1998 Return-Path: Received: (from majordom@localhost) by hub.freebsd.org (8.8.8/8.8.8) id LAA19855 for freebsd-announce-outgoing; Wed, 4 Nov 1998 11:37:49 -0800 (PST) (envelope-from owner-freebsd-announce@FreeBSD.ORG) Received: from gvr.gvr.org (gvr.gvr.org [194.151.74.97]) by hub.freebsd.org (8.8.8/8.8.8) with ESMTP id LAA19841; Wed, 4 Nov 1998 11:37:40 -0800 (PST) (envelope-from security-officer@freebsd.org) Received: (from guido@localhost) by gvr.gvr.org (8.8.8/8.8.5) id UAA12845; Wed, 4 Nov 1998 20:37:28 +0100 (MET) Date: Wed, 4 Nov 1998 20:37:28 +0100 (MET) Message-Id: <199811041937.UAA12845@gvr.gvr.org> From: FreeBSD Security Officer Subject: FreeBSD Security Advisory: FreeBSD-SA-98:08.fragment To: undisclosed-recipients:; Sender: owner-freebsd-announce@FreeBSD.ORG Precedence: bulk Reply-To: postmaster@FreeBSD.ORG X-Loop: FreeBSD.org -----BEGIN PGP SIGNED MESSAGE----- ============================================================================= FreeBSD-SA-98:08 Security Advisory FreeBSD, Inc. Topic: IP fragmentation denial of service Category: core Module: kernel Announced: 1998-11-04 Affects: FreeBSD 3.0 and FreeBSD-current before the correction date. Corrected: FreeBSD-3.0 and FreeBSD-current as of 1998/10/27 FreeBSD only: Yes Patches: ftp://ftp.freebsd.org/pub/FreeBSD/CERT/patches/SA-98:08/ I. Background IP connections are controlled through a series of packets that are received by the two computers involved in the connection. When packets are too large to be sent in a single IP packet (due to interface hardware limitations for example), they can be fragmented (unless prohibited by the Don't Fragment flag). The final destination will reassemble all the fragments of an IP packet and pass it to higher protocol layers (like TCP or UDP). II. Problem Description There is a bug in the IP fragment reassembly code that might lead to a kernel panic. An attacker can create and send a pair of malformed IP packets which are then reassembled into an invalid UDP datagram. Such an UDP datagram would then cause a server to panic and crash. III. Impact When this bug is exploited the operating system will panic. This results in a reboot of the system. This vulnerability has been discussed in public security forums and exploit programs are circulating to take advantage of this bug. IV. Workaround None. V. Solution Index: ip_input.c =================================================================== RCS file: /home/cvsup/freebsd/CVS/src/sys/netinet/ip_input.c,v retrieving revision 1.102 retrieving revision 1.103 diff -u -u -r1.102 -r1.103 --- ip_input.c 1998/10/16 03:55:01 1.102 +++ ip_input.c 1998/10/27 09:11:41 1.103 @@ -750,7 +750,7 @@ * if they are completely covered, dequeue them. */ for (; q != NULL && ip->ip_off + ip->ip_len > GETIP(q)->ip_off; - p = q, q = nq) { + q = nq) { i = (ip->ip_off + ip->ip_len) - GETIP(q)->ip_off; if (i < GETIP(q)->ip_len) { ============================================================================= FreeBSD, Inc. Web Site: http://www.freebsd.org/ Confidential contacts: security-officer@freebsd.org Security notifications: security-notifications@freebsd.org Security public discussion: freebsd-security@freebsd.org PGP Key: ftp://ftp.freebsd.org/pub/FreeBSD/CERT/public_key.asc Notice: Any patches in this document may not apply cleanly due to modifications caused by digital signature or mailer software. Please reference the URL listed at the top of this document for original copies of all patches if necessary. ============================================================================= -----BEGIN PGP SIGNATURE----- Version: 2.6.3ia Charset: noconv iQCVAwUBNkCrf1UuHi5z0oilAQE0GgQAga3x91fd4QU8/vXKkPp8h2hUmHifhdIc K4PynSKtqP8IQFzMzGApMU5MLCV2s6cXLj2cznAuCcHiF6xWsTIf1JoqgtaYZaTS pBtW9Dxp+5OYlVnGHfijUbO8sop2PpAqaBpVv2CnxYvFz3sMbM8z1H7wkWEHvL7Z MHXYAJ2Apfk= =fOyn -----END PGP SIGNATURE----- This is the moderated mailing list freebsd-announce. The list contains announcements of new FreeBSD capabilities, important events and project milestones. See also the FreeBSD Web pages at http://www.freebsd.org To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-announce" in the body of the message