From owner-svn-doc-projects@FreeBSD.ORG Sat Nov 24 23:16:09 2012 Return-Path: Delivered-To: svn-doc-projects@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [69.147.83.52]) by hub.freebsd.org (Postfix) with ESMTP id 8CDD6E59; Sat, 24 Nov 2012 23:16:09 +0000 (UTC) (envelope-from gjb@FreeBSD.org) Received: from svn.freebsd.org (svn.freebsd.org [IPv6:2001:1900:2254:2068::e6a:0]) by mx1.freebsd.org (Postfix) with ESMTP id 704298FC13; Sat, 24 Nov 2012 23:16:09 +0000 (UTC) Received: from svn.freebsd.org (localhost [127.0.0.1]) by svn.freebsd.org (8.14.5/8.14.5) with ESMTP id qAONG9lx044978; Sat, 24 Nov 2012 23:16:09 GMT (envelope-from gjb@svn.freebsd.org) Received: (from gjb@localhost) by svn.freebsd.org (8.14.5/8.14.5/Submit) id qAONG92k044966; Sat, 24 Nov 2012 23:16:09 GMT (envelope-from gjb@svn.freebsd.org) Message-Id: <201211242316.qAONG92k044966@svn.freebsd.org> From: Glen Barber Date: Sat, 24 Nov 2012 23:16:08 +0000 (UTC) To: doc-committers@freebsd.org, svn-doc-projects@freebsd.org Subject: svn commit: r40152 - in projects/pkgng/share: pgpkeys security/advisories security/patches/SA-12:06 security/patches/SA-12:07 security/patches/SA-12:08 xml X-SVN-Group: doc-projects MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-BeenThere: svn-doc-projects@freebsd.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: SVN commit messages for doc projects trees List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 24 Nov 2012 23:16:09 -0000 Author: gjb Date: Sat Nov 24 23:16:08 2012 New Revision: 40152 URL: http://svnweb.freebsd.org/changeset/doc/40152 Log: Merged /head/share:r39915-39917,39919-39920,39922-39925, 39927,39929-39931,39933-39945,39947-39949,39951-39952, 39954-39978,39981-39988,39990-39993,39995-40150 from ^/head/share to ^/projects/pkgng/share Added: projects/pkgng/share/pgpkeys/deischen.key - copied unchanged from r40150, head/share/pgpkeys/deischen.key projects/pkgng/share/pgpkeys/kan.key - copied unchanged from r40150, head/share/pgpkeys/kan.key projects/pkgng/share/pgpkeys/olgeni.key - copied unchanged from r40150, head/share/pgpkeys/olgeni.key projects/pkgng/share/security/advisories/FreeBSD-SA-12:06.bind.asc - copied unchanged from r40150, head/share/security/advisories/FreeBSD-SA-12:06.bind.asc projects/pkgng/share/security/advisories/FreeBSD-SA-12:07.hostapd.asc - copied unchanged from r40150, head/share/security/advisories/FreeBSD-SA-12:07.hostapd.asc projects/pkgng/share/security/advisories/FreeBSD-SA-12:08.linux.asc - copied unchanged from r40150, head/share/security/advisories/FreeBSD-SA-12:08.linux.asc projects/pkgng/share/security/patches/SA-12:06/ - copied from r40150, head/share/security/patches/SA-12:06/ projects/pkgng/share/security/patches/SA-12:07/ - copied from r40150, head/share/security/patches/SA-12:07/ projects/pkgng/share/security/patches/SA-12:08/ - copied from r40150, head/share/security/patches/SA-12:08/ Modified: projects/pkgng/share/pgpkeys/ehaupt.key projects/pkgng/share/pgpkeys/itetcu.key projects/pkgng/share/pgpkeys/jkim.key projects/pkgng/share/pgpkeys/kib.key projects/pkgng/share/pgpkeys/nyan.key