From owner-freebsd-security@freebsd.org Sun Mar 6 10:16:41 2016 Return-Path: Delivered-To: freebsd-security@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id 3DE5DA09293 for ; Sun, 6 Mar 2016 10:16:41 +0000 (UTC) (envelope-from nicolas@i.0x5.de) Received: from n.0x5.de (n.0x5.de [217.197.85.144]) by mx1.freebsd.org (Postfix) with ESMTP id 0159BE20 for ; Sun, 6 Mar 2016 10:16:40 +0000 (UTC) (envelope-from nicolas@i.0x5.de) Received: by pc5.i.0x5.de (Postfix, from userid 1003) id 3qHz671mGxzBCQ; Sun, 6 Mar 2016 11:08:47 +0100 (CET) Date: Sun, 6 Mar 2016 11:08:47 +0100 From: Nicolas Rachinsky To: freebsd-security@FreeBSD.org Subject: missing Advisory FreeBSD-SA-16:12.openssl Message-ID: <20160306100847.GA70170@mid.pc5.i.0x5.de> Mail-Followup-To: freebsd-security@FreeBSD.org MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline X-Powered-by: FreeBSD X-Homepage: http://www.rachinsky.de X-PGP-Keyid: 887BAE72 X-PGP-Fingerprint: 039E 9433 115F BC5F F88D 4524 5092 45C4 887B AE72 X-PGP-Keys: http://www.rachinsky.de/nicolas/gpg/nicolas_rachinsky.asc User-Agent: Mutt/1.5.24 (2015-08-30) X-BeenThere: freebsd-security@freebsd.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: "Security issues \[members-only posting\]" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 06 Mar 2016 10:16:41 -0000 Hallo, there is an commit for an advisory FreeBSD-SA-16:12.openssl from about two days ago. https://svnweb.freebsd.org/base?view=revision&revision=296341 But I got no mail for this advisory and it is not listed on http://www.freebsd.org/ or https://www.freebsd.org/security/advisories.html. Nicolas From owner-freebsd-security@freebsd.org Sun Mar 6 20:52:19 2016 Return-Path: Delivered-To: freebsd-security@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id 51E22AC2517 for ; Sun, 6 Mar 2016 20:52:19 +0000 (UTC) (envelope-from delphij@gmail.com) Received: from mail-io0-x234.google.com (mail-io0-x234.google.com [IPv6:2607:f8b0:4001:c06::234]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (Client CN "smtp.gmail.com", Issuer "Google Internet Authority G2" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 30EB98C for ; Sun, 6 Mar 2016 20:52:19 +0000 (UTC) (envelope-from delphij@gmail.com) Received: by mail-io0-x234.google.com with SMTP id g203so112275209iof.2 for ; Sun, 06 Mar 2016 12:52:19 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:in-reply-to:references:date:message-id:subject:from:to; bh=z78Q1NogbLMAA55517QoqLwfXYUed/d4aSLnvok3wjM=; b=L35zfqfMrhEdFhNECaGWXtvMZ2IKDdP1Cqvp5CdJmzA8PQJYU3YwMR4cFRAl18fHQT SuJ1JTDBLAaTIZYR0RS8ETdONSDIYcaBVFar70uWOHFhtnAVS151/qfL8w2x8YB8XWPV kBMAGYT420UaxdDt1W6WwVogoT5XO32tuIMJ7eyay5t8hMB3fY0T3pvlkYiPr/sHxEiM 4vgT/rNG8rekKkmabWb3c4b6eFWFGKIwh6Y0t6dxo0jMjWQ8+tV0s5B53vCEBdq1JB2Q 8BklN6OmCyfaPr1lS1Yt8yIaHBNhpmEyz8U9RcuO+JrbC4br3/NBgFU5hKFmfy5GifnV QldA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:in-reply-to:references:date :message-id:subject:from:to; bh=z78Q1NogbLMAA55517QoqLwfXYUed/d4aSLnvok3wjM=; b=c2eXVVQIOPXxMOGOPTulCaMFCEDGZt4IIVa0E+cH/u77fwjEFzRvTwhlkFTdFZ1Yca knJBVxC8xeGTRuAJrFbeYwNDXk8NgrnM5b1I/gHy89C0pqgnKVjwiyAgbv4UNQnKnwtq ZNQFPygDqiDFqL+eUMSbUcTp729XyiKbo9rhhprnxofLRVigrHnnm+L1ljKpp3g8dU/n SJ5dUeQCm01Zi5CqqvGLv0XU/P9yC0cHHc/zKQ3CqYnmaLh0df+yvu09IShbrWk5qNme c9MzyR06mu7PXlAkZoMZjXEuH+FYwihWJXMqM3ROiS2X+4rztfHX9IvrKB0J8YlBKyhk wjTg== X-Gm-Message-State: AD7BkJLfGE5FA2CsWExWWVDgWBVg9j+1q8fqZ3XXywaMktV4ai4/2B1pFz1b5tFyRQDorCjvlN/oUka3NLcbZQ== MIME-Version: 1.0 X-Received: by 10.107.29.212 with SMTP id d203mr12007665iod.6.1457297538474; Sun, 06 Mar 2016 12:52:18 -0800 (PST) Received: by 10.36.54.207 with HTTP; Sun, 6 Mar 2016 12:52:18 -0800 (PST) In-Reply-To: <20160306100847.GA70170@mid.pc5.i.0x5.de> References: <20160306100847.GA70170@mid.pc5.i.0x5.de> Date: Sun, 6 Mar 2016 12:52:18 -0800 Message-ID: Subject: Re: missing Advisory FreeBSD-SA-16:12.openssl From: Xin LI To: "freebsd-security@freebsd.org" Content-Type: text/plain; charset=UTF-8 X-BeenThere: freebsd-security@freebsd.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: "Security issues \[members-only posting\]" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 06 Mar 2016 20:52:19 -0000 We are still working on it and it's not final yet. On Sun, Mar 6, 2016 at 2:08 AM, Nicolas Rachinsky wrote: > Hallo, > > there is an commit for an advisory FreeBSD-SA-16:12.openssl from about > two days ago. > https://svnweb.freebsd.org/base?view=revision&revision=296341 > > But I got no mail for this advisory and it is not listed on > http://www.freebsd.org/ or > https://www.freebsd.org/security/advisories.html. > > > Nicolas > > _______________________________________________ > freebsd-security@freebsd.org mailing list > https://lists.freebsd.org/mailman/listinfo/freebsd-security > To unsubscribe, send any mail to "freebsd-security-unsubscribe@freebsd.org" -- Xin LI https://www.delphij.net/ FreeBSD - The Power to Serve! Live free or die From owner-freebsd-security@freebsd.org Tue Mar 8 09:45:55 2016 Return-Path: Delivered-To: freebsd-security@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id 1B8FFAC3B77 for ; Tue, 8 Mar 2016 09:45:55 +0000 (UTC) (envelope-from hirano@t.kanazawa-u.ac.jp) Received: from mailwd01.kanazawa-u.ac.jp (mailwd01.kanazawa-u.ac.jp [133.28.3.23]) (using TLSv1.1 with cipher ECDHE-RSA-AES256-SHA (256/256 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id DC908F02 for ; Tue, 8 Mar 2016 09:45:54 +0000 (UTC) (envelope-from hirano@t.kanazawa-u.ac.jp) Received: from mailvc04.kanazawa-u.ac.jp (mailvc04.kanazawa-u.ac.jp [133.28.3.94]) by mailwd01.kanazawa-u.ac.jp (Postfix) with ESMTP id 8D2353C0314 for ; Tue, 8 Mar 2016 18:34:40 +0900 (JST) Received: from mailvc04.kanazawa-u.ac.jp (localhost [127.0.0.1]) by localhost.kanazawa-u.ac.jp (Postfix) with ESMTP id 7E15142D75 for ; Tue, 8 Mar 2016 18:34:40 +0900 (JST) Received: from smtp01.kanazawa-u.ac.jp (smtp01.kanazawa-u.ac.jp [133.28.3.64]) by mailvc04.kanazawa-u.ac.jp (Postfix) with ESMTP id 76E1C42D5D for ; Tue, 8 Mar 2016 18:34:40 +0900 (JST) Received: from mail.se.kanazawa-u.ac.jp (mail.se.kanazawa-u.ac.jp [133.28.0.131]) by smtp01.kanazawa-u.ac.jp (Postfix) with ESMTP id 71F8D11605A; Tue, 8 Mar 2016 18:34:40 +0900 (JST) Received: from [192.168.1.197] (canes.ec.t.kanazawa-u.ac.jp [133.28.97.35]) (Authenticated sender: hirano@se.kanazawa-u.ac.jp) by mail.se.kanazawa-u.ac.jp (Postfix) with ESMTPSA id B57F34E61B; Tue, 8 Mar 2016 18:34:35 +0900 (JST) To: freebsd-security@freebsd.org From: Akihiro HIRANO Subject: openssl bug causes sshd crashed on FreeBSD 9.3-RELEASE Message-ID: <56DE9CA8.3010206@t.kanazawa-u.ac.jp> Date: Tue, 8 Mar 2016 18:34:32 +0900 User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:38.0) Gecko/20100101 Thunderbird/38.6.0 MIME-Version: 1.0 Content-Type: text/plain; charset=iso-2022-jp Content-Transfer-Encoding: 7bit X-TM-AS-MML: No X-BeenThere: freebsd-security@freebsd.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: "Security issues \[members-only posting\]" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 08 Mar 2016 09:45:55 -0000 On FreeBSD 9.3-RELEASE-p37, sshd crashes by signal 11. Mar 8 17:32:20 hostname kernel: pid 22651 (sshd), uid 0: exited on signal 11 On FreeBSD 10.1-RELEASE-p30, sshd works fine. As far as I have examined, the reason is OpenSSL in base system. The following tests have been performed on FreeBSD 9.3-RELEASE-p37: (1) sshd in base system crashes. (2) openssh-portable from pkg which uses base OpenSSL library crashes. (3) openssh-portable from ports with OpenSSL from pkg works fine. Therefore, I suggest that the openssl library in base system might have a problem. Best Regards, ---- Akihiro HIRANO, Kanazawa University hirano@t.kanazawa-u.ac.jp From owner-freebsd-security@freebsd.org Tue Mar 8 21:37:30 2016 Return-Path: Delivered-To: freebsd-security@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id D1FC5A13588 for ; Tue, 8 Mar 2016 21:37:30 +0000 (UTC) (envelope-from cfp@ruxcon.org.au) Received: from ruxcon.org.au (ruxcon.org.au [45.33.59.6]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id BBFEDAFF for ; Tue, 8 Mar 2016 21:37:30 +0000 (UTC) (envelope-from cfp@ruxcon.org.au) Received: by ruxcon.org.au (Postfix, from userid 110) id 99D1D10A29; Tue, 8 Mar 2016 21:29:32 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=ruxcon.org.au; s=mail; t=1457472572; bh=PHP0BrHEBHyFgUPqzZrc18obkM8wL0NiceUoS2ZubYo=; h=Subject:From:To:Date:From; b=HmXfEL7lhUqDGF1kdNZvg6zRztu7a/TbrfKALFDbnWGJ6pg8L9WeYQkOpbBaOj65c /BSCmBZV9EeEfuXr6M+V5h1P2Kv5O+eum/XG9LdTSqWVgpg1ahghz4OQN0ZIn+PR3E 5D62sxTp7NWsk5dehqxDC6QRyzuT53qd9ZZ/JUpg= X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on ruxcon.org.au X-Spam-Level: * X-Spam-Status: No, score=2.0 required=5.0 tests=ALL_TRUSTED,BAYES_50, HTML_MESSAGE,HTML_TAG_BALANCE_BODY,HTML_TAG_BALANCE_HEAD,T_DKIM_INVALID autolearn=disabled version=3.4.0 Received: from ruxcon.org.au (localhost [127.0.0.1]) by ruxcon.org.au (Postfix) with ESMTP id 200BD10A35 for ; Tue, 8 Mar 2016 21:29:27 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=ruxcon.org.au; s=mail; t=1457472567; bh=PHP0BrHEBHyFgUPqzZrc18obkM8wL0NiceUoS2ZubYo=; h=Subject:From:To:Date:From; b=bMYWRN1uLM4IVgQ1RDNqSez31SYmsXOgq0Duei8iq05mqjEUi+OFodmhB0FbKZMne kMtCC2233mQGeXn7rckz6RqRsb2EJL+yJk100OvjisgFgK1n2sAgLObWE5TntXgU0X iK0AYksuMgJQfBVl2C/rvzQT6SvI6HhhxnImlicE= MIME-Version: 1.0 Subject: Ruxcon 2016 Call For Presentations From: cfp@ruxcon.org.au To: freebsd-security@freebsd.org Date: Tue, 08 Mar 2016 21:29:27 +0000 Message-Id: <20160308212927.200BD10A35@ruxcon.org.au> X-Mailman-Approved-At: Tue, 08 Mar 2016 23:01:00 +0000 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit X-Content-Filtered-By: Mailman/MimeDel 2.1.21 X-BeenThere: freebsd-security@freebsd.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: "Security issues \[members-only posting\]" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 08 Mar 2016 21:37:30 -0000 Ruxcon 2016 Call For Presentations Melbourne, Australia, October 22-23 CQ Function Centre http://www.ruxcon.org.au The Ruxcon team is pleased to announce the first round of Call For Presentations for Ruxcon 2016. This year the conference will take place over the weekend of the 22nd and 23rd of October at the CQ Function Centre, Melbourne, Australia. The deadline for submissions is the 30th of June, 2016. .[x]. About Ruxcon .[x]. Ruxcon is ia premier technical computer security conference in the Australia. The conference aims to bring together the individual talents of the best and brightest security folk in the region, through live presentations, activities and demonstrations. The conference is held over two days in a relaxed atmosphere, allowing attendees to enjoy themselves whilst networking within the community and expanding their knowledge of security. Live presentations and activities will cover a full range of defensive and offensive security topics, varying from previously unpublished research to required reading for the security community. .[x]. Important Dates .[x]. June 30 - Call For Presentations Close October 17-21 - Ruxcon Training October 22-23 - Ruxcon Conference .[x]. Topic Scope .[x]. o Topics of interest include, but are not limited to: o Mobile Device Security o Virtualization, Hypervisor, and Cloud Security o Malware Analysis o Reverse Engineering o Exploitation Techniques o Rootkit Development o Code Analysis o Forensics and Anti-Forensics o Embedded Device Security o Web Application Security o Network Traffic Analysis o Wireless Network Security o Cryptography and Cryptanalysis o Social Engineering o Law Enforcement Activities o Telecommunications Security (SS7, 3G/4G, GSM, VOIP, etc) .[x]. Submission Guidelines .[x]. In order for us to process your submission we require the following information: 1. Presentation title 2. Detailed summary of your presentation material 3. Name/Nickname 4. Mobile phone number 5. Brief personal biography 6. Description of any demonstrations involved in the presentation 7. Information on where the presentation material has or will be presented before Ruxcon To submit a presentation please use our submission form: https://goo.gl/75WhtZ * As a general guideline, Ruxcon presentations are between 45 and 60 minutes, including question time. .[x]. Contact .[x]. o Email: presentations@ruxcon.org.au o Twitter: @ruxcon From owner-freebsd-security@freebsd.org Wed Mar 9 11:08:52 2016 Return-Path: Delivered-To: freebsd-security@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id E374BAC8BCA for ; Wed, 9 Mar 2016 11:08:52 +0000 (UTC) (envelope-from moeller@gonicus.de) Received: from mail-1.ar.gonicus.de (mail-1.gonicus.de [212.8.3.3]) by mx1.freebsd.org (Postfix) with ESMTP id A3070DFA for ; Wed, 9 Mar 2016 11:08:51 +0000 (UTC) (envelope-from moeller@gonicus.de) Received: from localhost (localhost [127.0.0.1]) by mail-1.ar.gonicus.de (Postfix) with ESMTP id 390A84CA262; Wed, 9 Mar 2016 11:59:04 +0100 (CET) Received: from mail-1.gonicus.de (localhost [127.0.0.1]) by mail-1.ar.gonicus.de (Postfix) with ESMTP id 06D134CA261; Wed, 9 Mar 2016 11:59:03 +0100 (CET) Received: from localhost (localhost [127.0.0.1]) by mail-1.gonicus.de (Postfix) with ESMTP id D107013C22; Wed, 9 Mar 2016 11:59:03 +0100 (CET) Received: from localhost (localhost [127.0.0.1]) by mail-1.gonicus.de (Postfix) with ESMTP id A042113C63; Wed, 9 Mar 2016 11:59:03 +0100 (CET) X-Virus-Scanned: by amavisd-new at gonicus.de Received: from mail-1.gonicus.de ([127.0.0.1]) by localhost (mail-1.gonicus.de [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id zSkF3sfbVWfB; Wed, 9 Mar 2016 11:59:03 +0100 (CET) X-Virus-Scanner: This message was checked by ESET Mail Security for Linux/BSD. For more information on ESET Mail Security, please, visit our website: http://www.eset.com/. Received: from zarafa.ms.gonicus.de (zarafa.ms.gonicus.de [10.9.1.55]) by mail-1.gonicus.de (Postfix) with ESMTP id 39E0413C22; Wed, 9 Mar 2016 11:59:03 +0100 (CET) Subject: Re: openssl bug causes sshd crashed on FreeBSD 9.3-RELEASE From: =?utf-8?Q?Frank_M=C3=B6ller?= To: =?utf-8?Q?hirano=40t=2Ekanazawa-u=2Eac=2Ejp?= Cc: =?utf-8?Q?freebsd-security=40freebsd=2Eorg?= Date: Wed, 9 Mar 2016 11:59:03 +0100 Mime-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable X-Priority: 3 (Normal) X-Mailer: Zarafa 7.1.14-51822 X-Original-To: Message-Id: X-ESET-AntiSpam: OK;0;calc;2016-03-09 11:59:03;1603091159030029;C0FA X-BeenThere: freebsd-security@freebsd.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: "Security issues \[members-only posting\]" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 09 Mar 2016 11:08:53 -0000 Hello, I got the same problem here. After updating to FreeBSD 9.3-RELEASE-p37 sshd from the base system crashes by signal 11 when I connect to the server with an old ssh client (e.g. OpenSSH_4.5p1).