From owner-freebsd-announce@FreeBSD.ORG Wed Dec 17 08:36:53 2014 Return-Path: Delivered-To: freebsd-announce@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by hub.freebsd.org (Postfix) with ESMTPS id 316E9721; Wed, 17 Dec 2014 08:36:53 +0000 (UTC) Received: from smtp.des.no (smtp.des.no [194.63.250.102]) by mx1.freebsd.org (Postfix) with ESMTP id CB100D9D; Wed, 17 Dec 2014 08:36:52 +0000 (UTC) Received: from nine.des.no (smtp.des.no [194.63.250.102]) by smtp-int.des.no (Postfix) with ESMTP id 0456B944A; Wed, 17 Dec 2014 08:36:50 +0000 (UTC) Received: by nine.des.no (Postfix, from userid 1001) id E7CC1421E; Wed, 17 Dec 2014 09:36:43 +0100 (CET) From: FreeBSD Security Advisories To: FreeBSD Security Advisories Reply-To: freebsd-security@freebsd.org Precedence: bulk Message-Id: <20141217083643.E7CC1421E@nine.des.no> Date: Wed, 17 Dec 2014 09:36:43 +0100 (CET) Subject: [FreeBSD-Announce] FreeBSD Security Advisory FreeBSD-SA-14:30.unbound X-BeenThere: freebsd-announce@freebsd.org X-Mailman-Version: 2.1.18-1 List-Id: "Project Announcements \[moderated\]" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 17 Dec 2014 08:36:53 -0000 -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= FreeBSD-SA-14:30.unbound Security Advisory The FreeBSD Project Topic: unbound remote denial of service vulnerability Category: contrib Module: unbound Announced: 2014-12-17 Affects: FreeBSD 10.0-RELEASE and later Credits: Florian Maury (ANSSI) Corrected: 2014-12-17 06:58:00 UTC (stable/10, 10.1-STABLE) 2014-12-17 06:59:47 UTC (releng/10.1, 10.1-RELEASE-p2) 2014-12-17 06:59:47 UTC (releng/10.0, 10.0-RELEASE-p14) CVE Name: CVE-2014-8602 For general information regarding FreeBSD Security Advisories, including descriptions of the fields above, security branches, and the following sections, please visit . I. Background Unbound is a validating, recursive, and caching DNS resolver. II. Problem Description By causing queries to be made against a maliciously-constructed zone or against a malicious DNS server, an attacker who is able to cause specific queries to be sent to a nameserver can trick unbound(8) resolver into following an endless series of delegations, which consumes a lot of resources. III. Impact Unbound will spend a lot of resources on this query, and this will impact unbound's CPU and network resources. Unbound may therefore lose some ability or timelines for the service of customer queries (a denial of service). Unbound will continue to respond normally for cached queries. IV. Workaround No workaround is available, but hosts not running unbound(8) are not vulnerable. V. Solution Perform one of the following: 1) Upgrade your vulnerable system to a supported FreeBSD stable or release / security branch (releng) dated after the correction date. 2) To update your vulnerable system via a binary patch: Systems running a RELEASE version of FreeBSD on the i386 or amd64 platforms can be updated via the freebsd-update(8) utility: # freebsd-update fetch # freebsd-update install 3) To update your vulnerable system via a source code patch: The following patches have been verified to apply to the applicable FreeBSD release branches. a) Download the relevant patch from the location below, and verify the detached PGP signature using your PGP utility. [FreeBSD 10.x] # fetch https://security.FreeBSD.org/patches/SA-14:30/unbound.patch # fetch https://security.FreeBSD.org/patches/SA-14:30/unbound.patch.asc # gpg --verify unbound.patch.asc b) Apply the patch. Execute the following commands as root: # cd /usr/src # patch < /path/to/patch c) Recompile the operating system using buildworld and installworld as described in . Restart the unbound(8) daemons, or reboot the system. VI. Correction details The following list contains the correction revision numbers for each affected branch. Branch/path Revision - ------------------------------------------------------------------------- stable/10/ r275853 releng/10.0/ r275854 releng/10.1/ r275854 - ------------------------------------------------------------------------- To see which files were modified by a particular revision, run the following command, replacing NNNNNN with the revision number, on a machine with Subversion installed: # svn diff -cNNNNNN --summarize svn://svn.freebsd.org/base Or visit the following URL, replacing NNNNNN with the revision number: VII. References The latest revision of this advisory is available at -----BEGIN PGP SIGNATURE----- iQIcBAEBCgAGBQJUkTg1AAoJEO1n7NZdz2rn+iUP/3RP0KKn8B2SnSpSLbXws/eY GEOTYEsZJpGTtCyIg5eKmJ/AU7dKiD34da2uaL41Lt4hWa/Icyk13CtV6cK9TfN4 