Date: Sat, 27 Jul 2002 10:15:19 -0700 (PDT) From: Jon <cykyc@yahoo.com> To: freebsd-gnats-submit@FreeBSD.org Subject: conf/41054: Sendmail assumptions in startup scripts may lead to a temporary DoS Message-ID: <200207271715.g6RHFJ7w018414@www.freebsd.org>
next in thread | raw e-mail | index | archive | help
>Number: 41054
>Category: conf
>Synopsis: Sendmail assumptions in startup scripts may lead to a temporary DoS
>Confidential: no
>Severity: serious
>Priority: low
>Responsible: freebsd-bugs
>State: open
>Quarter:
>Keywords:
>Date-Required:
>Class: sw-bug
>Submitter-Id: current-users
>Arrival-Date: Sat Jul 27 10:20:01 PDT 2002
>Closed-Date:
>Last-Modified:
>Originator: Jon
>Release: FreeBSD 4.6-RC i386
>Organization:
>Environment:
FreeBSD novaV2 4.6-RC FreeBSD 4.6-RC #3: Thu May 16 18:52:21 CDT 2002 root@novaV2:/usr/obj/usr/src/sys/NOVAV2 i386
>Description:
From /etc/rc, revision 1.212.2.50 (no change in rev 1.314):
# Delete any recovery files that are zero length,
# corrupted, or that have no corresponding backup file.
# Else send mail to the user.
recfile=`awk '/^X-vi-recover-path:/{print $2}' < "${i}"`
if [ -n "${recfile}" -a -s "${recfile}" ]; then
sendmail -t < "${i}"
else
rm -f "${i}"
fi
When the sendmail_enable entry in /etc/rc.conf is set at "NONE", recovery files exist in /var/tmp/vi.recover, and the system is rebooting, the system may be delayed during the restart. This is due to a recovery message trying to be sent to a user within /etc/rc from the 'sendmail -t < "${i}"' entry. I'm assuming the delay is a function of how many recovery files exist. This potentially could result in a crude Denial of Service attack if the aforementioned criteria are set, and an entity creates numerous vi recovery files.
>How-To-Repeat:
1. Set the sendmail_enable entry to "NONE"
2. Create some vi recovery files as a normal user (start up a session and kill it works easy enough)
3. Wait for a reboot of the system
>Fix:
A check against sendmail_enable set to "NONE" to avoid timeouts should be performed within all the startup scripts wherever sendmail is being used.
Issuing a ^C during startup should also stop the delay during a reboot, if at the console.
>Release-Note:
>Audit-Trail:
>Unformatted:
To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-bugs" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200207271715.g6RHFJ7w018414>