=20 Using a newer ssh client versions (e.g. OpenSSH_6.6.1p1 from FreeBSD 9.3-RELEASE-p10) the sshd works fine. Best Regards Frank Moeller --=20 Frank M"oller GONICUS GmbH > On FreeBSD 9.3-RELEASE-p37, sshd crashes by signal 11. > Mar=C2=A0 8 17:32:20 hostname kernel: pid 22651 (sshd), uid 0: exited on > signal 11 >=20 > On FreeBSD 10.1-RELEASE-p30, sshd works fine. >=20 > As far as I have examined, the reason is OpenSSL in base system. > The following tests have been performed on FreeBSD 9.3-RELEASE-p37: >=20 > (1) sshd in base system crashes. > (2) openssh-portable from pkg which uses base OpenSSL library crashes. > (3) openssh-portable from ports with OpenSSL from pkg works fine. >=20 > Therefore, I suggest that the openssl library in base system > might have a problem. >=20 > Best Regards, > ---- > Akihiro HIRANO, Kanazawa University > hirano at t.kanazawa-u.ac.jp From owner-freebsd-security@freebsd.org Wed Mar 9 12:32:43 2016 Return-Path: Delivered-To: freebsd-security@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id C3550AC7C15 for ; Wed, 9 Mar 2016 12:32:43 +0000 (UTC) (envelope-from hirano@t.kanazawa-u.ac.jp) Received: from mailwd01.kanazawa-u.ac.jp (mailwd01.kanazawa-u.ac.jp [133.28.3.23]) (using TLSv1.1 with cipher ECDHE-RSA-AES256-SHA (256/256 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id 8A00EC8A for ; Wed, 9 Mar 2016 12:32:43 +0000 (UTC) (envelope-from hirano@t.kanazawa-u.ac.jp) Received: from mailvc04.kanazawa-u.ac.jp (mailvc04.kanazawa-u.ac.jp [133.28.3.94]) by mailwd01.kanazawa-u.ac.jp (Postfix) with ESMTP id 0BAF03C04BC for ; Wed, 9 Mar 2016 21:32:32 +0900 (JST) Received: from mailvc04.kanazawa-u.ac.jp (localhost [127.0.0.1]) by localhost.kanazawa-u.ac.jp (Postfix) with ESMTP id EF31343257 for ; Wed, 9 Mar 2016 21:32:31 +0900 (JST) Received: from smtp01.kanazawa-u.ac.jp (smtp01.kanazawa-u.ac.jp [133.28.3.64]) by mailvc04.kanazawa-u.ac.jp (Postfix) with ESMTP id DCF6743253 for ; Wed, 9 Mar 2016 21:32:31 +0900 (JST) Received: from mail.se.kanazawa-u.ac.jp (mail.se.kanazawa-u.ac.jp [133.28.0.131]) by smtp01.kanazawa-u.ac.jp (Postfix) with ESMTP id CDE2F11605A; Wed, 9 Mar 2016 21:32:31 +0900 (JST) Received: from [192.168.1.197] (canes.ec.t.kanazawa-u.ac.jp [133.28.97.35]) (Authenticated sender: hirano@se.kanazawa-u.ac.jp) by mail.se.kanazawa-u.ac.jp (Postfix) with ESMTPSA id 938FE4E61B; Wed, 9 Mar 2016 21:32:31 +0900 (JST) Subject: Re: openssl bug causes sshd crashed on FreeBSD 9.3-RELEASE References: To: "freebsd-security@freebsd.org" From: Akihiro HIRANO Message-ID: <56E017E2.9060305@t.kanazawa-u.ac.jp> Date: Wed, 9 Mar 2016 21:32:34 +0900 User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:38.0) Gecko/20100101 Thunderbird/38.6.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 8bit X-TM-AS-MML: No X-BeenThere: freebsd-security@freebsd.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: "Security issues \[members-only posting\]" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 09 Mar 2016 12:32:43 -0000 Hi, On 2016/03/09 19:59, Frank Möller wrote: > I got the same problem here. > > After updating to FreeBSD 9.3-RELEASE-p37 sshd from the base system crashes by signal 11 > when I connect to the server with an old ssh client (e.g. OpenSSH_4.5p1). > Using a newer ssh client versions (e.g. OpenSSH_6.6.1p1 from FreeBSD 9.3-RELEASE-p10) > the sshd works fine. Hum... I tried OpenSSH_6.6.1p1 client on 9.3-RELEASE-p37 and OpenSSH_6.4p1 client on 10.0-RELEASE-p18. Both clients cause sshd on 9.3-RELEASE-p37 crashed by signal 11. Another admin states that postfix smtpd also has the same problem. Using security/openssl is also a workaround for this case. Best Regards, ---- Akihiro HIRANO, Kanazawa University hirano@t.kanazawa-u.ac.jp From owner-freebsd-security@freebsd.org Wed Mar 9 14:09:21 2016 Return-Path: Delivered-To: freebsd-security@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id 85EA3AC9DCE for ; Wed, 9 Mar 2016 14:09:21 +0000 (UTC) (envelope-from list-freebsd-security@jyborn.se) Received: from mailgate.leissner.se (mailgate.leissner.se [212.3.1.210]) by mx1.freebsd.org (Postfix) with ESMTP id 211E8DE0 for ; Wed, 9 Mar 2016 14:09:20 +0000 (UTC) (envelope-from list-freebsd-security@jyborn.se) Received: from mailgate.leissner.se (localhost [127.0.0.1]) by mailgate.leissner.se (8.15.2/8.15.1) with ESMTP id u29E1SH9095284 for ; Wed, 9 Mar 2016 15:01:28 +0100 (CET) (envelope-from list-freebsd-security@jyborn.se) Received: (from uucp@localhost) by mailgate.leissner.se (8.15.2/8.15.1/Submit) id u29E1SPJ095283 for ; Wed, 9 Mar 2016 15:01:28 +0100 (CET) (envelope-from list-freebsd-security@jyborn.se) Received: from pol.leissner.se(192.71.29.17), claiming to be "pol-server.leissner.se" via SMTP by mailgate.leissner.se, id smtpdhyj4UD; Wed Mar 9 15:01:25 2016 Received: from localhost (pol-server.leissner.se [local]); by pol-server.leissner.se (OpenSMTPD) with ESMTPA id 07c9eb68; for ; Wed, 9 Mar 2016 15:01:25 +0100 (CET) Date: Wed, 9 Mar 2016 15:01:25 +0100 From: Peter To: "freebsd-security@freebsd.org" Subject: Re: openssl bug causes sshd crashed on FreeBSD 9.3-RELEASE Message-ID: <20160309140125.GH13515@pol-server.leissner.se> MIME-Version: 1.0 Content-Type: text/plain; charset=iso-8859-1 Content-Disposition: inline Content-Transfer-Encoding: 8bit User-Agent: Mutt/1.5.23 (2014-03-12) X-BeenThere: freebsd-security@freebsd.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: "Security issues \[members-only posting\]" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 09 Mar 2016 14:09:21 -0000 On Wed, Mar 09, 2016 at 09:32:34PM +0900, Akihiro HIRANO wrote: > Hi, > > On 2016/03/09 19:59, Frank Möller wrote: > >I got the same problem here. > > > >After updating to FreeBSD 9.3-RELEASE-p37 sshd from the base system crashes by signal 11 > > when I connect to the server with an old ssh client (e.g. OpenSSH_4.5p1). > >Using a newer ssh client versions (e.g. OpenSSH_6.6.1p1 from FreeBSD 9.3-RELEASE-p10) > > the sshd works fine. > > Hum... I tried OpenSSH_6.6.1p1 client on 9.3-RELEASE-p37 > and OpenSSH_6.4p1 client on 10.0-RELEASE-p18. > Both clients cause sshd on 9.3-RELEASE-p37 crashed by signal 11. > > > Another admin states that postfix smtpd also has the same problem. > Using security/openssl is also a workaround for this case. A much worse problem, for me at least, is that 9.3-RELEASE-p37 makes apache crash with signal 11. I only tried this in a web server running https, so I don't know if apache running only http also crashes. Luckily I use freebsd-update, so I could solve the problem easily with freebsd-update rollback. Peter From owner-freebsd-security@freebsd.org Wed Mar 9 14:05:28 2016 Return-Path: Delivered-To: freebsd-security@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id 2386DAC9C29 for ; Wed, 9 Mar 2016 14:05:28 +0000 (UTC) (envelope-from pkubaj@anongoth.pl) Received: from anongoth.pl (anongoth.pl [88.156.79.165]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client CN "anongoth.pl", Issuer "Let's Encrypt Authority X1" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id D1611CA6 for ; Wed, 9 Mar 2016 14:05:27 +0000 (UTC) (envelope-from pkubaj@anongoth.pl) Received: from mail (unknown [127.0.1.10]) by anongoth.pl (Postfix) with ESMTP id 9156654F8 for ; Wed, 9 Mar 2016 15:05:24 +0100 (CET) X-Virus-Scanned: amavisd-new at anongoth.pl Received: from anongoth.pl ([127.0.1.10]) by mail (anongoth.pl [127.0.1.10]) (amavisd-new, port 10024) with LMTP id iaZWYdbTt-tN for ; Wed, 9 Mar 2016 15:05:11 +0100 (CET) Received: from [10.10.0.70] (unknown [46.248.161.165]) (using TLSv1.2 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) (Authenticated sender: pkubaj) by anongoth.pl (Postfix) with ESMTPSA id 8A87F54E6 for ; Wed, 9 Mar 2016 15:05:10 +0100 (CET) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=anongoth.pl; s=ANONGOTH; t=1457532310; bh=tKrw0MpN6xbELnk8+cS+kbnbxDmgqtRS0Us/PGyhX34=; h=To:From:Subject:Date; b=a+AYkYwNkQRqB88RYW9fGfj8yJK0U6xcd634HMUlBFwatP5b2TBhlPokWQaqR4Wls PbJcMEcX2ls0jO7aqgEAEQxWN6RGu6BcPNsnVBKlVjNuEon6oDtL475qFj6JLPJsnq TZ9fnBXF5JQO11nw8K/UjX50/YK6xbammc5MCb2J6fzHCtlk/l9gxT3LhE8H4Q4D6t gwY27lGcuyqd6BYRGW2bHg1pdmwamFVvoumj6xwy4s/foivjHGKJVdBqpPLW7madQU i9Oub2DMhLpy3nOu3w1ncLGo0bJ4KqBuftguiCcc8OVNM/5LwV3mtpgFhYu8J5PlAI r/f6I4IBEmz+g== To: freebsd-security@freebsd.org From: Piotr Kubaj Subject: Will 11.0-RELEASE include ASLR? X-Enigmail-Draft-Status: N1110 Message-ID: <56E02D95.9020303@anongoth.pl> Date: Wed, 9 Mar 2016 15:05:09 +0100 User-Agent: Mozilla/5.0 (X11; FreeBSD amd64; rv:38.0) Gecko/20100101 Thunderbird/38.6.0 MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Mailman-Approved-At: Wed, 09 Mar 2016 14:18:18 +0000 X-BeenThere: freebsd-security@freebsd.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: "Security issues \[members-only posting\]" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 09 Mar 2016 14:05:28 -0000 -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Shawn Webb has recently announced that ASLR is complete on HardenedBSD. There are patches ready for FreeBSD to use and it's ready to be shipped in FreeBSD. However, for some reason FreeBSD developers do not want to ship ASLR in FreeBSD. Why can't it be included at least as non-default src.conf option and marked as experimental? FreeBSD is the only OS that matters that doesn't have ASLR. -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 iQIcBAEBCAAGBQJW4C2QAAoJEHpZm4Ugg5yd2MoQAMPZ+UxbpTo9YvJz6YYB8wtH tRw3jQMUb4K6s26IO1mp/K6p+DM+HXcVvamO2cxjRKseQy/oLBGizgfR1ktBqdXQ xuqQJc5BCSdKgTsBs0IvNQghvUQkEyvYi+wn9EY9qJh6oEguAkcAWUhl5rGN2FhM Gwf9VDoPAR+n9Pjl6brcqyQvWczfDx9+VFpF0joeiI5PRRMF1UUsTYM/OHvtVoQA n1f8qNppIdprjwUjWE/BX6POaDhs4ZZKJRaFmbCuYudDPpX7P1yj7CHz/xthjMYG 325NnCJpN81fwCmcgvDFU3BYkEC9JSkBoA+5oDdRU3MALsJNQ10rz+IhAaeAsCMb oz7Oy0Gykeic60NLuMZlhOfl79XW666T1B9wOWlkrAlBPCY6v2kz6t/oJbHHGQOf CCBuhQJCdzdqyTnv0Bx4ZXiiecwhjvxaAPCwgppnxf2qLuBgxr9BsswMVp7wgYfM 2sfxk0pS0RuV5M2qWN9UATOyOiO5aPsC4f+WUzUM0LC6MbuHVDJu3QaUo7F3b3Ic KX150B3gWtsGlZZs8N9mIM3Aj/O5E496JHEf6zmlz6ssLuE6gIO8ICqpFSaXzkJC IWzgIVdL88gK6niVg7KCOAuzVZ1sxcx7cBCtGzAhVy9RhYKqwAtN9T2YOBC75cQW OdRGf2V3trcK664nKgEA =lM/6 -----END PGP SIGNATURE----- From owner-freebsd-security@freebsd.org Wed Mar 9 16:05:14 2016 Return-Path: Delivered-To: freebsd-security@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id 492B2AC925B for ; Wed, 9 Mar 2016 16:05:14 +0000 (UTC) (envelope-from spankthespam@gmail.com) Received: from mail-vk0-x22b.google.com (mail-vk0-x22b.google.com [IPv6:2607:f8b0:400c:c05::22b]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (Client CN "smtp.gmail.com", Issuer "Google Internet Authority G2" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 04C9563D for ; Wed, 9 Mar 2016 16:05:14 +0000 (UTC) (envelope-from spankthespam@gmail.com) Received: by mail-vk0-x22b.google.com with SMTP id e6so61041913vkh.2 for ; Wed, 09 Mar 2016 08:05:13 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc; bh=FyZsCGxc14k+JxOHbbaeIiZhngK5e/hNSRAzZPpyqX8=; b=R5apct7FGwrmbsL1xUlJw1TDHVrbruRjhBX/1dQRmtrkS9jrnHgXV/vQFSS7MLN8pu 1BXWo1EFQapNwm6/hW3nNvVQYQUiFu9k8L8k2VA4b5baMv2uXK6s0WcMr68Ih/N28GCv /1TznW/YZFRmpZBv1QzonDAogzsR51f/+8hJPlIObd21Gwkjybx7tSKEdoAVCzmUQIUh WgB++0wBoMbHDbY5VzDcZQ82pLdYX+u45aGDCHdIzt8jGXFXV31bD5ssdZG9eq+TPu4K vED5N1duGJfGfU6RA8zwmcXOdxG1fgwS2jOw7/eCZy33OWoFOmEoirnOgPt5cfYZHD+9 9/xg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:in-reply-to:references:date :message-id:subject:from:to:cc; bh=FyZsCGxc14k+JxOHbbaeIiZhngK5e/hNSRAzZPpyqX8=; b=LoLdjy5CPLWOFhZYkeF9GsAiE7cujDo1bUvYIO/UfvNRXIWIzg+lQ9Hrqsdd0xdGTK KmG/mr+3uOoiHrWgjBMZHXTSM9TsP3mvOiLzf7qKyrxFhWeRsSf/aGaoWuUckqE2iJrR f0zJP8lzLA0oAUMjWHro/ECdXNAOgw2KQ6XAEI2fxtK7iMcEoXtdS/kvVW/PsbqyUzMA dPTlEh/9aCio8Wlwv3U+B2pFMLYcTMVq6MojSWPfdYrpMeQ5D5PFEYnUEVSUvREkqqCp stxnW16CB/497rqpyqvGGB+0LWopPPlQ4K+Z0lojgPebQ4dLYDoa30lCXo/SjJKlY47W wJ6Q== X-Gm-Message-State: AD7BkJLw45WqOQ/kFzkzY2l+wQXZbgIz/3TBfilvGjzucTu0C30/fJ6ZRPuGZftu92C3lHdEHNvYtFRrpRrxNQ== MIME-Version: 1.0 X-Received: by 10.31.6.130 with SMTP id 124mr26979334vkg.106.1457539513011; Wed, 09 Mar 2016 08:05:13 -0800 (PST) Received: by 10.31.133.16 with HTTP; Wed, 9 Mar 2016 08:05:12 -0800 (PST) In-Reply-To: <56E02D95.9020303@anongoth.pl> References: <56E02D95.9020303@anongoth.pl> Date: Wed, 9 Mar 2016 16:05:12 +0000 Message-ID: Subject: Re: Will 11.0-RELEASE include ASLR? From: Big Lebowski To: Piotr Kubaj Cc: freebsd-security Content-Type: text/plain; charset=UTF-8 X-Content-Filtered-By: Mailman/MimeDel 2.1.21 X-BeenThere: freebsd-security@freebsd.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: "Security issues \[members-only posting\]" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 09 Mar 2016 16:05:14 -0000 Hi Piotr, There are people who can probably answer it better, but until they do, I can share what I've heard about it: on the FreeBSD side there are few things that stop ASLR implementation: - there's no actual agreement between the influencial developers on wether ASLR is viable or needed in first place - there was no planning or discussion how to implement ALSR in FreeBSD, Shawn simply started writing the code, and some developers would like to discuss and plan things first - there are doubts expressed in the code reviews about code quality and compliance to FreeBSD standards. Some developers dedicated their time to review the code and provide feedback, there were few cycles of rewrite, review, rinse, repeat, but if you'd look into the reviews, Shawn closed them, and I understand they'd only be considered for inclusion if they'd meet the code quality standards expected As a side note, one person saying 'ASLR implementation is finished' and proper ASLR implementation that's properly tested, functional and not in fact opening other security issues are two vastly different things, that should be approached very carefully. Cheers, BL On Wed, Mar 9, 2016 at 2:05 PM, Piotr Kubaj wrote: > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA256 > > Shawn Webb has recently announced that ASLR is complete on HardenedBSD. > There are patches ready for FreeBSD to use and it's ready to be shipped > in FreeBSD. However, for some reason FreeBSD developers do not want to > ship ASLR in FreeBSD. Why can't it be included at least as non-default > src.conf option and marked as experimental? > > FreeBSD is the only OS that matters that doesn't have ASLR. > -----BEGIN PGP SIGNATURE----- > Version: GnuPG v2 > > iQIcBAEBCAAGBQJW4C2QAAoJEHpZm4Ugg5yd2MoQAMPZ+UxbpTo9YvJz6YYB8wtH > tRw3jQMUb4K6s26IO1mp/K6p+DM+HXcVvamO2cxjRKseQy/oLBGizgfR1ktBqdXQ > xuqQJc5BCSdKgTsBs0IvNQghvUQkEyvYi+wn9EY9qJh6oEguAkcAWUhl5rGN2FhM > Gwf9VDoPAR+n9Pjl6brcqyQvWczfDx9+VFpF0joeiI5PRRMF1UUsTYM/OHvtVoQA > n1f8qNppIdprjwUjWE/BX6POaDhs4ZZKJRaFmbCuYudDPpX7P1yj7CHz/xthjMYG > 325NnCJpN81fwCmcgvDFU3BYkEC9JSkBoA+5oDdRU3MALsJNQ10rz+IhAaeAsCMb > oz7Oy0Gykeic60NLuMZlhOfl79XW666T1B9wOWlkrAlBPCY6v2kz6t/oJbHHGQOf > CCBuhQJCdzdqyTnv0Bx4ZXiiecwhjvxaAPCwgppnxf2qLuBgxr9BsswMVp7wgYfM > 2sfxk0pS0RuV5M2qWN9UATOyOiO5aPsC4f+WUzUM0LC6MbuHVDJu3QaUo7F3b3Ic > KX150B3gWtsGlZZs8N9mIM3Aj/O5E496JHEf6zmlz6ssLuE6gIO8ICqpFSaXzkJC > IWzgIVdL88gK6niVg7KCOAuzVZ1sxcx7cBCtGzAhVy9RhYKqwAtN9T2YOBC75cQW > OdRGf2V3trcK664nKgEA > =lM/6 > -----END PGP SIGNATURE----- > _______________________________________________ > freebsd-security@freebsd.org mailing list > https://lists.freebsd.org/mailman/listinfo/freebsd-security > To unsubscribe, send any mail to "freebsd-security-unsubscribe@freebsd.org > " > From owner-freebsd-security@freebsd.org Wed Mar 9 16:22:16 2016 Return-Path: Delivered-To: freebsd-security@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id E6545AC9B85 for ; Wed, 9 Mar 2016 16:22:15 +0000 (UTC) (envelope-from shawn.webb@hardenedbsd.org) Received: from mail-qg0-x22e.google.com (mail-qg0-x22e.google.com [IPv6:2607:f8b0:400d:c04::22e]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (Client CN "smtp.gmail.com", Issuer "Google Internet Authority G2" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 9E24A278 for ; Wed, 9 Mar 2016 16:22:15 +0000 (UTC) (envelope-from shawn.webb@hardenedbsd.org) Received: by mail-qg0-x22e.google.com with SMTP id t4so45780262qge.0 for ; Wed, 09 Mar 2016 08:22:15 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=hardenedbsd-org.20150623.gappssmtp.com; s=20150623; h=date:from:to:cc:subject:message-id:references:mime-version :content-disposition:in-reply-to:user-agent; bh=cdpEmDXEkeuocFMl1SLtGFANxlae0K4WNkgjOV1WBVw=; b=IltHIvg2HdRVgeH8Xdn6xEWmlX3U4zZMgLj3PiEnUZ2l9nDQRDc0OuSGQO/x/phH1U 8yrOZEcbZycr50C4XGfRXyNztEB+2Vmvgl7ARaCrp79M7fQzx+ObLgagef/gaPzr4Urm 7K5pcbRmgg/c/UjSnpNratzq+jHR6pnYUoauHVdvPOTp+sXa8LdAeQI9bylBooOEE7Po ezIGBCJtrThslswAXH1aqv43YSAOce+Y70DsI2NMpUnYb0uzOLjZ+Adg0SLZbiF+FMWT dtkpOJkRgPDtU3KZ1IAW2bw/VE54bYhvzRyy/zvGYWt5EBXlTn3jthYrbwIlFOm3Oiv9 B0xg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:date:from:to:cc:subject:message-id:references :mime-version:content-disposition:in-reply-to:user-agent; bh=cdpEmDXEkeuocFMl1SLtGFANxlae0K4WNkgjOV1WBVw=; b=dneJO4YuY2z1n37ymsuBzOEV+ODJaXu0mjbX/tJqwcFz6YO1b27v9fdpg/W7P8WVIc bGDm1k7PKRG5fZBpfQMFtfB/yie0GU3dypTmEBZfxGSHAIhbGBX5mvwQ7KRxlh3FD8dA LZECktZntJerbINZsOYLkWYmsb+Go2gjJYNUaqDpMFjS+s8KTnxi/oOOvM7NQwEvMVHH cCyru9gDhvKtVjYgn1kHfnc82GAnSXNnEA/6/5pePzD24c59plTdrI87NnSjTNd4hTFP NuTd+h3tQWUcHUSR4ioiEdY93g34xsi5hxs60yrnUsYVszc2N1QaEC7zLffk2cL6PXPW fsZA== X-Gm-Message-State: AD7BkJK1YtE+UouLkivdYyUKiREzJp7iTRiSKHLlwlCsEuflsMKS2vjumZJqzMT5hoHVM03u X-Received: by 10.140.201.209 with SMTP id w200mr46975566qha.57.1457540534646; Wed, 09 Mar 2016 08:22:14 -0800 (PST) Received: from mutt-hardenedbsd (c-73-135-80-144.hsd1.md.comcast.net. [73.135.80.144]) by smtp.gmail.com with ESMTPSA id c66sm3926524qha.27.2016.03.09.08.22.13 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Wed, 09 Mar 2016 08:22:13 -0800 (PST) Date: Wed, 9 Mar 2016 11:22:10 -0500 From: Shawn Webb To: Big Lebowski Cc: Piotr Kubaj , freebsd-security Subject: Re: Will 11.0-RELEASE include ASLR? Message-ID: <20160309162210.GA42303@mutt-hardenedbsd> References: <56E02D95.9020303@anongoth.pl> MIME-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha256; protocol="application/pgp-signature"; boundary="UlVJffcvxoiEqYs2" Content-Disposition: inline In-Reply-To: X-Operating-System: FreeBSD mutt-hardenedbsd 11.0-CURRENT-HBSD FreeBSD 11.0-CURRENT-HBSD X-PGP-Key: http://pgp.mit.edu/pks/lookup?op=vindex&search=0x6A84658F52456EEE User-Agent: Mutt/1.5.24 (2015-08-30) X-BeenThere: freebsd-security@freebsd.