oSrrgDCbqErrFh74lhQX3v3bYHNMhZRVnaM9tHXHmpa9NAKhyTP+eyo+Ss7iK/am lVBW2xPv92OKyjo0Onp5h3o5QT6DHpPgW91f9He4GygYfShMXtOb+VhGpllxwbeM aS59yPkhGJLVhxQn2QtFpj67QxS5GIhK6iccwrRKo8Okij2mlRfR4fuD5Ol4L9TK sZKMGtgESPLGmfW1Pj/BRobyCWcs+cYLchZkxbomQBcH7ybpOMW+SqTB0FkZcscU ODMzvum2VZuSl5fAlu3F6V0/k+8cFiE4B/Xyioqa8aRsfYNfWjoETmfE7ld+zXqX 8cPizwGYdsuO4g6mNS0HFuuexkJem9qviRfnQUQ/EJQPNfXB33GYBoFquE0mvFUO WN5QiietSnNp4/TF+BjXlaeo/PtO+Q8xIdqgdSzouslx95a4j3N127k8Yoz55Nx+ 3mEeqvZRf5/7ieIgyHti/v/xKZOyGCs6NwlZ6xN+0kanNqMDfjpKnfzTJnnSTbj6 z6FCzXn986EqL8kpJisKZEJfntvZu4ft/KUo4qzZAtuNgnoUGFYXv5DfQrM75ZJ/ 9PFQzCA+8snPiCyUhAaC =fkvr -----END PGP SIGNATURE----- From owner-freebsd-announce@FreeBSD.ORG Thu Dec 18 16:41:03 2014 Return-Path: Delivered-To: freebsd-announce@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [8.8.178.115]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by hub.freebsd.org (Postfix) with ESMTPS id C5A3DB96 for ; Thu, 18 Dec 2014 16:41:03 +0000 (UTC) Received: from smtp.des.no (smtp.des.no [194.63.250.102]) by mx1.freebsd.org (Postfix) with ESMTP id 875401725 for ; Thu, 18 Dec 2014 16:41:03 +0000 (UTC) Received: from nine.des.no (smtp.des.no [194.63.250.102]) by smtp-int.des.no (Postfix) with ESMTP id 6BB1F9DFC for ; Thu, 18 Dec 2014 16:41:02 +0000 (UTC) Received: by nine.des.no (Postfix, from userid 1001) id 1B66F4229; Thu, 18 Dec 2014 17:40:51 +0100 (CET) From: FreeBSD Security Officer To: freebsd-announce@freebsd.org Date: Thu, 18 Dec 2014 17:40:50 +0100 Message-ID: <86egrwoqr1.fsf@nine.des.no> MIME-Version: 1.0 Content-Type: multipart/signed; boundary="=-=-="; micalg=pgp-sha512; protocol="application/pgp-signature" Subject: [FreeBSD-Announce] [HEADS UP] freebsd-update issues in 10.1 X-BeenThere: freebsd-announce@freebsd.org X-Mailman-Version: 2.1.18-1 Precedence: list List-Id: "Project Announcements \[moderated\]" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 18 Dec 2014 16:41:03 -0000 --=-=-= Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Dear FreeBSD community, As many of you have noticed, running freebsd-update on FreeBSD 10.1 amd64 systems produces unexpected results, including reinstalling the 32-bit compatibility libraries (lib32) on systems where they are not installed and claiming to want to remove the root directory. When FreeBSD 10.1 was released, the lib32 component was inadvertantly left out of the baseline used to generate freebsd-update patches. The consequences are twofold: first, users upgrading from 10.0 to 10.1 would lose lib32; and second, users who had either installed 10.1 from scratch or manually reinstalled lib32 after freebsd-update removed it would not receive patches for it. When this issue was discovered, we were faced with two options: either ignore it or use the next update to re-add lib32. The latter was considered the lesser of two evils, as it was the only way to ensure that lib32 receives security updates. An unfortunate side effect is that freebsd-update will now recreate lib32 even on systems where it was intentionally left out or removed. Users who do not wish to have lib32 installed should replace "world" with "world/base" on the "Components" line in /etc/freebsd-update.conf. The second issue, attempting to remove '/', seems to be the consequence of a bug in the freebsd-update build process which we do not yet fully understand, but which results in an incorrect index for the lib32 component. We hope to be able to correct this (at the latest) when we next publish an advisory. In the meantime, the error can safely be ignored, as freebsd-update will not actually remove anything. Users who have disabled lib32 in /etc/freebsd-update.conf as described above are not affected. DES =2D-=20 Dag-Erling Sm=C3=B8rgrav - FreeBSD Security Officer --=-=-= Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQIcBAEBCgAGBQJUkwOSAAoJEO1n7NZdz2rnQuAP/0r4Piqtak6meI1KADKubm8h LKtzSkpjA+Dp7n5FVjuIuxZOR1TRRinavZ1gxdiiOFwSaSioniyfSaCwx00wbcbY gbaJV2Bn+Ra/u3HS2U4kJBirZzTILK+8Tn0pahZ7/Y/H3f+xGvBHR5Xt2F8cf1N3 4E14cM+RbwUrQwa4hkgja+OiTyb4C9BSkl5b22e2kpvd9gIGeRHfOjOn8EwqPaQz HwF9Hj9eODZFCum0sSWmYNLFSuWOoNgnQdtDpsj1nxg5Kg4kSdoDiyAjaa/s+e+l 4GJyNsCGRpFoIdm9GjSb4/lXEs2qAXR+YJN5SmXtPM+7tqvi22BnHdbnJlFDxqaQ heq9+KdtfzdLiiUmONqJXb+n7VCgLx8BRKQDCLQ+uCrd6+NDMDhASG3zMyMzmhbU fJakaqr2ykcQKL+dwK8F8+EQtjAhRAjxNYkJiPOph6Mba52mOOrkCDi6VnpXOG8q YmtQCuXcjshiPegQNAUmBrpPwCnTUEU+tlfpIz852Ktrqs0s/vZPgA6Ln/J1V38j AOwgcUETO5Cmf/uzvDh0J6/bSUV73Hfth2ya5P462+Z35OC6ZpWjMoCJ080o3u8U 8+8gC8EPYzUKkMd8dF+fZULbzBCBq7+MgHCYBIdm6wmiNbp2JQR0U//QV0t3wknW E7sAu+iOowsMB4MVGZyr =TapW -----END PGP SIGNATURE----- --=-=-=--