projects/pkgng/share/pgpkeys/pgpkeys-developers.xml projects/pkgng/share/pgpkeys/pgpkeys.ent projects/pkgng/share/pgpkeys/rene.key projects/pkgng/share/xml/advisories.xml projects/pkgng/share/xml/freebsd-html.dsl projects/pkgng/share/xml/news.xml Directory Properties: projects/pkgng/share/ (props changed) Copied: projects/pkgng/share/pgpkeys/deischen.key (from r40150, head/share/pgpkeys/deischen.key) ============================================================================== --- /dev/null 00:00:00 1970 (empty, because file is newly added) +++ projects/pkgng/share/pgpkeys/deischen.key Sat Nov 24 23:16:08 2012 (r40152, copy of r40150, head/share/pgpkeys/deischen.key) @@ -0,0 +1,63 @@ + + + +sub 4096R/A51F81F7 2012-11-17 +]]> + Modified: projects/pkgng/share/pgpkeys/ehaupt.key ============================================================================== --- projects/pkgng/share/pgpkeys/ehaupt.key Sat Nov 24 23:15:50 2012 (r40151) +++ projects/pkgng/share/pgpkeys/ehaupt.key Sat Nov 24 23:16:08 2012 (r40152) @@ -1,41 +1,63 @@ -sub 2048R/F658659F 2010-09-24 [expires: 2011-09-24] +sub 3072g/70183B96 2012-11-17 [expires: 2013-11-17] ]]> Modified: projects/pkgng/share/pgpkeys/itetcu.key ============================================================================== --- projects/pkgng/share/pgpkeys/itetcu.key Sat Nov 24 23:15:50 2012 (r40151) +++ projects/pkgng/share/pgpkeys/itetcu.key Sat Nov 24 23:16:08 2012 (r40152) @@ -1,44 +1,74 @@ -sub 2048g/0B30E680 2008-05-08 [expires: 2010-05-08] +sub 4096R/54B3FFA0 2012-11-19 [expires: 2014-11-19] ]]> Modified: projects/pkgng/share/pgpkeys/jkim.key ============================================================================== --- projects/pkgng/share/pgpkeys/jkim.key Sat Nov 24 23:15:50 2012 (r40151) +++ projects/pkgng/share/pgpkeys/jkim.key Sat Nov 24 23:16:08 2012 (r40152) @@ -1,55 +1,43 @@ -uid Jung-uk Kim -sub 4096g/B01CA5A0 2004-04-07 +sub 2048R/41858FC6 2012-11-19 ]]> Copied: projects/pkgng/share/pgpkeys/kan.key (from r40150, head/share/pgpkeys/kan.key) ============================================================================== Binary file (source and/or target). No diff available. Modified: projects/pkgng/share/pgpkeys/kib.key ============================================================================== --- projects/pkgng/share/pgpkeys/kib.key Sat Nov 24 23:15:50 2012 (r40151) +++ projects/pkgng/share/pgpkeys/kib.key Sat Nov 24 23:16:08 2012 (r40152) @@ -1,53 +1,95 @@ -uid Konstantin Belousov -uid Kostik Belousov -uid Kostik Belousov -sub 2048g/18488597 2004-07-29 +pub 4096R/C1BCAD41 2012-11-17 + Key fingerprint = 7DE0 3388 64AC 53C3 7B88 3A79 90C2 B92B C1BC AD41 +uid Konstantin Belousov +uid Konstantin Belousov +uid Konstantin Belousov +sub 4096R/3BBC8F64 2012-11-17 ]]> Modified: projects/pkgng/share/pgpkeys/nyan.key ============================================================================== --- projects/pkgng/share/pgpkeys/nyan.key Sat Nov 24 23:15:50 2012 (r40151) +++ projects/pkgng/share/pgpkeys/nyan.key Sat Nov 24 23:16:08 2012 (r40152) @@ -1,44 +1,95 @@ - Key fingerprint = D4FA D8CA 2AED FCF4 90A3 3569 8666 0500 8394 B81F -uid