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: "Security issues \[members-only posting\]" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 09 Mar 2016 16:22:16 -0000 --UlVJffcvxoiEqYs2 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable (Responding inline) On Wed, Mar 09, 2016 at 04:05:12PM +0000, Big Lebowski wrote: > Hi Piotr, >=20 > There are people who can probably answer it better, but until they do, I > can share what I've heard about it: on the FreeBSD side there are few > things that stop ASLR implementation: >=20 > - there's no actual agreement between the influencial developers on wether > ASLR is viable or needed in first place Some FreeBSD developers think ASLR would be a good addition and others don't. We at HardenedBSD believe that ASLR provides a great foundation for further exploit mitigation technologies. We don't hold the belief that ASLR is the "end-all-be-all" of security as some would like you to believe. > - there was no planning or discussion how to implement ALSR in FreeBSD, > Shawn simply started writing the code, and some developers would like to > discuss and plan things first Discussions took place over a period of over two years. I was very cooperative. If you take a look at the two reviews on FreeBSD's Phabricator instance (linked to below), you'll notice that there's a lot of back-and-forth discussion. > - there are doubts expressed in the code reviews about code quality and > compliance to FreeBSD standards. Some developers dedicated their time to > review the code and provide feedback, there were few cycles of rewrite, > review, rinse, repeat, but if you'd look into the reviews, Shawn closed > them, and I understand they'd only be considered for inclusion if they'd > meet the code quality standards expected Initial patches did not meet code quality standards. However, those style(9) violations were fixed early on. Even though the patches on Phabricator are closed, they can still be looked at for independent review. However, the code is now old and does not reflect the current implementation in HardenedBSD. We closed the reviews so that we could focus on making HardenedBSD great, not because of the lack of code quality. I'm not sure whether the patches would be considered for inclusion. That's up to FreeBSD to decide. Given that the last patch went months without any input from FreeBSD--input that was promised to be delivered. >=20 > As a side note, one person saying 'ASLR implementation is finished' and > proper ASLR implementation that's properly tested, functional and not in > fact opening other security issues are two vastly different things, that > should be approached very carefully. Does "being tested over the period of three or so years through many full package builds, production deployments, and dogfooding" not mean "properly tested?" What does "properly tested" mean to you? The developers at HardenedBSD make it a point to run HardenedBSD on all their hardware--even laptops. HardenedBSD has been available for over two years, so it can be tested by anyone who downloads it and runs tests themselves. If there's a test you'd like me to run, please let me know. Thanks, Shawn Original Phabricator review: https://reviews.freebsd.org/D473 (warning: huge load time since this review spans around two years). New Phabricator review for a smaller prereq patch: https://reviews.freebsd.org/D3565 Thanks, Shawn >=20 > Cheers, > BL >=20 > On Wed, Mar 9, 2016 at 2:05 PM, Piotr Kubaj wrote: >=20 > > -----BEGIN PGP SIGNED MESSAGE----- > > Hash: SHA256 > > > > Shawn Webb has recently announced that ASLR is complete on HardenedBSD. > > There are patches ready for FreeBSD to use and it's ready to be shipped > > in FreeBSD. However, for some reason FreeBSD developers do not want to > > ship ASLR in FreeBSD. Why can't it be included at least as non-default > > src.conf option and marked as experimental? > > > > FreeBSD is the only OS that matters that doesn't have ASLR. > > -----BEGIN PGP SIGNATURE----- > > Version: GnuPG v2 > > > > iQIcBAEBCAAGBQJW4C2QAAoJEHpZm4Ugg5yd2MoQAMPZ+UxbpTo9YvJz6YYB8wtH > > tRw3jQMUb4K6s26IO1mp/K6p+DM+HXcVvamO2cxjRKseQy/oLBGizgfR1ktBqdXQ > > xuqQJc5BCSdKgTsBs0IvNQghvUQkEyvYi+wn9EY9qJh6oEguAkcAWUhl5rGN2FhM > > Gwf9VDoPAR+n9Pjl6brcqyQvWczfDx9+VFpF0joeiI5PRRMF1UUsTYM/OHvtVoQA > > n1f8qNppIdprjwUjWE/BX6POaDhs4ZZKJRaFmbCuYudDPpX7P1yj7CHz/xthjMYG > > 325NnCJpN81fwCmcgvDFU3BYkEC9JSkBoA+5oDdRU3MALsJNQ10rz+IhAaeAsCMb > > oz7Oy0Gykeic60NLuMZlhOfl79XW666T1B9wOWlkrAlBPCY6v2kz6t/oJbHHGQOf > > CCBuhQJCdzdqyTnv0Bx4ZXiiecwhjvxaAPCwgppnxf2qLuBgxr9BsswMVp7wgYfM > > 2sfxk0pS0RuV5M2qWN9UATOyOiO5aPsC4f+WUzUM0LC6MbuHVDJu3QaUo7F3b3Ic > > KX150B3gWtsGlZZs8N9mIM3Aj/O5E496JHEf6zmlz6ssLuE6gIO8ICqpFSaXzkJC > > IWzgIVdL88gK6niVg7KCOAuzVZ1sxcx7cBCtGzAhVy9RhYKqwAtN9T2YOBC75cQW > > OdRGf2V3trcK664nKgEA > > =3DlM/6 > > -----END PGP SIGNATURE----- > > _______________________________________________ > > freebsd-security@freebsd.org mailing list > > https://lists.freebsd.org/mailman/listinfo/freebsd-security > > To unsubscribe, send any mail to "freebsd-security-unsubscribe@freebsd.= org > > " > > > _______________________________________________ > freebsd-security@freebsd.org mailing list > https://lists.freebsd.org/mailman/listinfo/freebsd-security > To unsubscribe, send any mail to "freebsd-security-unsubscribe@freebsd.or= g" --=20 Shawn Webb HardenedBSD GPG Key ID: 0x6A84658F52456EEE GPG Key Fingerprint: 2ABA B6BD EF6A F486 BE89 3D9E 6A84 658F 5245 6EEE --UlVJffcvxoiEqYs2 Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 iQIcBAEBCAAGBQJW4E2vAAoJEGqEZY9SRW7uC58P/REKa/2MuNFigeLu9/cbEYlA 8q0wWeNsPd34LxnJX82TT+Wutsd75PHDKXsI+IuwuRbaBY/CK73GKn0L17OM50+3 crXbbvfQUu6Fh2ui9z69wGTZG9lNQLir4JL9WLQ3Q4WwtFHBOuf/JL8/XPBL6DiZ 2WsX11p+JP1cC6uMpeuXij/0DdShcoh121hBJK+thzz09/2kf0dcqdbcPGB5D8GI H1b+pM3b0w1bKbkziTOLwBZ4D0xcDYIZ1n40YaS/WuZ8RwNHOUoOXE93ZwdcF6Z/ lWn7gL7jawwnEusKYvZc1oY5ZOVKib+ra7+HSJyN3XDSoo4fOoGDRwfx0vYeotpF mgS0dkWhvTmHrnL04ZspOF9JWvB5NyKFZAuhwolBH5ze/JRG4FV5dpoL807FVv6s nhKn6qBjvsH+Jd6eIAvodWkupdvVMuCWM52bOFISfpPG5Nk5Z4QrMSKdWwP7MHPl T/0HICXJKv3QgmXfMTplvPK5h2DFHrJKoCeNEoZM26JTJZVsmHZqkpzly2IoIc6K uTQiQZru2ekJzDlFJRPmiKq7k8oEjZYILZtQfvCzyTvBC5WAe2T6QwaWno/Llvyo IYALlySWIKPXxxG7/V6YJeytQ77EwYJFbzIOVc5DDxpuXnnNsmsW3UBaWcdDYGOJ v7CdCswIYWtY4vNEMjkD =X6e1 -----END PGP SIGNATURE----- --UlVJffcvxoiEqYs2-- From owner-freebsd-security@freebsd.org Wed Mar 9 16:39:38 2016 Return-Path: Delivered-To: freebsd-security@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id 73455AC80F3 for ; Wed, 9 Mar 2016 16:39:38 +0000 (UTC) (envelope-from spankthespam@gmail.com) Received: from mail-vk0-x234.google.com (mail-vk0-x234.google.com [IPv6:2607:f8b0:400c:c05::234]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (Client CN "smtp.gmail.com", Issuer "Google Internet Authority G2" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 2CA22C26 for ; Wed, 9 Mar 2016 16:39:38 +0000 (UTC) (envelope-from spankthespam@gmail.com) Received: by mail-vk0-x234.google.com with SMTP id e6so62396514vkh.2 for ; Wed, 09 Mar 2016 08:39:38 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc; bh=eBKHm+0NsWYe6lsSK3l+vbhTcbn72jCtLGMeTfO0cjs=; b=BWRbvrOSO5ruD9d9z5RQ6tznlAwcsVERUxonMP/IAFXQ1DX/qLRhIo62W+1zzhHdUB lj4xYEbXs5XiM3a0Ms/ggro9C4nIaVbcEQA4ayRXJrslR+ivxV8SfZ/5O6yceUzTMJqs y2wi4Hsbg++x/0xbGDbf6rlqdLLUms4Hg/JxzmmOd/PyIlj94lmsPbL8VpKlPoOFuQcg KEvgyMLPPRDpIl5Z0Pmzml6wOyOrodRZDNsFA2kM56YfDyDObze/GsAu/eGchh8xPKAy XEtA1zfv0nbYS3cdPeUYGuvIa904hGvLHlmEDrjthnldxJk6L+XFIGSqUEbHqhkt6Vtz 4/FQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:in-reply-to:references:date :message-id:subject:from:to:cc; bh=eBKHm+0NsWYe6lsSK3l+vbhTcbn72jCtLGMeTfO0cjs=; b=Xa/nUSwNJ2VZ8P7aqplVtx86z4/8Ch1rAbSrx+JCAnsrzPzveJJ0AEbKqd/ePDte0U cagv1zY/GyWL6kLsFttFKuaxwWdLsxGWjvYSqMu92zr1sNmVq0vX3voQx8SNUeLp/P7Y KkY3sQPkfyoO1hpG9DeaLmf0rhs+D55SRaxoO6Ki1y/ssHKztVNKEVYAo5LXdUZICaM0 7Sb3BihEZC1EnjTiJ/29kwnfBKBD4mvLMONn4Car6HUcjQN5jKxCFCm5EG9bMR8XhYe0 6mhmd7y8nXEII+YLeLhi7GQcELlC0TS2HhcBp20vsKVsGYfgMUCD6o8g4qqQ8AYIrgvJ DnzQ== X-Gm-Message-State: AD7BkJJRUKdgbvfoqFyLUklu3igYdCxE1+82z1c3cW+IOLTowyUmHCNsd85FBTtyOG4VgtVNehsFYIsFyLQxfw== MIME-Version: 1.0 X-Received: by 10.31.52.78 with SMTP id b75mr32820577vka.77.1457541577208; Wed, 09 Mar 2016 08:39:37 -0800 (PST) Received: by 10.31.133.16 with HTTP; Wed, 9 Mar 2016 08:39:37 -0800 (PST) In-Reply-To: <20160309162210.GA42303@mutt-hardenedbsd> References: <56E02D95.9020303@anongoth.pl> <20160309162210.GA42303@mutt-hardenedbsd> Date: Wed, 9 Mar 2016 16:39:37 +0000 Message-ID: Subject: Re: Will 11.0-RELEASE include ASLR? From: Big Lebowski To: Shawn Webb Cc: Piotr Kubaj , freebsd-security Content-Type: text/plain; charset=UTF-8 X-Content-Filtered-By: Mailman/MimeDel 2.1.21 X-BeenThere: freebsd-security@freebsd.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: "Security issues \[members-only posting\]" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 09 Mar 2016 16:39:38 -0000 Shawn, Please, note, that I said, these are the things I've heard, and there should be people able to answer those better. As such, you should consider them to be opinion, not pure facts. On Wed, Mar 9, 2016 at 4:22 PM, Shawn Webb wrote: > (Responding inline) > > On Wed, Mar 09, 2016 at 04:05:12PM +0000, Big Lebowski wrote: > > Hi Piotr, > > > > There are people who can probably answer it better, but until they do, I > > can share what I've heard about it: on the FreeBSD side there are few > > things that stop ASLR implementation: > > > > - there's no actual agreement between the influencial developers on > wether > > ASLR is viable or needed in first place > > Some FreeBSD developers think ASLR would be a good addition and others > don't. We at HardenedBSD believe that ASLR provides a great foundation > for further exploit mitigation technologies. We don't hold the belief > that ASLR is the "end-all-be-all" of security as some would like you to > believe. > That's pretty much what I wanted to say. > > > - there was no planning or discussion how to implement ALSR in FreeBSD, > > Shawn simply started writing the code, and some developers would like to > > discuss and plan things first > > Discussions took place over a period of over two years. I was very > cooperative. If you take a look at the two reviews on FreeBSD's > Phabricator instance (linked to below), you'll notice that there's a lot > of back-and-forth discussion. > Discussing patches and designing a feature such as ASLR is not exactly the same thing. In the spirit of this, some developers would expect some form of academical approach, a whitepaper, and so on, not the reviews discussion, and that's what lacking in their opinion. > > > - there are doubts expressed in the code reviews about code quality and > > compliance to FreeBSD standards. Some developers dedicated their time to > > review the code and provide feedback, there were few cycles of rewrite, > > review, rinse, repeat, but if you'd look into the reviews, Shawn closed > > them, and I understand they'd only be considered for inclusion if they'd > > meet the code quality standards expected > > Initial patches did not meet code quality standards. However, those > style(9) violations were fixed early on. > > Even though the patches on Phabricator are closed, they can still be > looked at for independent review. However, the code is now old and does > not reflect the current implementation in HardenedBSD. > > We closed the reviews so that we could focus on making HardenedBSD > great, not because of the lack of code quality. > > I'm not sure whether the patches would be considered for inclusion. > That's up to FreeBSD to decide. Given that the last patch went months > without any input from FreeBSD--input that was promised to be delivered. > I dont know C and I am not a security expert, however, the code quality was questioned by people who I respect for their achievement in security, operating systems and C knowledge, and I can simply rely what I've heard: that there are doubts, some people even mentioned actual bugs, so its not all about style(9). Yet again, not something I can verify myself, only something I've heard and can share. The lack of input is directly caused by my first two points: lack of agreement that FreeBSD needs it, and lack of academical style on how FreeBSD would like to implement it. > > > > > As a side note, one person saying 'ASLR implementation is finished' and > > proper ASLR implementation that's properly tested, functional and not in > > fact opening other security issues are two vastly different things, that > > should be approached very carefully. > > Does "being tested over the period of three or so years through many > full package builds, production deployments, and dogfooding" not mean > "properly tested?" What does "properly tested" mean to you? > > The developers at HardenedBSD make it a point to run HardenedBSD on all > their hardware--even laptops. > > HardenedBSD has been available for over two years, so it can be tested > by anyone who downloads it and runs tests themselves. If there's a test > you'd like me to run, please let me know. > Sorry, but I completely disagree here. I dont know the actual numbers, but I can safely assume that HardenedBSD user numbers are way smaller than FreeBSD, and thus, I would say that amount of dogfooding