From owner-freebsd-security@FreeBSD.ORG  Tue Dec  1 01:20:45 2009
Return-Path: <owner-freebsd-security@FreeBSD.ORG>
Delivered-To: freebsd-security@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34])
	by hub.freebsd.org (Postfix) with ESMTP id AE5001065693;
	Tue,  1 Dec 2009 01:20:45 +0000 (UTC)
	(envelope-from security-advisories@freebsd.org)
Received: from freefall.freebsd.org (freefall.freebsd.org
	[IPv6:2001:4f8:fff6::28])
	by mx1.freebsd.org (Postfix) with ESMTP id 9AB448FC19;
	Tue,  1 Dec 2009 01:20:45 +0000 (UTC)
Received: from freefall.freebsd.org (localhost [127.0.0.1])
	by freefall.freebsd.org (8.14.3/8.14.3) with ESMTP id nB11Kj2S087486;
	Tue, 1 Dec 2009 01:20:45 GMT
	(envelope-from security-advisories@freebsd.org)
Received: (from cperciva@localhost)
	by freefall.freebsd.org (8.14.3/8.14.3/Submit) id nB11Kjm9087476;
	Tue, 1 Dec 2009 01:20:45 GMT
	(envelope-from security-advisories@freebsd.org)
Date: Tue, 1 Dec 2009 01:20:45 GMT
Message-Id: <200912010120.nB11Kjm9087476@freefall.freebsd.org>
X-Authentication-Warning: freefall.freebsd.org: cperciva set sender to
	security-advisories@freebsd.org using -f
From: FreeBSD Security Officer <cperciva@freebsd.org>
To: FreeBSD Security Advisories <security-advisories@freebsd.org>
Precedence: bulk
Cc: 
Subject: Upcoming FreeBSD Security Advisory
X-BeenThere: freebsd-security@freebsd.org
X-Mailman-Version: 2.1.5
Reply-To: freebsd-security@freebsd.org
List-Id: "Security issues \[members-only posting\]"
	<freebsd-security.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-security>, 
	<mailto:freebsd-security-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-security>
List-Post: <mailto:freebsd-security@freebsd.org>
List-Help: <mailto:freebsd-security-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-security>, 
	<mailto:freebsd-security-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Tue, 01 Dec 2009 01:20:45 -0000

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hi all,

A short time ago a "local root" exploit was posted to the full-disclosure
mailing list; as the name suggests, this allows a local user to execute
arbitrary code as root.

Normally it is the policy of the FreeBSD Security Team to not publicly
discuss security issues until an advisory is ready, but in this case
since exploit code is already widely available I want to make a patch
available ASAP.  Due to the short timeline, it is possible that this
patch will not be the final version which is provided when an advisory
is sent out; it is even possible (although highly doubtful) that this
patch does not fully fix the issue or introduces new issues -- in short,
use at your own risk (even more than usual).

The patch is at
  http://people.freebsd.org/~cperciva/rtld.patch
and has SHA256 hash
  ffcba0c20335dd83e9ac0d0e920faf5b4aedf366ee5a41f548b95027e3b770c1

I expect a full security advisory concerning this issue will go out on
Wednesday December 2nd.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (FreeBSD)

iEYEARECAAYFAksUbjcACgkQFdaIBMps37LP9ACgljaYCfgVuhD2gd9Natpq4H/9
i48An1mgl+Mih+AWN7J9KZ1rsiEU31IZ
=MPXj
-----END PGP SIGNATURE-----

-- 
Colin Percival
Security Officer, FreeBSD | freebsd.org | The power to serve
Founder / author, Tarsnap | tarsnap.com | Online backups for the truly paranoid