Yoshihiro TAKAHASHI -uid Yoshihiro TAKAHASHI -sub 1024g/B796F020 2001-10-15 +pub 4096R/6624859E 2012-11-18 + Key fingerprint = 1CA5 445E 7ABD BC21 AEC0 7B89 47D7 4EFF 6624 859E +uid Yoshihiro TAKAHASHI +uid Yoshihiro TAKAHASHI +uid Yoshihiro TAKAHASHI +sub 4096R/362726EA 2012-11-18 ]]> Copied: projects/pkgng/share/pgpkeys/olgeni.key (from r40150, head/share/pgpkeys/olgeni.key) ============================================================================== --- /dev/null 00:00:00 1970 (empty, because file is newly added) +++ projects/pkgng/share/pgpkeys/olgeni.key Sat Nov 24 23:16:08 2012 (r40152, copy of r40150, head/share/pgpkeys/olgeni.key) @@ -0,0 +1,91 @@ + + + +uid Jimmy Olgeni +uid Giacomo Olgeni +uid Giacomo Olgeni +uid Giacomo Olgeni +uid Giacomo Olgeni +uid Giacomo Olgeni +sub 2048R/1988BB4B 2012-11-01 +]]> + Modified: projects/pkgng/share/pgpkeys/pgpkeys-developers.xml ============================================================================== --- projects/pkgng/share/pgpkeys/pgpkeys-developers.xml Sat Nov 24 23:15:50 2012 (r40151) +++ projects/pkgng/share/pgpkeys/pgpkeys-developers.xml Sat Nov 24 23:16:08 2012 (r40152) @@ -416,6 +416,11 @@ &pgpkey.peadar; + + &a.deischen; + &pgpkey.deischen; + + &a.josef; &pgpkey.josef; @@ -726,6 +731,11 @@ &pgpkey.tj; + + &a.kan; + &pgpkey.kan; + + &a.bjk; &pgpkey.bjk; @@ -1226,6 +1236,11 @@ &pgpkey.obrien; + + &a.olgeni; + &pgpkey.olgeni; + + &a.philip; &pgpkey.philip; Modified: projects/pkgng/share/pgpkeys/pgpkeys.ent ============================================================================== --- projects/pkgng/share/pgpkeys/pgpkeys.ent Sat Nov 24 23:15:50 2012 (r40151) +++ projects/pkgng/share/pgpkeys/pgpkeys.ent Sat Nov 24 23:16:08 2012 (r40152) @@ -92,6 +92,7 @@ + @@ -185,6 +186,7 @@ + @@ -271,6 +273,7 @@ + Modified: projects/pkgng/share/pgpkeys/rene.key ============================================================================== --- projects/pkgng/share/pgpkeys/rene.key Sat Nov 24 23:15:50 2012 (r40151) +++ projects/pkgng/share/pgpkeys/rene.key Sat Nov 24 23:16:08 2012 (r40152) @@ -1,41 +1,64 @@ -sub 2048g/C54EA560 2008-11-03 +pub 4096R/0A3789B7 2012-11-18 + Key fingerprint = 101A 716B 162B 00E5 5BED EA05 ADBB F861 0A37 89B7 +uid René Ladan +sub 4096R/B67184C6 2012-11-18 ]]> Copied: projects/pkgng/share/security/advisories/FreeBSD-SA-12:06.bind.asc (from r40150, head/share/security/advisories/FreeBSD-SA-12:06.bind.asc) ============================================================================== --- /dev/null 00:00:00 1970 (empty, because file is newly added) +++ projects/pkgng/share/security/advisories/FreeBSD-SA-12:06.bind.asc Sat Nov 24 23:16:08 2012 (r40152, copy of r40150, head/share/security/advisories/FreeBSD-SA-12:06.bind.asc) @@ -0,0 +1,139 @@ +-----BEGIN PGP SIGNED MESSAGE----- +Hash: SHA1 + +============================================================================= +FreeBSD-SA-12:06.bind Security Advisory + The FreeBSD Project + +Topic: Multiple Denial of Service vulnerabilities with named(8) + +Category: contrib +Module: bind +Announced: 2012-11-22 +Affects: All supported versions of FreeBSD before 