over so short period of time (since ASLR is considered to be completed by you) is nowhere close for my taste, to consider it production ready. Moreover, do you have any tests results available? Do you have a complete automated test suite exposed somwhere? Have you done static code analysis? Have you used fuzzers or any similar tools? Dont get me wrong, I highly appreciate your work in that area, however, I would like to see more complete, thorough and cautios approach to such complicated thing as computer security. Cheers, BL > > Thanks, > > Shawn > > Original Phabricator review: https://reviews.freebsd.org/D473 (warning: > huge load time since this review spans around two years). > > New Phabricator review for a smaller prereq patch: > https://reviews.freebsd.org/D3565 > > Thanks, > > Shawn > > > > > Cheers, > > BL > > > > On Wed, Mar 9, 2016 at 2:05 PM, Piotr Kubaj wrote: > > > > > -----BEGIN PGP SIGNED MESSAGE----- > > > Hash: SHA256 > > > > > > Shawn Webb has recently announced that ASLR is complete on HardenedBSD. > > > There are patches ready for FreeBSD to use and it's ready to be shipped > > > in FreeBSD. However, for some reason FreeBSD developers do not want to > > > ship ASLR in FreeBSD. Why can't it be included at least as non-default > > > src.conf option and marked as experimental? > > > > > > FreeBSD is the only OS that matters that doesn't have ASLR. > > > -----BEGIN PGP SIGNATURE----- > > > Version: GnuPG v2 > > > > > > iQIcBAEBCAAGBQJW4C2QAAoJEHpZm4Ugg5yd2MoQAMPZ+UxbpTo9YvJz6YYB8wtH > > > tRw3jQMUb4K6s26IO1mp/K6p+DM+HXcVvamO2cxjRKseQy/oLBGizgfR1ktBqdXQ > > > xuqQJc5BCSdKgTsBs0IvNQghvUQkEyvYi+wn9EY9qJh6oEguAkcAWUhl5rGN2FhM > > > Gwf9VDoPAR+n9Pjl6brcqyQvWczfDx9+VFpF0joeiI5PRRMF1UUsTYM/OHvtVoQA > > > n1f8qNppIdprjwUjWE/BX6POaDhs4ZZKJRaFmbCuYudDPpX7P1yj7CHz/xthjMYG > > > 325NnCJpN81fwCmcgvDFU3BYkEC9JSkBoA+5oDdRU3MALsJNQ10rz+IhAaeAsCMb > > > oz7Oy0Gykeic60NLuMZlhOfl79XW666T1B9wOWlkrAlBPCY6v2kz6t/oJbHHGQOf > > > CCBuhQJCdzdqyTnv0Bx4ZXiiecwhjvxaAPCwgppnxf2qLuBgxr9BsswMVp7wgYfM > > > 2sfxk0pS0RuV5M2qWN9UATOyOiO5aPsC4f+WUzUM0LC6MbuHVDJu3QaUo7F3b3Ic > > > KX150B3gWtsGlZZs8N9mIM3Aj/O5E496JHEf6zmlz6ssLuE6gIO8ICqpFSaXzkJC > > > IWzgIVdL88gK6niVg7KCOAuzVZ1sxcx7cBCtGzAhVy9RhYKqwAtN9T2YOBC75cQW > > > OdRGf2V3trcK664nKgEA > > > =lM/6 > > > -----END PGP SIGNATURE----- > > > _______________________________________________ > > > freebsd-security@freebsd.org mailing list > > > https://lists.freebsd.org/mailman/listinfo/freebsd-security > > > To unsubscribe, send any mail to " > freebsd-security-unsubscribe@freebsd.org > > > " > > > > > _______________________________________________ > > freebsd-security@freebsd.org mailing list > > https://lists.freebsd.org/mailman/listinfo/freebsd-security > > To unsubscribe, send any mail to " > freebsd-security-unsubscribe@freebsd.org" > > -- > Shawn Webb > HardenedBSD > > GPG Key ID: 0x6A84658F52456EEE > GPG Key Fingerprint: 2ABA B6BD EF6A F486 BE89 3D9E 6A84 658F 5245 6EEE > From owner-freebsd-security@freebsd.org Wed Mar 9 16:52:56 2016 Return-Path: Delivered-To: freebsd-security@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id 9FB85AC882C for ; Wed, 9 Mar 2016 16:52:56 +0000 (UTC) (envelope-from shawn.webb@hardenedbsd.org) Received: from mail-qk0-x22c.google.com (mail-qk0-x22c.google.com [IPv6:2607:f8b0:400d:c09::22c]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (Client CN "smtp.gmail.com", Issuer "Google Internet Authority G2" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 6A766938 for ; Wed, 9 Mar 2016 16:52:56 +0000 (UTC) (envelope-from shawn.webb@hardenedbsd.org) Received: by mail-qk0-x22c.google.com with SMTP id o6so22714411qkc.2 for ; Wed, 09 Mar 2016 08:52:56 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=hardenedbsd-org.20150623.gappssmtp.com; s=20150623; h=date:from:to:cc:subject:message-id:references:mime-version :content-disposition:in-reply-to:user-agent; bh=N8Nd6DJ5fv8dW34EBx7hz5iEvHQZwD5Sb2DC0CgpdNc=; b=CFHzBvlKfr1IpnlY52z8GQexBAzt46S/kTd3LkDZu/F5sl4JPXt74D0/suiryNl4EI jDwSbC6gHcmc8cBO3azyXYu/wJ74h8nMmGLol5cftOJBzahAEPLPKv55N/SEUyqxveSR 3gwxvhpB2EiSMqvVb8ceaoJSCn++fImcgmYb2DdQpTy2rdO+DqvqF2kbH64D5elCFQt3 VbtNQBXc7Eak2n4gYQnscePSlZHTm/UvoFgB3vQG9DifzLGdDHxbOAAwpdQk26aiT5nf ChIM5z3NJZT8veU+8N6IfYGi33vLfqu4HgpBR0jy+nUoSQGHz8oNGNsmqQFpgxG3umOn 7euQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:date:from:to:cc:subject:message-id:references :mime-version:content-disposition:in-reply-to:user-agent; bh=N8Nd6DJ5fv8dW34EBx7hz5iEvHQZwD5Sb2DC0CgpdNc=; b=b3LAG6ExNGCFtLVpBNysN+EQrOvxiGa1ANvnKcET8uiax3rKwmTpEi59m2c0TixpXS nMuyegL5JLQl5XmaT8xo3FQEdD7MuMR8NY6LWIz91GkETvP0r03I8NnWlMOsGilidubI edtS0H+fJ5Zu1pOVxOaRbotKreuLBMI5XngFocEyUQV40hJIZ/Md6GXigJl3LFVlqt8P TbNAhSrpaUVoQv1VYqMF1gb+cKUYtxKEcsaFTHujGPjzgLxe3P2+cicrH2LPk5+CyrWh 7CJXJixkQ6KXCWJLo8+oHhupWtv7rls3iOcUqVlIGBMiIDGH6PVTd612orMoBVG7I6yF 0E3Q== X-Gm-Message-State: AD7BkJJc6wqgn1KoR4TbhdljlNq2Y436wdxLYC1n6YkKOhlJ2/eSTgnFQ+xvsMJWPa4bRPGb X-Received: by 10.55.195.142 with SMTP id r14mr43217652qkl.59.1457542375307; Wed, 09 Mar 2016 08:52:55 -0800 (PST) Received: from mutt-hardenedbsd (c-73-135-80-144.hsd1.md.comcast.net. [73.135.80.144]) by smtp.gmail.com with ESMTPSA id o97sm4003224qge.23.2016.03.09.08.52.54 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Wed, 09 Mar 2016 08:52:54 -0800 (PST) Date: Wed, 9 Mar 2016 11:52:52 -0500 From: Shawn Webb To: Big Lebowski Cc: Piotr Kubaj , freebsd-security Subject: Re: Will 11.0-RELEASE include ASLR? Message-ID: <20160309165252.GB42303@mutt-hardenedbsd> References: <56E02D95.9020303@anongoth.pl> <20160309162210.GA42303@mutt-hardenedbsd> MIME-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha256; protocol="application/pgp-signature"; boundary="KFztAG8eRSV9hGtP" Content-Disposition: inline In-Reply-To: X-Operating-System: FreeBSD mutt-hardenedbsd 11.0-CURRENT-HBSD FreeBSD 11.0-CURRENT-HBSD X-PGP-Key: http://pgp.mit.edu/pks/lookup?op=vindex&search=0x6A84658F52456EEE User-Agent: Mutt/1.5.24 (2015-08-30) X-BeenThere: freebsd-security@freebsd.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: "Security issues \[members-only posting\]" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 09 Mar 2016 16:52:56 -0000 --KFztAG8eRSV9hGtP Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Wed, Mar 09, 2016 at 04:39:37PM +0000, Big Lebowski wrote: > Shawn, >=20 > Please, note, that I said, these are the things I've heard, and there > should be people able to answer those better. As such, you should consider > them to be opinion, not pure facts. >=20 > On Wed, Mar 9, 2016 at 4:22 PM, Shawn Webb > wrote: >=20 > > (Responding inline) > > > > On Wed, Mar 09, 2016 at 04:05:12PM +0000, Big Lebowski wrote: > > > Hi Piotr, > > > > > > There are people who can probably answer it better, but until they do= , I > > > can share what I've heard about it: on the FreeBSD side there are few > > > things that stop ASLR implementation: > > > > > > - there's no actual agreement between the influencial developers on > > wether > > > ASLR is viable or needed in first place > > > > Some FreeBSD developers think ASLR would be a good addition and others > > don't. We at HardenedBSD believe that ASLR provides a great foundation > > for further exploit mitigation technologies. We don't hold the belief > > that ASLR is the "end-all-be-all" of security as some would like you to > > believe. > > >=20 > That's pretty much what I wanted to say. >=20 >=20 > > > > > - there was no planning or discussion how to implement ALSR in FreeBS= D, > > > Shawn simply started writing the code, and some developers would like= to > > > discuss and plan things first > > > > Discussions took place over a period of over two years. I was very > > cooperative. If you take a look at the two reviews on FreeBSD's > > Phabricator instance (linked to below), you'll notice that there's a lot > > of back-and-forth discussion. > > >=20 > Discussing patches and designing a feature such as ASLR is not exactly the > same thing. In the spirit of this, some developers would expect some form > of academical approach, a whitepaper, and so on, not the reviews > discussion, and that's what lacking in their opinion. We provided a whitepaper and went through a few revisions of that, even. >=20 >=20 > > > > > - there are doubts expressed in the code reviews about code quality a= nd > > > compliance to FreeBSD standards. Some developers dedicated their time= to > > > review the code and provide feedback, there were few cycles of rewrit= e, > > > review, rinse, repeat, but if you'd look into the reviews, Shawn clos= ed > > > them, and I understand they'd only be considered for inclusion if the= y'd > > > meet the code quality standards expected > > > > Initial patches did not meet code quality standards. However, those > > style(9) violations were fixed early on. > > > > Even though the patches on Phabricator are closed, they can still be > > looked at for independent review. However, the code is now old and does > > not reflect the current implementation in HardenedBSD. > > > > We closed the reviews so that we could focus on making HardenedBSD > > great, not because of the lack of code quality. > > > > I'm not sure whether the patches would be considered for inclusion. > > That's up to FreeBSD to decide. Given that the last patch went months > > without any input from FreeBSD--input that was promised to be delivered. > > >=20 > I dont know C and I am not a security expert, however, the code quality w= as > questioned by people who I respect for their achievement in security, > operating systems and C knowledge, and I can simply rely what I've heard: > that there are doubts, some people even mentioned actual bugs, so its not > all about style(9). Yet again, not something I can verify myself, only > something I've heard and can share. >=20 > The lack of input is directly caused by my first two points: lack of > agreement that FreeBSD needs it, and lack of academical style on how > FreeBSD would like to implement it. Agreed. >=20 >=20 > > > > > > > > As a side note, one person saying 'ASLR implementation is finished' a= nd > > > proper ASLR implementation that's properly tested, functional and not= in > > > fact opening other security issues are two vastly different things, t= hat > > > should be approached very carefully. > > > > Does "being tested over the period of three or so years through many > > full package builds, production deployments, and dogfooding" not mean > > "properly tested?" What does "properly tested" mean to you? > > > > The developers at HardenedBSD make it a point to run HardenedBSD on all > > their hardware--even laptops. > > > > HardenedBSD has been available for over two years, so it can be tested > > by anyone who downloads it and runs tests themselves. If there's a test > > you'd like me to run, please let me know. > > >=20 > Sorry, but I completely disagree here. I dont know the actual numbers, but > I can safely assume that HardenedBSD user numbers are way smaller than > FreeBSD, and thus, I would say that amount of dogfooding over so short > period of time (since ASLR is considered to be completed by you) is nowhe= re > close for my taste, to consider it production ready. Moreover, do you have > any tests results available? Do you have a complete automated test suite > exposed somwhere? Have you done static code analysis? Have you used fuzze= rs > or any similar tools? When it comes to number of users, sure. We don't have nearly the visibility FreeBSD enjoys. But that's not a problem I can easily solve. Since we don't have any tools that call home, we don't even know how many users we have. Does a kernel fuzzer even exist for FreeBSD? If so, I'd love to run it for a whole bunch of things. I'll run it for ASLR, too. >=20 > Dont get me wrong, I highly appreciate your work in that area, however, I > would like to see more complete, thorough and cautios approach to such > complicated thing as computer security. What can we at HardenedBSD do to make it "more complete, thorough, and cautious"? Thanks, Shawn >=20 > Cheers, > BL >=20 >=20 > > > > Thanks, > > > > Shawn > > > > Original Phabricator review: https://reviews.freebsd.org/D473 (warning: > > huge load time since this review spans around two years). > > > > New Phabricator review for a smaller prereq patch: > > https://reviews.freebsd.org/D3565 > > > > Thanks, > > > > Shawn > > > > > > > > Cheers, > > > BL > > > > > > On Wed, Mar 9, 2016 at 2:05 PM, Piotr Kubaj wrot= e: > > > > > > > -----BEGIN PGP SIGNED MESSAGE----- > > > > Hash: SHA256 > > > > > > > > Shawn Webb has recently announced that ASLR is complete on Hardened= BSD. > > > > There are patches ready for FreeBSD to use and it's ready to be shi= pped > > > > in FreeBSD. However, for some reason FreeBSD developers do not want= to > > > > ship ASLR in FreeBSD. Why can't it be included at least as non-defa= ult > > > > src.conf option and marked as experimental? > > > > > > > > FreeBSD is the only OS that matters that doesn't have ASLR. > > > > -----BEGIN PGP SIGNATURE----- > > > > Version: GnuPG v2 > > > > > > > > iQIcBAEBCAAGBQJW4C2QAAoJEHpZm4Ugg5yd2MoQAMPZ+UxbpTo9YvJz6YYB8wtH > > > > tRw3jQMUb4K6s26IO1mp/K6p+DM+HXcVvamO2cxjRKseQy/oLBGizgfR1ktBqdXQ > > > > xuqQJc5BCSdKgTsBs0IvNQghvUQkEyvYi+wn9EY9qJh6oEguAkcAWUhl5rGN2FhM > > > > Gwf9VDoPAR+n9Pjl6brcqyQvWczfDx9+VFpF0joeiI5PRRMF1UUsTYM/OHvtVoQA > > > > n1f8qNppIdprjwUjWE/BX6POaDhs4ZZKJRaFmbCuYudDPpX7P1yj7CHz/xthjMYG > > > > 325NnCJpN81fwCmcgvDFU3BYkEC9JSkBoA+5oDdRU3MALsJNQ10rz+IhAaeAsCMb > > > > oz7Oy0Gykeic60NLuMZlhOfl79XW666T1B9wOWlkrAlBPCY6v2kz6t/oJbHHGQOf > > > > CCBuhQJCdzdqyTnv0Bx4ZXiiecwhjvxaAPCwgppnxf2qLuBgxr9BsswMVp7wgYfM > > > > 2sfxk0pS0RuV5M2qWN9UATOyOiO5aPsC4f+WUzUM0LC6MbuHVDJu3QaUo7F3b3Ic > > > > KX150B3gWtsGlZZs8N9mIM3Aj/O5E496JHEf6zmlz6ssLuE6gIO8ICqpFSaXzkJC > > > > IWzgIVdL88gK6niVg7KCOAuzVZ1sxcx7cBCtGzAhVy9RhYKqwAtN9T2YOBC75cQW > > > > OdRGf2V3trcK664nKgEA > > > > =3DlM/6 > > > > -----END PGP SIGNATURE----- > > > > _______________________________________________ > > > > freebsd-security@freebsd.org mailing list > > > > https://lists.freebsd.org/mailman/listinfo/freebsd-security > > > > To unsubscribe, send any mail to " > > freebsd-security-unsubscribe@freebsd.org > > > > " > > > > > > > _______________________________________________ > > > freebsd-security@freebsd.org mailing list > > > https://lists.freebsd.org/mailman/listinfo/freebsd-security > > > To unsubscribe, send any mail to " > > freebsd-security-unsubscribe@freebsd.org" > > > > -- > > Shawn Webb > > HardenedBSD > > > > GPG Key ID: 0x6A84658F52456EEE > > GPG Key Fingerprint: 2ABA B6BD EF6A F486 BE89 3D9E 6A84 658F 5245 6EEE > > --=20 Shawn Webb HardenedBSD GPG Key ID: 0x6A84658F52456EEE GPG Key Fingerprint: 2ABA B6BD EF6A F486 BE89 3D9E 6A84 658F 5245 6EEE --KFztAG8eRSV9hGtP Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 iQIcBAEBCAAGBQJW4FTiAAoJEGqEZY9SRW7u8C0P/A3FowG3nIuRpPc4cD0i3N5Y nW8avhW45UkY415QSY7Cw4e7ejv3t9ZmLXyOkUt3xc7H09T9hp+QurvxC1spUiCD Mt9XZk8XW03MObLq5sp+OiZsCG5PWcmAu+PWhmYVwkHh5REz/xAaCFICERynH+UI RhJeUMIgkuvu6jC+c4OvaKgOHV4Zy9q4eGqvta9FcODvQf69KEmmo9vhQo+B+UfF deT+GbfyR83it1ysIec8Yj+6kUO043OwQc65QIsS6o102ynBJkiwo1FMtfNfT3B0 NzPSnwvZKEVYIZrZ61Bu5TZtRV99flMXh5v7RMuByl3AdcewB5JsvWV9JaKlPg3p i1bz8VPCQ57yYMVdYZq+efJWlmSyR/fKBLYTCk1Qroy7p/e+mYo7tx7cS79I0LOU C61gexRp9GDo4ZY90pEkD8hTt2NBImonBDI1P+O+EIXGOfyGNUOGoH6boVMAmDwf GSjhV+zng2+TmO/ptOEl4atXhqGHevlCL2H6GkDvUepV/ErvTfmlRBCrqeiMMDM7 RDo6YTaQB3uZwzdHr9EiFUfUzQ0p8SEt8fdmjAOKnnVgZTXXeiX9UOM9Fn61gQ6e 8JJY/6CrhF1auvTyfxDrmhIk8yOZbDjKHsnhRhoObZH5Ll249tkVnuBVDoQopoBS apNXsXcdEf8mY1lvTaQx =k0Iv -----END PGP SIGNATURE----- --KFztAG8eRSV9hGtP-- From owner-freebsd-security@freebsd.org Wed Mar 9 18:43:17 2016 Return-Path: Delivered-To: freebsd-security@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id 8A816AC8CC6 for ; Wed, 9 Mar 2016 18:43:17 +0000 (UTC) (envelope-from brett@lariat.net) Received: from mail.lariat.net (mail.lariat.net [66.62.230.51]) by mx1.freebsd.org (Postfix) with ESMTP id 1885829 for ; Wed, 9 Mar 2016 18:43:16 +0000 (UTC) (envelope-from brett@lariat.net) Received: from Toshi.lariat.net (IDENT:ppp1000.lariat.net@localhost [127.0.0.1]) by mail.lariat.net (8.9.3/8.9.3) with ESMTP id KAA24139; Wed, 9 Mar 2016 10:22:03 -0700 (MST) Message-Id: <201603091722.KAA24139@mail.lariat.net> X-Mailer: QUALCOMM Windows Eudora Version 7.1.0.9 Date: Wed, 09 Mar 2016 10:21:42 -0700 To: Piotr Kubaj , freebsd-security@freebsd.org From: Brett Glass Subject: Re: Will 11.0-RELEASE include ASLR? In-Reply-To: <56E02D95.9020303@anongoth.pl> References: <56E02D95.9020303@anongoth.pl> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii"; format=flowed X-Mailman-Approved-At: Wed, 09 Mar 2016 22:16:31 +0000 X-BeenThere: freebsd-security@freebsd.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: "Security issues \[members-only posting\]" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 09 Mar 2016 18:43:17 -0000 ASLR is controversial. Some see it as "security by obscurity;" others see it as extremely useful and effective. Yes, I would like it as a kernel build option, so that I can choose to optimize for raw speed (e.g. on a server which is hardened in other ways) or for the extra warm fuzzies that ASLR provides. --Brett Glass At 07:05 AM 3/9/2016, Piotr Kubaj wrote: >-----BEGIN PGP SIGNED MESSAGE----- >Hash: SHA256 > >Shawn Webb has recently announced that ASLR is complete on HardenedBSD. >There are patches ready for FreeBSD to use and it's ready to be shipped >in FreeBSD. However, for some reason FreeBSD developers do not want to >ship ASLR in FreeBSD. Why can't it be included at least as non-default >src.conf option and marked as experimental? > >FreeBSD is the only OS that matters that doesn't have ASLR. From owner-freebsd-security@freebsd.org Wed Mar 9 22:23:16 2016 Return-Path: Delivered-To: freebsd-security@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id 90B5EACA963 for ; Wed, 9 Mar 2016 22:23:16 +0000 (UTC) (envelope-from shawn.webb@hardenedbsd.org) Received: from mail-qg0-x22b.google.com (mail-qg0-x22b.google.com [IPv6:2607:f8b0:400d:c04::22b]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (Client CN "smtp.gmail.com", Issuer "Google Internet Authority G2" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 498E0176C for ; Wed, 9 Mar 2016 22:23:16 +0000 (UTC) (envelope-from shawn.webb@hardenedbsd.org) Received: by mail-qg0-x22b.google.com with SMTP id w104so55092240qge.1 for ; Wed, 09 Mar 2016 14:23:16 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=hardenedbsd-org.20150623.gappssmtp.com; s=20150623; h=date:from:to:cc:subject:message-id:references:mime-version :content-disposition:in-reply-to:user-agent; bh=F3M9d5+zW5Efk9Pk/z9lctNYppUaKxFXPuwUpsR9Da0=; b=XDCay/v2Z6d3NvYOPyLb1Qjn2gwmNn/S4+GQ8KtuN/1plHyB2WE1NbPHBTix1LVw3j xdtY2nJThYpgIc9rvKtDQtevYZTqiVLfBLNaIi1gMXRwXukz23MvYyam/mDjLnAMF/VX 7Cj1WohrHGhC16A0W+ucQMJUftOZL0A/5/IHFFZl5ZnmrhJVWiXP0t8jS2U+6NRngq9L TkcsbnxX5tfze74V9MO84EmyozZwSdRc9DK7DD8ppkC1thuDcWzPWo6vNPxks/ymO8lK c5D6O6dshz83RkZM2p0Wq4+73yxHgBRYg/zWvz0AvyL8OVTCfsjX/kwVKNkNJR4Gzypv WrYQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:date:from:to:cc:subject:message-id:references :mime-version:content-disposition:in-reply-to:user-agent; bh=F3M9d5+zW5Efk9Pk/z9lctNYppUaKxFXPuwUpsR9Da0=; b=Y3AV2aoqgwHQmwN1GRJzveIWu1IyAV+vDklCsGGzGFm9QkuJ+euwvHaJVhi8WwF6MQ hsG5MAHw2h2agoxy9JCX9EPGjB0dSIAgTfbJ4jTV0A5TNdyTka8CztX1yXBY6xQw1w+T KVSg4hcZjxA7hfQaLHIYkiFt8zplIDmVy2Sti58kpjqq4ICRfZVKmOA4BWVb8+9PhJw+ wuHUCODj5frarTU77NjOgLlO++M9sie9FPhJuweJj/9cvOp0VVMiUj8LuuoUQgb5oYiW TT/gbe4CweeMcO1oEi0JA8LbBgw+b0TK3Fus0qZvf304pD1mMe+FlWHwlzsy4cBAz0gj /nTw== X-Gm-Message-State: AD7BkJIiMnsrgmU8P1tIyMhMqtwf35MR4NLQgfHtxPStzQZe+XvhtF9jXrz2bJ383F5qGKK7 X-Received: by 10.140.106.68 with SMTP id d62mr169202qgf.84.1457562195470; Wed, 09 Mar 2016 14:23:15 -0800 (PST) Received: from mutt-hardenedbsd (c-73-135-80-144.hsd1.md.comcast.net. [73.135.80.144]) by smtp.gmail.com with ESMTPSA id c2sm344217qkb.41.2016.03.09.14.23.14 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Wed, 09 Mar 2016 14:23:14 -0800 (PST) Date: Wed, 9 Mar 2016 17:23:12 -0500 From: Shawn Webb To: Brett Glass Cc: Piotr Kubaj , freebsd-security@freebsd.org Subject: Re: Will 11.0-RELEASE include ASLR? Message-ID: <20160309222312.GD42303@mutt-hardenedbsd> References: <56E02D95.9020303@anongoth.pl> <201603091722.KAA24139@mail.lariat.net> MIME-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha256; protocol="application/pgp-signature"; boundary="hoZxPH4CaxYzWscb" Content-Disposition: inline In-Reply-To: <201603091722.KAA24139@mail.lariat.net> X-Operating-System: FreeBSD mutt-hardenedbsd 11.0-CURRENT-HBSD FreeBSD 11.0-CURRENT-HBSD X-PGP-Key: http://pgp.mit.edu/pks/lookup?op=vindex&search=0x6A84658F52456EEE User-Agent: Mutt/1.5.24 (2015-08-30) X-BeenThere: freebsd-security@freebsd.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: "Security issues \[members-only posting\]" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 09 Mar 2016 22:23:16 -0000 --hoZxPH4CaxYzWscb Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Wed, Mar 09, 2016 at 10:21:42AM -0700, Brett Glass wrote: > ASLR is controversial. Some see it as "security by obscurity;" others see > it as extremely useful and effective. >=20 > Yes, I would like it as a kernel build option, so that I can choose to > optimize for raw speed (e.g. on a server which is hardened in other ways) > or for the extra warm fuzzies that ASLR provides. The great thing is that our implementation comes as a kernel build option, just like you want. Our implementation also works on a per-jail basis. Thanks, --=20 Shawn Webb HardenedBSD GPG Key ID: 0x6A84658F52456EEE GPG Key Fingerprint: 2ABA B6BD EF6A F486 BE89 3D9E 6A84 658F 5245 6EEE --hoZxPH4CaxYzWscb Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 iQIcBAEBCAAGBQJW4KJOAAoJEGqEZY9SRW7u20sP/jYqalzbyiQtCqSl2SR7leq9 Cdu134/qX/fnddtWaUYani9XuaPZPs8Qfi+ZlWN/WZ2CZcXR3/PIpQPvg37rqUXG Cql9WwZjJqqn884RZb08KHBsduVZF81r4SJZCIFSZyvm7+EBz1FJlVS2Tsrz42by W5YsSi0KfzHhdsy88l6WAfwUB70kVQSWLwXse2HkQVG4MnmBhUDeLMaezHUdZWEJ PCYjWiuuOOO9uMalCz+2bwzbcQzVLuvT5W69Q90ENE+bJelC2WkAAJtknXhGdJoR tcCPbX1IyXEupLweM5w0FHKNzYs88Kh2xoRdcx12M0QXu+9TmAiOpFa1zb+PazEC kVLVQliY+uirQkf1H/4jwNAGB+bKeoGCdC/B4JUqVgfAw+1K9EZvrmMTPjYU3YFk /xaNL1j2638c4elt7rtm57XF4SGGzgEGWguXo/bWt+8FYp2pT+w6hOHY0SyN/dw+ m296z1UELZC/vG4MLiH88Bidbm97Ft1BUErt2fjo4wOc7iQyP0QxSWGUGvgt1/ad Q6I9pDDsm6TE5w8C1jSRgAd2xx2WebX1WOaZHkrAAsBhXKFzhxZux0yEVqDh183v KYm9f6qaDx09PFepU94lS3aM4vdNmheaD1wuyyzlq3orJb9vwNtg9kIDYSenqdSV BsRzBkEifXp1QNXct30a =jGpJ -----END PGP SIGNATURE----- --hoZxPH4CaxYzWscb-- From owner-freebsd-security@freebsd.org Wed Mar 9 22:59:08 2016 Return-Path: Delivered-To: freebsd-security@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id 686E5AC9B10 for ; Wed, 9 Mar 2016 22:59:08 +0000 (UTC) (envelope-from des@des.no) Received: from smtp.des.no (smtp.des.no [194.63.250.102]) by mx1.freebsd.org (Postfix) with ESMTP id 335B9F51 for ; Wed, 9 Mar 2016 22:59:08 +0000 (UTC) (envelope-from des@des.no) Received: from desk.des.no (smtp.des.no [194.63.250.102]) by smtp.des.no (Postfix) with ESMTP id C2CE9499C; Wed, 9 Mar 2016 22:59:00 +0000 (UTC) Received: by desk.des.no (Postfix, from userid 1001) id 284EF3A7DA; Wed, 9 Mar 2016 23:59:00 +0100 (CET) From: =?utf-8?Q?Dag-Erling_Sm=C3=B8rgrav?= To: Akihiro HIRANO Cc: "freebsd-security\@freebsd.org" Subject: Re: openssl bug causes sshd crashed on FreeBSD 9.3-RELEASE References: <56E017E2.9060305@t.kanazawa-u.ac.jp> Date: Wed, 09 Mar 2016 23:59:00 +0100 In-Reply-To: <56E017E2.9060305@t.kanazawa-u.ac.jp> (Akihiro HIRANO's message of "Wed, 9 Mar 2016 21:32:34 +0900") Message-ID: <86oaanfebv.fsf@desk.des.no> User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/24.5 (berkeley-unix) MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable X-BeenThere: freebsd-security@freebsd.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: "Security issues \[members-only posting\]" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 09 Mar 2016 22:59:08 -0000 Akihiro HIRANO writes: > Frank M=C3=B6ller writes: > > After updating to FreeBSD 9.3-RELEASE-p37 sshd from the base system > > crashes by signal 11 when I connect to the server with an old ssh > > client (e.g. OpenSSH_4.5p1). Using a newer ssh client versions > > (e.g. OpenSSH_6.6.1p1 from FreeBSD 9.3-RELEASE-p10) the sshd works > > fine. > Hum... I tried OpenSSH_6.6.1p1 client on 9.3-RELEASE-p37 > and OpenSSH_6.4p1 client on 10.0-RELEASE-p18. > Both clients cause sshd on 9.3-RELEASE-p37 crashed by signal 11. It depends on which ciphers you use. If my hunch is correct, the bug is somewhere in the codepath for RSA, so newer versions (which default to ECDSA) will be less likely to trigger it, but it will also depend on the server version and whether the server has an ECDSA host key. DES --=20 Dag-Erling Sm=C3=B8rgrav - des@des.no From owner-freebsd-security@freebsd.org Wed Mar 9 23:04:45 2016 Return-Path: Delivered-To: freebsd-security@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id ACA29AC9EC5 for ; Wed, 9 Mar 2016 23:04:45 +0000 (UTC) (envelope-from dim@FreeBSD.org) Received: from tensor.andric.com (tensor.andric.com [IPv6:2001:7b8:3a7:1:2d0:b7ff:fea0:8c26]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client CN "tensor.andric.com", Issuer "COMODO RSA Domain Validation Secure Server CA" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 7279A7C2 for ; Wed, 9 Mar 2016 23:04:45 +0000 (UTC) (envelope-from dim@FreeBSD.org) Received: from [IPv6:2001:7b8:3a7::dd44:f53f:bd83:81a6] (unknown [IPv6:2001:7b8:3a7:0:dd44:f53f:bd83:81a6]) (using TLSv1 with cipher ECDHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by tensor.andric.com (Postfix) with ESMTPSA id 4C6E93EA64; Thu, 10 Mar 2016 00:04:35 +0100 (CET) Subject: Re: openssl bug causes sshd crashed on FreeBSD 9.3-RELEASE Mime-Version: 1.0 (Mac OS X Mail 9.2 \(3112\)) Content-Type: multipart/signed; boundary="Apple-Mail=_80AFAB92-6829-47BA-A3F4-B50FBBF0E8B6"; protocol="application/pgp-signature"; micalg=pgp-sha1 X-Pgp-Agent: GPGMail 2.6b2 (ebbf3ef) From: Dimitry Andric In-Reply-To: <86oaanfebv.fsf@desk.des.no> Date: Thu, 10 Mar 2016 00:04:14 +0100 Cc: Akihiro HIRANO , "freebsd-security@freebsd.org" Message-Id: References: <56E017E2.9060305@t.kanazawa-u.ac.jp> <86oaanfebv.fsf@desk.des.no> To: =?utf-8?Q?Dag-Erling_Sm=C3=B8rgrav?= X-Mailer: Apple Mail (2.3112) X-Mailman-Approved-At: Thu, 10 Mar 2016 00:10:54 +0000 X-BeenThere: freebsd-security@freebsd.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: "Security issues \[members-only posting\]" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 09 Mar 2016 23:04:45 -0000 --Apple-Mail=_80AFAB92-6829-47BA-A3F4-B50FBBF0E8B6 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 On 09 Mar 2016, at 23:59, Dag-Erling Sm=C3=B8rgrav wrote: >=20 > Akihiro HIRANO writes: >> Frank M=C3=B6ller writes: >>> After updating to FreeBSD 9.3-RELEASE-p37 sshd from the base system >>> crashes by signal 11 when I connect to the server with an old ssh >>> client (e.g. OpenSSH_4.5p1). Using a newer ssh client versions >>> (e.g. OpenSSH_6.6.1p1 from FreeBSD 9.3-RELEASE-p10) the sshd works >>> fine. >> Hum... I tried OpenSSH_6.6.1p1 client on 9.3-RELEASE-p37 >> and OpenSSH_6.4p1 client on 10.0-RELEASE-p18. >> Both clients cause sshd on 9.3-RELEASE-p37 crashed by signal 11. >=20 > It depends on which ciphers you use. If my hunch is correct, the bug = is > somewhere in the codepath for RSA, so newer versions (which default to > ECDSA) will be less likely to trigger it, but it will also depend on = the > server version and whether the server has an ECDSA host key. Please see my comment on PR 207783 [1]. Proposed fix: Index: crypto/openssl/crypto/bn/bn_exp.c =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D --- crypto/openssl/crypto/bn/bn_exp.c (revision 296469) +++ crypto/openssl/crypto/bn/bn_exp.c (working copy) @@ -758,7 +758,7 @@ int BN_mod_exp_mont_consttime(BIGNUM *rr, const BI * Fetch the appropriate pre-computed value from the pre-buf */ if (!MOD_EXP_CTIME_COPY_FROM_PREBUF - (computeTemp, top, powerbuf, wvalue, numPowers)) + (computeTemp, top, powerbuf, wvalue, window)) goto err; /* Multiply the result into the intermediate result */ -Dimitry [1] https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=3D207783#c11 --Apple-Mail=_80AFAB92-6829-47BA-A3F4-B50FBBF0E8B6 Content-Transfer-Encoding: 7bit Content-Disposition: attachment; filename=signature.asc Content-Type: application/pgp-signature; name=signature.asc Content-Description: Message signed with OpenPGP using GPGMail -----BEGIN PGP SIGNATURE----- Version: GnuPG/MacGPG2 v2.0.29 iEYEARECAAYFAlbgrAIACgkQsF6jCi4glqP50gCfawtmgIA3bKdY3Gs/6KGriDc2 CfYAoLgvJXR8R7OjWm1YtcjyiLEcLDyw =xo0V -----END PGP SIGNATURE----- --Apple-Mail=_80AFAB92-6829-47BA-A3F4-B50FBBF0E8B6-- From owner-freebsd-security@freebsd.org Thu Mar 10 00:33:10 2016 Return-Path: Delivered-To: freebsd-security@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id CF583AC82B4 for ; Thu, 10 Mar 2016 00:33:10 +0000 (UTC) (envelope-from sergej.schmidt@uni-ulm.de) Received: from smtp.uni-ulm.de (smtp.uni-ulm.de [134.60.1.26]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client CN "mail.uni-ulm.de", Issuer "Global-Uni-Ulm-CA" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 667C41A8E for ; Thu, 10 Mar 2016 00:33:09 +0000 (UTC) (envelope-from sergej.schmidt@uni-ulm.de) X-Virus-Scanned: amavisd-new at uni-ulm.de Received: from [192.168.0.104] (HSI-KBW-046-005-253-013.hsi8.kabel-badenwuerttemberg.de [46.5.253.13]) (authenticated bits=0) by mail.uni-ulm.de (8.14.9/8.14.9) with ESMTP id u2A0PK9p011550 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES128-SHA bits=128 verify=NOT) for ; Thu, 10 Mar 2016 01:25:20 +0100 (CET) Subject: Re: Will 11.0-RELEASE include ASLR? To: freebsd-security@freebsd.org References: <56E02D95.9020303@anongoth.pl> <201603091722.KAA24139@mail.lariat.net> From: Sergej Schmidt Message-ID: <56E0BEEB.2070901@uni-ulm.de> Date: Thu, 10 Mar 2016 01:25:15 +0100 MIME-Version: 1.0 In-Reply-To: <201603091722.KAA24139@mail.lariat.net> Content-Type: multipart/signed; micalg=pgp-sha256; protocol="application/pgp-signature"; boundary="OX3nrbu9cmlENvLiXCE6WtRKo4dHF4Sj4" X-DCC-sonic.net-Metrics: poseidon 1117; Body=1 Fuz1=1 Fuz2=1 X-BeenThere: freebsd-security@freebsd.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: "Security issues \[members-only posting\]" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 10 Mar 2016 00:33:10 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --OX3nrbu9cmlENvLiXCE6WtRKo4dHF4Sj4 Content-Type: multipart/mixed; boundary="fC8AoqjKJt38Ccs5cPFDhW6J6sBRDLNTD" From: Sergej Schmidt To: freebsd-security@freebsd.org Message-ID: <56E0BEEB.2070901@uni-ulm.de> Subject: Re: Will 11.0-RELEASE include ASLR? References: <56E02D95.9020303@anongoth.pl> <201603091722.KAA24139@mail.lariat.net> In-Reply-To: <201603091722.KAA24139@mail.lariat.net> --fC8AoqjKJt38Ccs5cPFDhW6J6sBRDLNTD Content-Type: text/plain; charset=windows-1252 Content-Transfer-Encoding: quoted-printable > ASLR is controversial. Some see it as "security by obscurity;" others s= ee > it as extremely useful and effective. In which way ASLR has something to do with security by obscurity? Imho this is a standard security feature of a modern OS.