9.1-RC2. +Corrected: 2012-11-22 23:15:38 UTC (RELENG_7, 7.4-STABLE) + 2012-11-22 22:52:15 UTC (RELENG_7_4, 7.4-RELEASE-p11) + 2012-10-11 13:25:09 UTC (RELENG_8, 8.3-STABLE) + 2012-11-22 22:52:15 UTC (RELENG_8_3, 8.3-RELEASE-p5) + 2012-10-10 19:50:15 UTC (RELENG_9, 9.1-PRERELEASE) + 2012-11-22 22:52:15 UTC (RELENG_9_0, 9.0-RELEASE-p5) + 2012-11-22 22:52:15 UTC (RELENG_9_1, 9.1-RC1-p1) + 2012-11-22 22:52:15 UTC (RELENG_9_1, 9.1-RC2-p1) + 2012-11-22 22:52:15 UTC (RELENG_9_1, 9.1-RC3-p1) +CVE Name: CVE-2012-4244, CVE-2012-5166 + +For general information regarding FreeBSD Security Advisories, +including descriptions of the fields above, security branches, and the +following sections, please visit . + +I. Background + +BIND 9 is an implementation of the Domain Name System (DNS) protocols. +The named(8) daemon is an Internet Domain Name Server. + +II. Problem Description + +The BIND daemon would crash when a query is made on a resource record +with RDATA that exceeds 65535 bytes. + +The BIND daemon would lock up when a query is made on specific +combinations of RDATA. + +III. Impact + +A remote attacker can query a resolving name server to retrieve a record +whose RDATA is known to be larger than 65535 bytes, thereby causing the +resolving server to crash via an assertion failure in named. + +An attacker who is in a position to add a record with RDATA larger than +65535 bytes to an authoritative name server can cause that server to +crash by later querying for that record. + +The attacker can also cause the server to lock up with specific +combinations of RDATA. + +IV. Workaround + +No workaround is available, but systems not running the BIND name +server are not affected. + +V. Solution + +Perform one of the following: + +1) Upgrade your vulnerable system to 7-STABLE, 8-STABLE, or 9-STABLE, +or to the RELENG_7_4, RELENG_8_3, or RELENG_9_0 security branch dated +after the correction date. + +2) To update your vulnerable system via a source code patch: + +The following patches have been verified to apply to FreeBSD 7.4, +8.3, and 9.0 systems. + +a) Download the relevant patch from the location below, and verify the +detached PGP signature using your PGP utility. + +# fetch http://security.FreeBSD.org/patches/SA-12:06/bind.patch +# fetch http://security.FreeBSD.org/patches/SA-12:06/bind.patch.asc + +b) Execute the following commands as root: + +# cd /usr/src +# patch < /path/to/patch + +Recompile the operating system using buildworld and installworld as +described in . + +3) To update your vulnerable system via a binary patch: + +Systems running 7.4-RELEASE, 8.3-RELEASE, 9.0-RELEASE, or 9.1-RC1 on +the i386 or amd64 platforms can be updated via the freebsd-update(8) +utility: + +# freebsd-update fetch +# freebsd-update install + +4) Install and run BIND from the Ports Collection after the correction +date. The following versions and newer versions of BIND installed from +the Ports Collection are not affected by this vulnerability: + + bind96-9.6.3.1.ESV.R7.4 + bind97-9.7.6.4 + bind98-9.8.3.4 + bind99-9.9.1.4 + +VI. Correction details + *** DIFF OUTPUT TRUNCATED AT 1000 LINES ***