=20 Regards, Sergej --fC8AoqjKJt38Ccs5cPFDhW6J6sBRDLNTD-- --OX3nrbu9cmlENvLiXCE6WtRKo4dHF4Sj4 Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 iQIcBAEBCAAGBQJW4L7rAAoJEHHUMn9UstdDdTUQAJTlsbroVc8djhYKJBMn1y7x bO5zz4PW+a3qGMWUevyz9kGNehhNmUKBn4I2GVrhciQUInMWalanJgSVH6MnpP6F tXl7fncV5BkV6BBsPjO6pjyvQSJN1Y/7XqRN+Hf4idzzep0LTBrUxFaNWKC2N/pn zUOv7blbKzbkzcDFvU7Vp6jSaXouUEztKUcPesX9poYEsxOwiWkdvnLIj+zGGEBd 781obhetIwDVjFG4o2Bfq/OWNXL5TCDUCtoVf/ip9tX5HVcTY22kqtKE8Z95fg6i 46Zi8aecSBLQfLDlK2vo8tMTMcoTbtykSNZdSqtFedJlyUqvZU1Gmt7ZG/bhtzrb T32QFpnf8S7YbS/KvqbN3zPXqlnCnXt+6OME2scjLK3R1p+swFDENJcUY4NMO34c 6atHLoXeU76D+0uDB4imtdr4PAXfi4Z6FNAPk38UdBIlaAJzs4xCSkejjKa1C+p2 KR+fVVIo1CFX5G/3d+zV7T1nxXva2rsXQ2KhPKYCJayk3r5Z124DDIY49OYCkNDq VUXVCmuDcDCdF2gRVniGfq2Jfr5Hai8cJlasp5DZMH0fXuECwK7lINeBph8rmDp7 1GxxO4bHxBUHZVi9gKkI5o/6yQhxjSGGESM+bbGAg9dW5fM3uoEwibhJjz/Bkn2w NImEEMBEok4kR/snACLL =Y8Cq -----END PGP SIGNATURE----- --OX3nrbu9cmlENvLiXCE6WtRKo4dHF4Sj4-- From owner-freebsd-security@freebsd.org Thu Mar 10 05:02:01 2016 Return-Path: Delivered-To: freebsd-security@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id 3DBAAACA71A for ; Thu, 10 Mar 2016 05:02:01 +0000 (UTC) (envelope-from hirano@t.kanazawa-u.ac.jp) Received: from mailwd01.kanazawa-u.ac.jp (mailwd01.kanazawa-u.ac.jp [133.28.3.23]) (using TLSv1.1 with cipher ECDHE-RSA-AES256-SHA (256/256 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id 04D6C34A for ; Thu, 10 Mar 2016 05:02:00 +0000 (UTC) (envelope-from hirano@t.kanazawa-u.ac.jp) Received: from mailvc03.kanazawa-u.ac.jp (mailvc03.kanazawa-u.ac.jp [133.28.3.93]) by mailwd01.kanazawa-u.ac.jp (Postfix) with ESMTP id BF8D13C0417 for ; Thu, 10 Mar 2016 14:01:56 +0900 (JST) Received: from mailvc03.kanazawa-u.ac.jp (localhost [127.0.0.1]) by localhost.kanazawa-u.ac.jp (Postfix) with ESMTP id AD5F84AC5E for ; Thu, 10 Mar 2016 14:01:56 +0900 (JST) Received: from smtp01.kanazawa-u.ac.jp (smtp01.kanazawa-u.ac.jp [133.28.3.64]) by mailvc03.kanazawa-u.ac.jp (Postfix) with ESMTP id A2C354AC5B for ; Thu, 10 Mar 2016 14:01:56 +0900 (JST) Received: from mail.se.kanazawa-u.ac.jp (mail.se.kanazawa-u.ac.jp [133.28.0.131]) by smtp01.kanazawa-u.ac.jp (Postfix) with ESMTP id 9D13F11605E for ; Thu, 10 Mar 2016 14:01:56 +0900 (JST) Received: from [192.168.1.197] (canes.ec.t.kanazawa-u.ac.jp [133.28.97.35]) (Authenticated sender: hirano@se.kanazawa-u.ac.jp) by mail.se.kanazawa-u.ac.jp (Postfix) with ESMTPSA id 8F9734E61B for ; Thu, 10 Mar 2016 14:01:55 +0900 (JST) Subject: Re: openssl bug causes sshd crashed on FreeBSD 9.3-RELEASE To: "freebsd-security@freebsd.org" References: <20160309140125.GH13515@pol-server.leissner.se> From: Akihiro HIRANO Message-ID: <56E0FFC7.6040909@t.kanazawa-u.ac.jp> Date: Thu, 10 Mar 2016 14:01:59 +0900 User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:38.0) Gecko/20100101 Thunderbird/38.6.0 MIME-Version: 1.0 In-Reply-To: <20160309140125.GH13515@pol-server.leissner.se> Content-Type: text/plain; charset=windows-1252; format=flowed Content-Transfer-Encoding: 7bit X-TM-AS-MML: No X-BeenThere: freebsd-security@freebsd.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: "Security issues \[members-only posting\]" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 10 Mar 2016 05:02:01 -0000 On 2016/03/09 23:01, Peter wrote: > A much worse problem, for me at least, is that 9.3-RELEASE-p37 > makes apache crash with signal 11. As far as I know, a web server on 9.3-RELEASE-p37 works fine if installed by the following step. (1) Install security/openssl from ports (2) Install apache from ports By this step, httpd will use OpenSSL library in /usr/local/lib from ports, rather than that in base system. ---- Akihiro HIRANO, Kanazawa University hirano@t.kanazawa-u.ac.jp From owner-freebsd-security@freebsd.org Thu Mar 10 05:24:00 2016 Return-Path: Delivered-To: freebsd-security@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id 46DECACAFB8 for ; Thu, 10 Mar 2016 05:24:00 +0000 (UTC) (envelope-from brett@lariat.org) Received: from mail.lariat.net (mail.lariat.net [66.62.230.51]) by mx1.freebsd.org (Postfix) with ESMTP id 00623273 for ; Thu, 10 Mar 2016 05:23:59 +0000 (UTC) (envelope-from brett@lariat.org) Received: from Toshi.lariat.org (IDENT:ppp1000.lariat.net@localhost [127.0.0.1]) by mail.lariat.net (8.9.3/8.9.3) with ESMTP id WAA00750; Wed, 9 Mar 2016 22:23:49 -0700 (MST) Message-Id: <201603100523.WAA00750@mail.lariat.net> X-Mailer: QUALCOMM Windows Eudora Version 7.1.0.9 Date: Wed, 09 Mar 2016 22:23:22 -0700 To: Sergej Schmidt , freebsd-security@freebsd.org From: Brett Glass Subject: Re: Will 11.0-RELEASE include ASLR? In-Reply-To: <56E0BEEB.2070901@uni-ulm.de> References: <56E02D95.9020303@anongoth.pl> <201603091722.KAA24139@mail.lariat.net> <56E0BEEB.2070901@uni-ulm.de> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii"; format=flowed X-BeenThere: freebsd-security@freebsd.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: "Security issues \[members-only posting\]" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 10 Mar 2016 05:24:00 -0000 At 05:25 PM 3/9/2016, Sergej Schmidt wrote: >In which way ASLR has something to do with security by obscurity? ASLR attempts to create security by obscuring the locations of objects within the machine's address space. Critics of ASLR say (with some justification!) that this is just hiding them... in plain sight. Without getting into a flame war about that, I would simply like the option of compiling it in or not. --Brett Glass From owner-freebsd-security@freebsd.org Thu Mar 10 10:20:31 2016 Return-Path: Delivered-To: freebsd-security@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id E9F55ACAF15 for ; Thu, 10 Mar 2016 10:20:31 +0000 (UTC) (envelope-from security-advisories@freebsd.org) Received: from freefall.freebsd.org (freefall.freebsd.org [IPv6:2001:1900:2254:206c::16:87]) by mx1.freebsd.org (Postfix) with ESMTP id E129AC30; Thu, 10 Mar 2016 10:20:31 +0000 (UTC) (envelope-from security-advisories@freebsd.org) Received: by freefall.freebsd.org (Postfix, from userid 1035) id E022416F9; Thu, 10 Mar 2016 10:20:31 +0000 (UTC) From: FreeBSD Security Advisories To: FreeBSD Security Advisories Subject: FreeBSD Security Advisory FreeBSD-SA-16:12.openssl Reply-To: freebsd-security@freebsd.org Precedence: bulk Message-Id: <20160310102031.E022416F9@freefall.freebsd.org> Date: Thu, 10 Mar 2016 10:20:31 +0000 (UTC) X-BeenThere: freebsd-security@freebsd.org X-Mailman-Version: 2.1.21 List-Id: "Security issues \[members-only posting\]" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 10 Mar 2016 10:20:32 -0000 -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= FreeBSD-SA-16:12.openssl Security Advisory The FreeBSD Project Topic: Multiple OpenSSL vulnerabilities Category: contrib Module: openssl Announced: 2016-03-10 Credits: OpenSSL Project Affects: All supported versions of FreeBSD. Corrected: 2016-03-04 00:40:15 UTC (stable/10, 10.2-BETA3) 2016-03-03 07:30:55 UTC (releng/10.2, 10.2-RELEASE-p13) 2016-03-03 07:30:55 UTC (releng/10.1, 10.1-RELEASE-p30) 2016-03-10 03:58:48 UTC (stable/9, 9.3-STABLE) 2016-03-10 10:03:28 UTC (releng/9.3, 9.3-RELEASE-p38) CVE Name: CVE-2016-0702, CVE-2016-0703, CVE-2016-0704, CVE-2016-0705 CVE-2016-0797, CVE-2016-0798, CVE-2016-0799, CVE-2016-0800 For general information regarding FreeBSD Security Advisories, including descriptions of the fields above, security branches, and the following sections, please visit . I. Background FreeBSD includes software from the OpenSSL Project. The OpenSSL Project is a collaborative effort to develop a robust, commercial-grade, full-featured Open Source toolkit implementing the Secure Sockets Layer (SSL v2/v3) and Transport Layer Security (TLS v1) protocols as well as a full-strength general purpose cryptography library. II. Problem Description A cross-protocol attack was discovered that could lead to decryption of TLS sessions by using a server supporting SSLv2 and EXPORT cipher suites as a Bleichenbacher RSA padding oracle. Note that traffic between clients and non-vulnerable servers can be decrypted provided another server supporting SSLv2 and EXPORT ciphers (even with a different protocol such as SMTP, IMAP or POP3) shares the RSA keys of the non-vulnerable server. This vulnerability is known as DROWN. [CVE-2016-0800] A double free bug was discovered when OpenSSL parses malformed DSA private keys and could lead to a DoS attack or memory corruption for applications that receive DSA private keys from untrusted sources. This scenario is considered rare. [CVE-2016-0705] The SRP user database lookup method SRP_VBASE_get_by_user had confusing memory management semantics; the returned pointer was sometimes newly allocated, and sometimes owned by the callee. The calling code has no way of distinguishing these two cases. [CVE-2016-0798] In the BN_hex2bn function, the number of hex digits is calculated using an int value |i|. Later |bn_expand| is called with a value of |i * 4|. For large values of |i| this can result in |bn_expand| not allocating any memory because |i * 4| is negative. This can leave the internal BIGNUM data field as NULL leading to a subsequent NULL pointer dereference. For very large values of |i|, the calculation |i * 4| could be a positive value smaller than |i|. In this case memory is allocated to the internal BIGNUM data field, but it is insufficiently sized leading to heap corruption. A similar issue exists in BN_dec2bn. This could have security consequences if BN_hex2bn/BN_dec2bn is ever called by user applications with very large untrusted hex/dec data. This is anticipated to be a rare occurrence. [CVE-2016-0797] The internal |fmtstr| function used in processing a "%s" formatted string in the BIO_*printf functions could overflow while calculating the length of a string and cause an out-of-bounds read when printing very long strings. [CVE-2016-0799] A side-channel attack was found which makes use of cache-bank conflicts on the Intel Sandy-Bridge microarchitecture which could lead to the recovery of RSA keys. [CVE-2016-0702] s2_srvr.c did not enforce that clear-key-length is 0 for non-export ciphers. If clear-key bytes are present for these ciphers, they displace encrypted-key bytes. [CVE-2016-0703] s2_srvr.c overwrites the wrong bytes in the master key when applying Bleichenbacher protection for export cipher suites. [CVE-2016-0704] III. Impact Servers that have SSLv2 protocol enabled are vulnerable to the "DROWN" attack which allows a remote attacker to fast attack many recorded TLS connections made to the server, even when the client did not make any SSLv2 connections themselves. An attacker who can supply malformed DSA private keys to OpenSSL applications may be able to cause memory corruption which would lead to a Denial of Service condition. [CVE-2016-0705] An attacker connecting with an invalid username can cause memory leak, which could eventually lead to a Denial of Service condition. [CVE-2016-0798] An attacker who can inject malformed data into an application may be able to cause memory corruption which would lead to a Denial of Service condition. [CVE-2016-0797, CVE-2016-0799] A local attacker who has control of code in a thread running on the same hyper-threaded core as the victim thread which is performing decryptions could recover RSA keys. [CVE-2016-0702] An eavesdropper who can intercept SSLv2 handshake can conduct an efficient divide-and-conquer key recovery attack and use the server as an oracle to determine the SSLv2 master-key, using only 16 connections to the server and negligible computation. [CVE-2016-0703] An attacker can use the Bleichenbacher oracle, which enables more efficient variant of the DROWN attack. [CVE-2016-0704] IV. Workaround No workaround is available. V. Solution Perform one of the following: 1) Upgrade your vulnerable system to a supported FreeBSD stable or release / security branch (releng) dated after the correction date. Restart all deamons using the library, or reboot the system. 2) To update your vulnerable system via a binary patch: Systems running a RELEASE version of FreeBSD on the i386 or amd64 platforms can be updated via the freebsd-update(8) utility: # freebsd-update fetch # freebsd-update install Restart all deamons using the library, or reboot the system. 3) To update your vulnerable system via a source code patch: The following patches have been verified to apply to the applicable FreeBSD release branches. a) Download the relevant patch from the location below, and verify the detached PGP signature using your PGP utility. [FreeBSD 9.3] # fetch https://security.FreeBSD.org/patches/SA-16:12/openssl-9.3.patch.xz # fetch https://security.FreeBSD.org/patches/SA-16:12/openssl-9.3.patch.xz.asc # gpg --verify openssl-9.3.patch.xz.asc Note that the initial patch version contains a serious regression that would lead to crash. The following patch must be applied to address it. # fetch https://security.FreeBSD.org/patches/SA-16:12/openssl-9.3-fix.patch # fetch https://security.FreeBSD.org/patches/SA-16:12/openssl-9.3-fix.patch.asc # gpg --verify openssl-9.3-fix.patch.asc [FreeBSD 10.1] # fetch https://security.FreeBSD.org/patches/SA-16:12/openssl-10.1.patch.xz # fetch https://security.FreeBSD.org/patches/SA-16:12/openssl-10.1.patch.xz.asc # gpg --verify openssl-10.1.patch.xz.asc [FreeBSD 10.2] # fetch https://security.FreeBSD.org/patches/SA-16:12/openssl-10.2.patch # fetch https://security.FreeBSD.org/patches/SA-16:12/openssl-10.2.patch.asc # gpg --verify openssl-10.2.patch.asc b) Apply the patch. Execute the following commands as root: # cd /usr/src # patch < /path/to/patch c) Recompile the operating system using buildworld and installworld as described in . Restart all deamons using the library, or reboot the system. VI. Correction details The following list contains the correction revision numbers for each affected branch. Branch/path Revision - ------------------------------------------------------------------------- stable/9/ r296598 releng/9.3/ r296611 stable/10/ r296371 releng/10.1/ r296341 releng/10.2/ r296341 - ------------------------------------------------------------------------- To see which files were modified by a particular revision, run the following command, replacing NNNNNN with the revision number, on a machine with Subversion installed: # svn diff -cNNNNNN --summarize svn://svn.freebsd.org/base Or visit the following URL, replacing NNNNNN with the revision number: VII. References The latest revision of this advisory is available at -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.1.11 (FreeBSD) iQIcBAEBCgAGBQJW4UchAAoJEO1n7NZdz2rnNC8P/2YSnc2DaOH37BZXKBKCt2iv rzTlQ6Cdr2n3r0k6Ayp1MonEfndWl9d86us6Z5ssfMrNsmJGWZv3Yj1Y8H12HE8+ ZhHCJ44ZYbyaDSe/vigG1S+xYILKP6uOxJYPWH5lXD9Yr20dHIJ8s3e9Jsai8aY2 aXMSVz67t84QJUoxAf5yEDsmY2drA5myppkRCRB1Xcb3qVebgwwQ4XkB+rJjjNjg rG0DFbTxLnStr/geEDC+WdeAzLH6D035gFRkHL6uIOfOX8UcYNnf4pVXUgymWJzI E/su+Cij/ckhV6UuOyNvKgN8uEs5XCny/10LKHqpPDhcYY6L8Dg47rI+2acOdFUi 5+79rx7+gUs71zC4D6hFCldUqOVpNYDRBYhX+MNqYkLn5XYEffbckv5zSkg53+aE Rf1G90VcC+yHRFu2hgCTOGXsayOAJhvCRTnuqLncKpznFSRD+1a3XUm2zS79gfpN f/uYIYmPbE1/uCU4StAlemdiH5vhYoWsP8tkBJsL8s6jMbV1REqukPJUPdDSaJmj rHLvige7yr1QTWYBQ1ghRXJml+3xDSst/RZzqn+QelsDoUwa1wJa6kc5Ki74eXmi XyuklOME8cbfUc8TPLqv4Lqbvr0nGK71jT0M7zG+eQTJsUls5EFBPhWL/6+SU29I Lb+5Q4Wn9Qlmxfj0Nm3U =f6Cw -----END PGP SIGNATURE----- From owner-freebsd-security@freebsd.org Thu Mar 10 10:20:32 2016 Return-Path: Delivered-To: freebsd-security@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id 1A6ABACAF1D for ; Thu, 10 Mar 2016 10:20:32 +0000 (UTC) (envelope-from security-advisories@freebsd.org) Received: from freefall.freebsd.org (freefall.freebsd.org [IPv6:2001:1900:2254:206c::16:87]) by mx1.freebsd.org (Postfix) with ESMTP id 125C0C35; Thu, 10 Mar 2016 10:20:32 +0000 (UTC) (envelope-from security-advisories@freebsd.org) Received: by freefall.freebsd.org (Postfix, from userid 1035) id 11C991705; Thu, 10 Mar 2016 10:20:32 +0000 (UTC) From: FreeBSD Security Advisories To: FreeBSD Security Advisories Subject: FreeBSD Security Advisory FreeBSD-SA-16:13.bind Reply-To: freebsd-security@freebsd.org Precedence: bulk Message-Id: <20160310102032.11C991705@freefall.freebsd.org> Date: Thu, 10 Mar 2016 10:20:32 +0000 (UTC) X-BeenThere: freebsd-security@freebsd.org X-Mailman-Version: 2.1.21 List-Id: "Security issues \[members-only posting\]" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 10 Mar 2016 10:20:32 -0000 -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= FreeBSD-SA-16:13.bind Security Advisory The FreeBSD Project Topic: Multiple BIND vulnerabilities Category: contrib Module: bind Announced: 2016-03-10 Credits: ISC Affects: FreeBSD 9.x Corrected: 2016-03-10 07:47:55 UTC (stable/9, 9.3-STABLE) 2016-03-10 10:03:28 UTC (releng/9.3, 9.3-RELEASE-p38) CVE Name: CVE-2016-1285, CVE-2016-1286 For general information regarding FreeBSD Security Advisories, including descriptions of the fields above, security branches, and the following sections, please visit . I. Background BIND 9 is an implementation of the Domain Name System (DNS) protocols. The named(8) daemon is an Internet Domain Name Server. II. Problem Description Testing by ISC has uncovered a defect in control channel input handling which can cause named to exit due to an assertion failure in sexpr.c or alist.c when a malformed packet is sent to named's control channel (the interface which allows named to be controlled using the "rndc" server control utility). [CVE-2016-1285] An error when parsing signature records for DNAME records having specific properties can lead to named exiting due to an assertion failure in resolver.c or db.c. [CVE-2016-1286] III. Impact A remote attacker can deliberately trigger the failed assertion if the DNS server accepts remote rndc commands regardless if authentication is configured. Note that this is not enabled by default. [CVE-2016-1285] A remote attacker who can cause a server to make a query deliberately chosen to generate a response containing a signature record which would trigger a failed assertion and cause named to stop. Disabling DNSsec does not provide protection against this vulnerability. [CVE-2016-1286] IV. Workaround No workaround is available, but hosts not running named(8) are not vulnerable. V. Solution Perform one of the following: 1) Upgrade your vulnerable system to a supported FreeBSD stable or release / security branch (releng) dated after the correction date. The named service has to be restarted after the update. A reboot is recommended but not required. 2) To update your vulnerable system via a binary patch: Systems running a RELEASE version of FreeBSD on the i386 or amd64 platforms can be updated via the freebsd-update(8) utility: # freebsd-update fetch # freebsd-update install The named service has to be restarted after the update. A reboot is recommended but not required. 3) To update your vulnerable system via a source code patch: The following patches have been verified to apply to the applicable FreeBSD release branches. a) Download the relevant patch from the location below, and verify the detached PGP signature using your PGP utility. # fetch https://security.FreeBSD.org/patches/SA-16:13/bind.patch # fetch https://security.FreeBSD.org/patches/SA-16:13/bind.patch.asc # gpg --verify bind.patch.asc b) Apply the patch. Execute the following commands as root: # cd /usr/src # patch < /path/to/patch c) Recompile the operating system using buildworld and installworld as described in . Restart the named(8) daemon, or reboot the system. VI. Correction details The following list contains the correction revision numbers for each affected branch. Branch/path Revision - ------------------------------------------------------------------------- stable/9/ r296608 releng/9.3/ r296611 - ------------------------------------------------------------------------- To see which files were modified by a particular revision, run the following command, replacing NNNNNN with the revision number, on a machine with Subversion installed: # svn diff -cNNNNNN --summarize svn://svn.freebsd.org/base Or visit the following URL, replacing NNNNNN with the revision number: VII. References The latest revision of this advisory is available at -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.1.11 (FreeBSD) iQIcBAEBCgAGBQJW4UdUAAoJEO1n7NZdz2rnmRwQAIXDSu/gX5A+CFv6+9/2ak+H 3JOMO8p7KSKWhc1Hh7uqTUEy04lmpUylzK6Kj3h5PDNVaObxCcqsCAdy9xLYv8Q6 scBLeaDRPnwVQ1Mb/pkx1pdKSG7oKjY00PY0/hTKOVJUC1tJIoiAX8ExFqt53UKc LHjzrFrHh/0lBebYj8jmqW8Pxhi8nluuwWhtrwFgiG/XR15k69TRjPHnLOfXVwqs ORJb/8pVHYsNkGP3JB1xWMVs1nKLjzc7+Gm43OmLCa6QeLgQWqYmguoUl0FEHpoI nPqlukYT3V9BfMR+fwoNXXUjgjiK66onvS/O3yhyCPCrRgnw0ZVVSF2jbPUhT638 p1QwN9snoTzxY0CpCjcjpZvf9Zhfyzc8UFnl2hm0rmAuCiOPBTeJ16AG3a8S40vF /xoq4P6gNxUTQrPpGmG3Z/tfUQsxIpzib9D6ncDD5feuRyLB9y/MQSK1wxZjXDjk 2Bmaqk5foXNJfNEViNfJ4yy2qqED114ZpPIcDbSyIX9HeiKBo9BTEZ7Q9nEUHurN GcnvimUuhk+hYJDEsELDSGDSLT6aMaD/hXVTMQeQwxQKh7QDFfzJsUlA44tqB56V sn6VfIiA++K/JAFrAExD2FhtaIlOsUx24dUYkhcfNuVVBm3lgGCECeKGFxdNu2SM kRc1+1ihyNRolL47E3s/ =OncW -----END PGP SIGNATURE----- From owner-freebsd-security@freebsd.org Thu Mar 10 12:30:37 2016 Return-Path: Delivered-To: freebsd-security@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id E4BA4ACA609 for ; Thu, 10 Mar 2016 12:30:37 +0000 (UTC) (envelope-from moeller@gonicus.de) Received: from mail-1.ar.gonicus.de (mail-1.gonicus.de [212.8.3.3]) by mx1.freebsd.org (Postfix) with ESMTP id A3E9415F9 for ; Thu, 10 Mar 2016 12:30:37 +0000 (UTC) (envelope-from moeller@gonicus.de) Received: from localhost (localhost [127.0.0.1]) by mail-1.ar.gonicus.de (Postfix) with ESMTP id C9E874CA266; Thu, 10 Mar 2016 13:30:29 +0100 (CET) Received: from mail-1.gonicus.de (localhost [127.0.0.1]) by mail-1.ar.gonicus.de (Postfix) with ESMTP id B9E764CA265; Thu, 10 Mar 2016 13:30:29 +0100 (CET) Received: from localhost (localhost [127.0.0.1]) by mail-1.gonicus.de (Postfix) with ESMTP id A966513C22; Thu, 10 Mar 2016 13:30:29 +0100 (CET) Received: from localhost (localhost [127.0.0.1]) by mail-1.gonicus.de (Postfix) with ESMTP id 92F6713C63; Thu, 10 Mar 2016 13:30:29 +0100 (CET) X-Virus-Scanned: by amavisd-new at gonicus.de Received: from mail-1.gonicus.de ([127.0.0.1]) by localhost (mail-1.gonicus.de [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id JItXVvv62fnp; Thu, 10 Mar 2016 13:30:29 +0100 (CET) X-Virus-Scanner: This message was checked by ESET Mail Security for Linux/BSD. For more information on ESET Mail Security, please, visit our website: http://www.eset.com/. Received: from zarafa.ms.gonicus.de (zarafa.ms.gonicus.de [10.9.1.55]) by mail-1.gonicus.de (Postfix) with ESMTP id 54FE613C22; Thu, 10 Mar 2016 13:30:29 +0100 (CET) Subject: AW: openssl bug causes sshd crashed on FreeBSD 9.3-RELEASE From: =?utf-8?Q?Frank_M=C3=B6ller?= To: =?utf-8?Q?freebsd-security=40freebsd=2Eorg?= Date: Thu, 10 Mar 2016 13:30:29 +0100 Mime-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable X-Priority: 3 (Normal) X-Mailer: Zarafa 7.1.14-51822 X-Original-To: Message-Id: X-ESET-AntiSpam: OK;0;calc;2016-03-10 13:30:29;1603101330290664;10CA X-BeenThere: freebsd-security@freebsd.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: "Security issues \[members-only posting\]" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 10 Mar 2016 12:30:38 -0000 Hello, it seems, that with the newly released p38 everything concerning sshd works fine again. Apache with mod_ssl does not crash either. Best regards Frank --=20 Frank M"oller GONICUS GmbH=20 -----Urspr=C3=BCngliche Nachricht----- > Von:Akihiro HIRANO > Gesendet: Don 10 M=C3=A4rz 2016 06:02 > An: freebsd-security@freebsd.org > Betreff: Re: openssl bug causes sshd crashed on FreeBSD 9.3-RELEASE >=20 > On 2016/03/09 23:01, Peter wrote: > > A much worse problem, for me at least, is that 9.3-RELEASE-p37 > > makes apache crash with signal 11. >=20 > As far as I know, a web server on 9.3-RELEASE-p37 works fine > if installed by the following step. >=20 > (1) Install security/openssl from ports > (2) Install apache from ports >=20 > By this step, httpd will use OpenSSL library in /usr/local/lib from ports, > rather than that in base system. > ---- > Akihiro HIRANO, Kanazawa University > hirano@t.kanazawa-u.ac.jp > _______________________________________________ > freebsd-security@freebsd.org mailing list > https://lists.freebsd.org/mailman/listinfo/freebsd-security > To unsubscribe, send any mail to "freebsd-security-unsubscribe@freebsd.org" From owner-freebsd-security@freebsd.org Thu Mar 10 13:38:10 2016 Return-Path: Delivered-To: freebsd-security@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id DC6C8ACA62F for ; Thu, 10 Mar 2016 13:38:10 +0000 (UTC) (envelope-from hirano@t.kanazawa-u.ac.jp) Received: from mailwd01.kanazawa-u.ac.jp (mailwd01.kanazawa-u.ac.jp [133.28.3.23]) (using TLSv1.1 with cipher ECDHE-RSA-AES256-SHA (256/256 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id A670BD7F for ; Thu, 10 Mar 2016 13:38:10 +0000 (UTC) (envelope-from hirano@t.kanazawa-u.ac.jp) Received: from mailvc01.kanazawa-u.ac.jp (mailvc01.kanazawa-u.ac.jp [133.28.3.91]) by mailwd01.kanazawa-u.ac.jp (Postfix) with ESMTP id B1F5C3C0483 for ; Thu, 10 Mar 2016 22:37:58 +0900 (JST) Received: from mailvc01.kanazawa-u.ac.jp (localhost [127.0.0.1]) by localhost.kanazawa-u.ac.jp (Postfix) with ESMTP id 9FD223B316 for ; Thu, 10 Mar 2016 22:37:58 +0900 (JST) Received: from smtp01.kanazawa-u.ac.jp (smtp01.kanazawa-u.ac.jp [133.28.3.64]) by mailvc01.kanazawa-u.ac.jp (Postfix) with ESMTP id 96A643B290 for ; Thu, 10 Mar 2016 22:37:58 +0900 (JST) Received: from mail.se.kanazawa-u.ac.jp (mail.se.kanazawa-u.ac.jp [133.28.0.131]) by smtp01.kanazawa-u.ac.jp (Postfix) with ESMTP id 932A911605A for ; Thu, 10 Mar 2016 22:37:58 +0900 (JST) Received: from [192.168.1.197] (scutum.ec.t.kanazawa-u.ac.jp [133.28.97.34]) (Authenticated sender: hirano@se.kanazawa-u.ac.jp) by mail.se.kanazawa-u.ac.jp (Postfix) with ESMTPSA id 85E4A4E61B for ; Thu, 10 Mar 2016 22:37:57 +0900 (JST) Subject: Re: AW: openssl bug causes sshd crashed on FreeBSD 9.3-RELEASE To: "freebsd-security@freebsd.org" References: From: Akihiro HIRANO Message-ID: <56E178B9.3030700@t.kanazawa-u.ac.jp> Date: Thu, 10 Mar 2016 22:38:01 +0900 User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:38.0) Gecko/20100101 Thunderbird/38.6.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 8bit X-TM-AS-MML: No X-BeenThere: freebsd-security@freebsd.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: "Security issues \[members-only posting\]" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 10 Mar 2016 13:38:11 -0000 Hi, On 2016/03/10 21:30, Frank Möller wrote: > it seems, that with the newly released p38 everything concerning sshd works fine again. > Apache with mod_ssl does not crash either. I have updated my servers to 9.3-RELEASE-p38, and sshd works fine on them. Best Regards, ---- Akihiro HIRANO, Kanazawa University hirano@t.kanazawa-u.ac.jp From owner-freebsd-security@freebsd.org Thu Mar 10 13:44:26 2016 Return-Path: Delivered-To: freebsd-security@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id 5ADCAACA974 for ; Thu, 10 Mar 2016 13:44:26 +0000 (UTC) (envelope-from kyle.dippery@uky.edu) Received: from ironportb.uky.edu (ironportb.uky.edu [128.163.184.76]) by mx1.freebsd.org (Postfix) with ESMTP id 25A6428D for ; Thu, 10 Mar 2016 13:44:25 +0000 (UTC) (envelope-from kyle.dippery@uky.edu) Received: from ex10hb03.ad.uky.edu ([128.163.187.78]) by ironportb.uky.edu with ESMTP; 10 Mar 2016 08:43:18 -0500 Received: from [10.163.140.48] (128.163.16.198) by exchange.uky.edu (128.163.187.78) with Microsoft SMTP Server (TLS) id 14.3.248.2; Thu, 10 Mar 2016 08:43:18 -0500 Subject: Re: AW: openssl bug causes sshd crashed on FreeBSD 9.3-RELEASE To: References: <56E178B9.3030700@t.kanazawa-u.ac.jp> From: Kyle Dippery Message-ID: <56E179F5.7080102@uky.edu> Date: Thu, 10 Mar 2016 08:43:17 -0500 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:38.0) Gecko/20100101 Thunderbird/38.6.0 MIME-Version: 1.0 In-Reply-To: <56E178B9.3030700@t.kanazawa-u.ac.jp> Content-Type: text/plain; charset="utf-8"; format=flowed Content-Transfer-Encoding: 8bit X-Originating-IP: [128.163.16.198] X-BeenThere: freebsd-security@freebsd.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: "Security issues \[members-only posting\]" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 10 Mar 2016 13:44:26 -0000 On 03/10/2016 08:38 AM, Akihiro HIRANO wrote: > Hi, > > On 2016/03/10 21:30, Frank Möller wrote: >> it seems, that with the newly released p38 everything concerning sshd >> works fine again. >> Apache with mod_ssl does not crash either. > > I have updated my servers to 9.3-RELEASE-p38, > and sshd works fine on them. Also, for what it's worth, exim, nagios, and nrpe all seem happy. Thank you much to all who fixed the problem. -- Kyle Dippery Engineering Computing Services 219 RMB 859-257-1346 From owner-freebsd-security@freebsd.org Thu Mar 10 13:54:49 2016 Return-Path: Delivered-To: freebsd-security@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id 208EEACAF71 for ; Thu, 10 Mar 2016 13:54:49 +0000 (UTC) (envelope-from shawn.webb@hardenedbsd.org) Received: from mail-qg0-x234.google.com (mail-qg0-x234.google.com [IPv6:2607:f8b0:400d:c04::234]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (Client CN "smtp.gmail.com", Issuer "Google Internet Authority G2" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id CCAAEA71 for ; Thu, 10 Mar 2016 13:54:48 +0000 (UTC) (envelope-from shawn.webb@hardenedbsd.org) Received: by mail-qg0-x234.google.com with SMTP id w104so70580070qge.1 for ; Thu, 10 Mar 2016 05:54:48 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=hardenedbsd-org.20150623.gappssmtp.com; s=20150623; h=date:from:to:cc:subject:message-id:references:mime-version :content-disposition:in-reply-to:user-agent; bh=q8NWW6n1xIC5n12YCancZuIap5qQaHcDd75ibsVxXng=; b=quUoRzcUgXQXYRs+kGcYg1ioYPxv6z36uTMBVf8UDG1z/Ojhnro+Wr3GT2MVa+fmds RH6lgr3NQwGpNfpgAt0G1V+A4AfooOI9wnOJ9XGRIZ4VofMrqoBVK8K0+hV/LpneBpks 7n2zlvu3v8FeEmAW4gtbr6BKlGM1r6O7taZxxNr0zDOHghjEUjSkThQ0gA8Nc2TTmHh5 yjAsKCw2CMQ7My1dXYPCrI3QwG2w8ZsCwuWuU7TAm8xmTwxOFniwu1GLYiF7FY1vwI2+ HckVzoz82puIP5UmaAB+vpG5eGKlm2Th8BJ/syFSopLNrCujFy2lcSVxijaI/jTzGkQi BNFg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:date:from:to:cc:subject:message-id:references :mime-version:content-disposition:in-reply-to:user-agent; bh=q8NWW6n1xIC5n12YCancZuIap5qQaHcDd75ibsVxXng=; b=UFES6qeklVBCeAQzL0ZuhXMYtJRXbrANIn2K9a6UL2MCG93sudBIGG6q4zEQjgMh6O FI/9/jFTL762U/4eFxEmhhK8pIYndElRD58/h9p3Mcd34ca2FBzstg0QPcbmB8OHuADH OxvFVSji/GKgVdyvFNVdAy92ocly00K14O6CkkRHmfneX6HLzXtP4QcvYEtnBVzn+r2d a4E42QEmeB0rm0mTv9J9YyX33Eu0oLOacaFYHL5XHaLNQuK6PU7iHiVohlAfXOmfLa5g H+D3lLpFeSS73fU+mXryply73K8Lf1UEMEoNLFXvlbsM7DvfH4KU5SN6/Bu9QfcFrSos JyVg== X-Gm-Message-State: AD7BkJJFuxiuVJQQ2c0JP7IAcTk58Kce0TD+8ES9/GxrTJqh2l26IyyxVl6IxgXJCnLcG+q1 X-Received: by 10.140.133.133 with SMTP id 127mr4451391qhf.42.1457618087990; Thu, 10 Mar 2016 05:54:47 -0800 (PST) Received: from mutt-hardenedbsd (c-73-135-80-144.hsd1.md.comcast.net. [73.135.80.144]) by smtp.gmail.com with ESMTPSA id o97sm1704268qge.23.2016.03.10.05.54.46 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Thu, 10 Mar 2016 05:54:46 -0800 (PST) Date: Thu, 10 Mar 2016 08:54:45 -0500 From: Shawn Webb To: Brett Glass Cc: Sergej Schmidt , freebsd-security@freebsd.org Subject: Re: Will 11.0-RELEASE include ASLR? Message-ID: <20160310135445.GF42303@mutt-hardenedbsd> References: <56E02D95.9020303@anongoth.pl> <201603091722.KAA24139@mail.lariat.net> <56E0BEEB.2070901@uni-ulm.de> <201603100523.WAA00750@mail.lariat.net> MIME-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha256; protocol="application/pgp-signature"; boundary="ULyIDA2m8JTe+TiX" Content-Disposition: inline In-Reply-To: <201603100523.WAA00750@mail.lariat.net> X-Operating-System: FreeBSD mutt-hardenedbsd 11.0-CURRENT-HBSD FreeBSD 11.0-CURRENT-HBSD X-PGP-Key: http://pgp.mit.edu/pks/lookup?op=vindex&search=0x6A84658F52456EEE User-Agent: Mutt/1.5.24 (2015-08-30) X-BeenThere: freebsd-security@freebsd.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: "Security issues \[members-only posting\]" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 10 Mar 2016 13:54:49 -0000 --ULyIDA2m8JTe+TiX Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Wed, Mar 09, 2016 at 10:23:22PM -0700, Brett Glass wrote: > At 05:25 PM 3/9/2016, Sergej Schmidt wrote: >=20 > >In which way ASLR has something to do with security by obscurity? >=20 > ASLR attempts to create security by obscuring the locations of=20 > objects within the machine's address space. Critics of ASLR say=20 > (with some justification!) that this is just hiding them... in=20 > plain sight. Without getting into a flame war about that, I would=20 > simply like the option of compiling it in or not. That option has always been available in HardenedBSD's implementation. It has been a kernel option that you can toggle at compile time with the PAX_ASLR kernel option. IT can also be toggled via /boot/loader.conf by setting hardening.pax.aslr.status=3D0. Thanks, --=20 Shawn Webb HardenedBSD GPG Key ID: 0x6A84658F52456EEE GPG Key Fingerprint: 2ABA B6BD EF6A F486 BE89 3D9E 6A84 658F 5245 6EEE --ULyIDA2m8JTe+TiX Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 iQIcBAEBCAAGBQJW4XyhAAoJEGqEZY9SRW7uAksP/jRzuQ1gZ0fZvjhTZOEfQwsS o0f+yuC7Zj/2eXn6Bychl8WsL+ZBqfUTZYJFQh+TbP4X3Oqs51np0G4h2R3dY6j5 L3P7SOui7I3eQRqGXnQNuvbVdN9++3EY5Km8qfzSU1FM+QQHCGJWO8LBGVLOAQiY Z3bXGreX0XYtAUFQOZPtJVDBnLz9K8LmEEFz5r89pkXqc1D6JxG5NRw4KDqQB+FS RgSWzDL52dT5MeUGYNFaAakatH7LJiTOXLMrVY3sWPkfwO+0HgJMApgg5yGJnckP ULXb7DkHL9aTv/Rv7WSe+6pybv+PLQPCY26c/gAxttCuH+TbHpjnuqsdHv6o3QzX 8E8PhhlioNr839Wl1UEw2fML41EuhiB0fC1ik135EAfIr7fhJMCFPixndM/c/aJx kb5xUMnYKDPitGzqXGOR1K/qw2ODARhSanbOkSwupM8t/13RhMVLVyiGxiF4TjW0 x8dSuzLYIw423qtCGWLYq16ZxP3e8scV5SRjfuE1gRuZzxmaelTkcWSkp9FQWGdN sr8/txrx0tE+OuZufwMGIp37jG3hNPkcCHRHFl0ANC0Si0nZ2dk0xw0U59/dQi34 D00/bAg5DHMFiott6SerEW0bg/tof9uUBOA88Q8tS5w4GL0fpe9SDAkU+MXvdbVd 1NMFWF0pEMYlLgo3g6Es =+RPW -----END PGP SIGNATURE----- --ULyIDA2m8JTe+TiX-- From owner-freebsd-security@freebsd.org Thu Mar 10 15:29:58 2016 Return-Path: Delivered-To: freebsd-security@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id 515B6ACBC56 for ; Thu, 10 Mar 2016 15:29:58 +0000 (UTC) (envelope-from carpeddiem@gmail.com) Received: from mail-ig0-x22c.google.com (mail-ig0-x22c.google.com [IPv6:2607:f8b0:4001:c05::22c]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (Client CN "smtp.gmail.com", Issuer "Google Internet Authority G2" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 1FB1B1D00 for ; Thu, 10 Mar 2016 15:29:58 +0000 (UTC) (envelope-from carpeddiem@gmail.com) Received: by mail-ig0-x22c.google.com with SMTP id vs8so19650169igb.1 for ; Thu, 10 Mar 2016 07:29:58 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:sender:in-reply-to:references:from:date:message-id :subject:to; bh=Bl2oY7VVB+A6gHwylXjN71efy8eHgQ0nadBlrXLzw5w=; b=SHyDXaaBTBib+8uNahpJG6PW0VSuL3ZCYuCubcdTSY56lMkxwUfOt/fVfgXm/qyPZI 5hG3Far3rth514gQbUDZ8U7zzehXdao+oTs37ZjK35DKldDJLTtDA9kZ0yxrJnx0cPTn dumaMvZhuidhPO+vpPQVqjlYYYBV0stpN9ON9XE5oZi3jo7E5Mu19xfOTMJbxhnKKtWh +Ua0R+nl7FvotTHWfrbi14LN7vn0zZqdkeIIRBCxAl7GXB2BQ4l7A02HXDDAeAx0mJJF 7Kbb864xrW54hBTuP6jfmlRcniWsBPW2Z2/FTDfcKQRL9xjfp+pWXQvwPWqoaeIy5TLK DntA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:sender:in-reply-to:references:from :date:message-id:subject:to; bh=Bl2oY7VVB+A6gHwylXjN71efy8eHgQ0nadBlrXLzw5w=; b=Gyjqt3TgiflptDUwumooA6VvqB57muwitIcprpKi8g/P1sWj+aV3DrXk8+DsP80VTv s0yzgvxbumia/XmkdKAK3yOn6xmwVrxGl3IRY5zWljh1q4MIcKJagWcFdafjlVgRJGCn PsnURyVTqicjCDWmsv70HJoa6GxLti9f+4o6lF8haznX2yw6wXTEb12U/YiVgAM0ErVB Cn1tbWOLYAxXwFZe5FYLHeGjQK6kOG8t576GAsNnfN22326GVu4JsaGsPTAj4uCGV9IT 1qyO4q+QhEtRBsH//atsnDNTaOb1l78JTUHai9RAYOpRNsTOV0JhyTK6Wh2mOKzKocoH JQLQ== X-Gm-Message-State: AD7BkJKTxse0UcXcGiYvE6OjmWCnGBr5QL1/nsPQPDcyZ/D1IXUWtjghtBOeMdpWd6JPDby/+1CB9r9GgYWETQ== X-Received: by 10.50.12.8 with SMTP id u8mr4207352igb.33.1457623797553; Thu, 10 Mar 2016 07:29:57 -0800 (PST) MIME-Version: 1.0 Sender: carpeddiem@gmail.com Received: by 10.107.39.66 with HTTP; Thu, 10 Mar 2016 07:29:38 -0800 (PST) In-Reply-To: <56E02D95.9020303@anongoth.pl> References: <56E02D95.9020303@anongoth.pl> From: Ed Maste Date: Thu, 10 Mar 2016 10:29:38 -0500 X-Google-Sender-Auth: J6PfW7s0M9VyisqR8kz6So4OTJY Message-ID: Subject: Re: Will 11.0-RELEASE include ASLR? To: freebsd-security@freebsd.org Content-Type: text/plain; charset=UTF-8 X-BeenThere: freebsd-security@freebsd.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: "Security issues \[members-only posting\]" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 10 Mar 2016 15:29:58 -0000 > There are patches ready for FreeBSD to use and it's ready to be shipped > in FreeBSD. However, for some reason FreeBSD developers do not want to > ship ASLR in FreeBSD. Why can't it be included at least as non-default > src.conf option and marked as experimental? A little while ago I asked kib@ to look at the ASLR situation. He implemented a small, more general solution. We planned to post it for review, testing and discussion soon, but given the renewed interest in this topic we'll put it on Phabricator today. I look forward to feedback on the patch from Shawn and the HardenedBSD folks and everyone else with an interest in ASLR on FreeBSD. From owner-freebsd-security@freebsd.org Thu Mar 10 15:40:32 2016 Return-Path: Delivered-To: freebsd-security@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id 350F8ACA378 for ; Thu, 10 Mar 2016 15:40:32 +0000 (UTC) (envelope-from shawn.webb@hardenedbsd.org) Received: from mail-qk0-x230.google.com (mail-qk0-x230.google.com [IPv6:2607:f8b0:400d:c09::230]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (Client CN "smtp.gmail.com", Issuer "Google Internet Authority G2" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id E1D50970 for ; Thu, 10 Mar 2016 15:40:31 +0000 (UTC) (envelope-from shawn.webb@hardenedbsd.org) Received: by mail-qk0-x230.google.com with SMTP id x1so35764973qkc.1 for ; Thu, 10 Mar 2016 07:40:31 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=hardenedbsd-org.20150623.gappssmtp.com; s=20150623; h=date:from:to:cc:subject:message-id:references:mime-version :content-disposition:in-reply-to:user-agent; bh=TiKOrA4WQZVBMDkqj1WHYU+QBArcD+pvY76CxvLW1pc=; b=g52Nw2Xxmttwz/M65MQWCBRacpHlzFJ8K199Z9T3sakrE1Rvuc+YaYq6w+UFZ82Ryd v1ViX78XDZ1WN6YmAp+rJKetQ7+D8Bw5vBBNlfGQ8GwT/jzCMYfFW9bPuo4IrLjRbaMz LM06jEiMD2I1nT6mjZxamsUYqeGlqTFBA4gEcWPl5Ns+XiIquCxi5fIFd0ZCNIqUD2Lv CWFZUr1/ELzSpm7VW+F89fMJbIlflDwx96jZNmlDjc29St9kvPsFsiXToFstSjAPpWeA 2wsaK0v7oDEZHerFXH6/oTsd/UFYTbn5NkLnGmTG/N3nCZG/wjvHbVvvaTrmTreLm6P8 ZtHA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:date:from:to:cc:subject:message-id:references :mime-version:content-disposition:in-reply-to:user-agent; bh=TiKOrA4WQZVBMDkqj1WHYU+QBArcD+pvY76CxvLW1pc=; b=ag4beLgAqIXJQSQJiR9UbeU7Rx1P+1UtOjCjYN2b6MI8MiyV3oSfgXCuLBSmbbxpvX yjW9b9wuR2YYqGBBLtqKUiLj9RYOgJ4o6wY70oIGBaWe1skLCNiZRVeyHwlScP038AV3 3czhsSjv2PClVV5T0IzRioeyiSMaNkBjFJj2zrMgdWJ/OXVbJFh9vltPYWOCiqLJSdjm QcUSIR0PoVZSDUHBhG71QOzIEJgfD62S6g9D17jhmwyw/JCIVLX+cJHjG0GJezuk3Msj joYa30hX9XB98ulmyntBlRsrHOHvPAKm1xrmXM7ynE23lB3nbb2LKNFaGDOGhxrGbEQ+ vTIQ== X-Gm-Message-State: AD7BkJKBMh0Oa63FUFJng0xXjsnd1jgl6xdLQZlqbEoxB1x/YMB9lrVGN6gJeNwsAOXz75i4 X-Received: by 10.55.74.197 with SMTP id x188mr4973147qka.104.1457624430897; Thu, 10 Mar 2016 07:40:30 -0800 (PST) Received: from mutt-hardenedbsd (c-73-135-80-144.hsd1.md.comcast.net. [73.135.80.144]) by smtp.gmail.com with ESMTPSA id a11sm1876219qge.43.2016.03.10.07.40.29 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Thu, 10 Mar 2016 07:40:29 -0800 (PST) Date: Thu, 10 Mar 2016 10:40:27 -0500 From: Shawn Webb To: Ed Maste Cc: freebsd-security@freebsd.org Subject: Re: Will 11.0-RELEASE include ASLR? Message-ID: <20160310154027.GJ42303@mutt-hardenedbsd> References: <56E02D95.9020303@anongoth.pl> MIME-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha256; protocol="application/pgp-signature"; boundary="bgQAstJ9X1Eg13Dy" Content-Disposition: inline In-Reply-To: X-Operating-System: FreeBSD mutt-hardenedbsd 11.0-CURRENT-HBSD FreeBSD 11.0-CURRENT-HBSD X-PGP-Key: http://pgp.mit.edu/pks/lookup?op=vindex&search=0x6A84658F52456EEE User-Agent: Mutt/1.5.24 (2015-08-30) X-BeenThere: freebsd-security@freebsd.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: "Security issues \[members-only posting\]" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 10 Mar 2016 15:40:32 -0000 --bgQAstJ9X1Eg13Dy Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Thu, Mar 10, 2016 at 10:29:38AM -0500, Ed Maste wrote: > > There are patches ready for FreeBSD to use and it's ready to be shipped > > in FreeBSD. However, for some reason FreeBSD developers do not want to > > ship ASLR in FreeBSD. Why can't it be included at least as non-default > > src.conf option and marked as experimental? >=20 > A little while ago I asked kib@ to look at the ASLR situation. >=20 > He implemented a small, more general solution. We planned to post it > for review, testing and discussion soon, but given the renewed > interest in this topic we'll put it on Phabricator today. >=20 > I look forward to feedback on the patch from Shawn and the HardenedBSD > folks and everyone else with an interest in ASLR on FreeBSD. I look forward to seeing the patch. We'd be especially interested to see how it does stack and VDSO randomization. If the implementation that FreeBSD provides is better than HardenedBSD's, we'd likely drop our implementation and go with FreeBSD's. I'll keep an eye on Phabricator today. Thanks, --=20 Shawn Webb HardenedBSD GPG Key ID: 0x6A84658F52456EEE GPG Key Fingerprint: 2ABA B6BD EF6A F486 BE89 3D9E 6A84 658F 5245 6EEE --bgQAstJ9X1Eg13Dy Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 iQIcBAEBCAAGBQJW4ZVpAAoJEGqEZY9SRW7uL1oP/jjOl/KsoYKmwhdO13DJNGba ktM2n4qyouhlnyAfq5LTnJDC876LFqsQPTkZKmZm8uXBF8o12WEa6CRrdJq72a+g lzBVwD9y2iRJQy7Xff9tSV3AHcS6RbUcec4LLTmioP5cDo7r13ZOzZKTVyDzC1wB GVY+45GzTMhml/dxshMrJ4DCPht4e/bMGbgiQG+ueWRrvhmI3+H06LScriDyf8jQ iiKJyx/bCBg7R3rq+pURZJ4/IEXXpwUbYAY8fQf5H2tLirgg1fYiXvmn6IixMBNZ 8FDIuxZO2riSuN009P+jULS+4ciszc7Kc4WK6mZYWEIl2dLYOf8WR9dwYAQTZH4g fyq3Dtp9whGocEuQHtOd3hpWOfOLH73l5ZgdCKJB+s1WPYK0W7E9vTVX8XQWzM8z epErupqVZNcJLuyi93Q2YSMYVUke9KgvlWaxMDfaBjB/VfgfadHLWbylUE2uOqpS pCeP8F67t+D5P+ZgUsAA+5lr4mHHjJj5tpQDap/FVgxu8h47zocXTZOjCyVy748G HI9CmCotw0ht3gGCn6/WURAQeYmnzX3zkB+Bp6RjaPTwiqq5rdDU9QeUknEzMJcG nwH/bD6jJ8Drs/J5o+iAy9L2mkdUkhSeqElQyWiTu4s/VaWgERjxAviywEtLZtIY lrwDVUDjv2Te/6L+HyPM =1JPW -----END PGP SIGNATURE----- --bgQAstJ9X1Eg13Dy-- From owner-freebsd-security@freebsd.org Thu Mar 10 16:22:03 2016 Return-Path: Delivered-To: freebsd-security@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id E2364AC99CA for ; Thu, 10 Mar 2016 16:22:03 +0000 (UTC) (envelope-from se@freebsd.org) Received: from nm49-vm4.bullet.mail.ne1.yahoo.com (nm49-vm4.bullet.mail.ne1.yahoo.com [98.138.121.132]) (using TLSv1 with cipher ECDHE-RSA-RC4-SHA (128/128 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id AE8873FE for ; Thu, 10 Mar 2016 16:22:03 +0000 (UTC) (envelope-from se@freebsd.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s2048; t=1457626532; bh=t81hN/tZaQbjxItStZGxrEiwAduTW5oONKV8ezdb3wI=; h=Subject:To:References:From:Date:In-Reply-To:From:Subject; b=aMCtsG0c+ISuWLoYaSumbD6trj6qps/bKTaY6xthfHS6D3lALzzrojHMiQCvosiPSVVgQpgdfwlnV7kQkFKAnN8kX0902JcbTWyyDHKFEmdjttab849vcWgQ9QlgXDC6429EwfzswHsWG1/er/lvm4tEiw2fvb7nMAw21bMPRDHBiER+vu0NKkqSivQk7ESD+lqqDLFhCK4Kq52wqQu0LmagHg01RY1vMBlXOLx7m35UEDILop8cOlo1K9drZIeh8K+ZRR+HJMWiCqugjta4WaplcxOOSDwR2UJirZqQZbK2rgMgZVJAZuLEqrpA/YHY0hmGl/FPzBqT/Uqqr7znwQ== Received: from [127.0.0.1] by nm49.bullet.mail.ne1.yahoo.com with NNFMP; 10 Mar 2016 16:15:32 -0000 Received: from [98.138.226.176] by nm49.bullet.mail.ne1.yahoo.com with NNFMP; 10 Mar 2016 16:12:34 -0000 Received: from [212.82.98.48] by tm11.bullet.mail.ne1.yahoo.com with NNFMP; 10 Mar 2016 16:12:34 -0000 Received: from [46.228.39.101] by tm1.bullet.mail.ir2.yahoo.com with NNFMP; 10 Mar 2016 16:12:34 -0000 Received: from [127.0.0.1] by smtp138.mail.ir2.yahoo.com with NNFMP; 10 Mar 2016 16:12:34 -0000 X-Yahoo-Newman-Id: 261995.7366.bm@smtp138.mail.ir2.yahoo.com X-Yahoo-Newman-Property: ymail-4 X-YMail-OSG: Qbz8VacVM1nQq65hzpMQdtii37L3GPRJB.sBXjhKMo35oX_ broYf9bCbvp7LwlJU40B.gAVUEaWUlJJHuoqpcxMly1NIwQPHZDva.SbxrP2 ZFxEEvFYf_TYhV8YvN6w2fkwlhVnboVOg73slm5AIE.b1wWgQt2sJt92WVy5 rLi2fXK7_TBqr7xYg_kgriJrmVtO2hfNU3Ye3EN8f2sgcBtWquN7hSeifrso Iku5QfFT.b2sR1H99_Oyefm18qmuysqwo9fCskN2JgWJAGPQUO1z_FrCRXnq X0a8yiCLPi9L1QjnhALHLBHzE7fZyiq2dRFZSSDageR5CtnEGAo5ImO6u72q WZBa7M2QQg5_xYuLu.lPgn3C0QEKvt6o8FExSmR2Vntne.VLKonsVo0q0XHt DLbP.plsjX2gCqe2m44StyrepdWRDG8PlBO2phTQvg1saeqtWHEu8YQgV1ch 1GR3s_csxJhzpYYeu1PUu0omvD8F0cElZ4y.wlUMh7oR9nwwRIMZvQTf06k9 cbSDWYxgzuS1QpKHfsSfbGhGqk5vUD2Lag0rN6mBhWbbN X-Yahoo-SMTP: iDf2N9.swBDAhYEh7VHfpgq0lnq. Subject: Re: FreeBSD Security Advisory FreeBSD-SA-16:12.openssl To: freebsd-security@freebsd.org References: <20160310102031.E4E7B16FB@freefall.freebsd.org> From: Stefan Esser Message-ID: <56E19CC5.5090406@freebsd.org> Date: Thu, 10 Mar 2016 17:11:49 +0100 User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:38.0) Gecko/20100101 Thunderbird/38.6.0 MIME-Version: 1.0 In-Reply-To: <20160310102031.E4E7B16FB@freefall.freebsd.org> Content-Type: text/plain; charset=windows-1252 Content-Transfer-Encoding: 7bit X-Mailman-Approved-At: Thu, 10 Mar 2016 16:57:18 +0000 X-BeenThere: freebsd-security@freebsd.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: "Security issues \[members-only posting\]" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 10 Mar 2016 16:22:04 -0000 Am 10.03.2016 um 11:20 schrieb FreeBSD Security Advisories: > ============================================================================= > FreeBSD-SA-16:12.openssl Security Advisory > The FreeBSD Project > > Topic: Multiple OpenSSL vulnerabilities > > Category: contrib > Module: openssl > Announced: 2016-03-10 > Credits: OpenSSL Project > Affects: All supported versions of FreeBSD. > Corrected: 2016-03-04 00:40:15 UTC (stable/10, 10.2-BETA3) Minor nit: That should probably have been: stable/10, 10.3-BETA3? Regards, STefan