From owner-freebsd-bugs Sat Jul 27 10:20:10 2002 Delivered-To: freebsd-bugs@hub.freebsd.org Received: from mx1.FreeBSD.org (mx1.FreeBSD.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 7BFF937B400 for ; Sat, 27 Jul 2002 10:20:02 -0700 (PDT) Received: from freefall.freebsd.org (freefall.FreeBSD.org [216.136.204.21]) by mx1.FreeBSD.org (Postfix) with ESMTP id D0DE743E65 for ; Sat, 27 Jul 2002 10:20:01 -0700 (PDT) (envelope-from gnats@FreeBSD.org) Received: from freefall.freebsd.org (gnats@localhost [127.0.0.1]) by freefall.freebsd.org (8.12.4/8.12.4) with ESMTP id g6RHK1JU089914 for ; Sat, 27 Jul 2002 10:20:01 -0700 (PDT) (envelope-from gnats@freefall.freebsd.org) Received: (from gnats@localhost) by freefall.freebsd.org (8.12.4/8.12.4/Submit) id g6RHK18m089913; Sat, 27 Jul 2002 10:20:01 -0700 (PDT) Received: from mx1.FreeBSD.org (mx1.FreeBSD.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 914E637B400 for ; Sat, 27 Jul 2002 10:15:19 -0700 (PDT) Received: from www.freebsd.org (www.FreeBSD.org [216.136.204.117]) by mx1.FreeBSD.org (Postfix) with ESMTP id 4F58343E4A for ; Sat, 27 Jul 2002 10:15:19 -0700 (PDT) (envelope-from nobody@FreeBSD.org) Received: from www.freebsd.org (localhost [127.0.0.1]) by www.freebsd.org (8.12.4/8.12.4) with ESMTP id g6RHFJOT018417 for ; Sat, 27 Jul 2002 10:15:19 -0700 (PDT) (envelope-from nobody@www.freebsd.org) Received: (from nobody@localhost) by www.freebsd.org (8.12.4/8.12.4/Submit) id g6RHFJ7w018414; Sat, 27 Jul 2002 10:15:19 -0700 (PDT) Message-Id: <200207271715.g6RHFJ7w018414@www.freebsd.org> Date: Sat, 27 Jul 2002 10:15:19 -0700 (PDT) From: Jon To: freebsd-gnats-submit@FreeBSD.org X-Send-Pr-Version: www-1.0 Subject: conf/41054: Sendmail assumptions in startup scripts may lead to a temporary DoS Sender: owner-freebsd-bugs@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.org >Number: 41054 >Category: conf >Synopsis: Sendmail assumptions in startup scripts may lead to a temporary DoS >Confidential: no >Severity: serious >Priority: low >Responsible: freebsd-bugs >State: open >Quarter: >Keywords: >Date-Required: >Class: sw-bug >Submitter-Id: current-users >Arrival-Date: Sat Jul 27 10:20:01 PDT 2002 >Closed-Date: >Last-Modified: >Originator: Jon >Release: FreeBSD 4.6-RC i386 >Organization: >Environment: FreeBSD novaV2 4.6-RC FreeBSD 4.6-RC #3: Thu May 16 18:52:21 CDT 2002 root@novaV2:/usr/obj/usr/src/sys/NOVAV2 i386 >Description: From /etc/rc, revision 1.212.2.50 (no change in rev 1.314): # Delete any recovery files that are zero length, # corrupted, or that have no corresponding backup file. # Else send mail to the user. recfile=`awk '/^X-vi-recover-path:/{print $2}' < "${i}"` if [ -n "${recfile}" -a -s "${recfile}" ]; then sendmail -t < "${i}" else rm -f "${i}" fi When the sendmail_enable entry in /etc/rc.conf is set at "NONE", recovery files exist in /var/tmp/vi.recover, and the system is rebooting, the system may be delayed during the restart. This is due to a recovery message trying to be sent to a user within /etc/rc from the 'sendmail -t < "${i}"' entry. I'm assuming the delay is a function of how many recovery files exist. This potentially could result in a crude Denial of Service attack if the aforementioned criteria are set, and an entity creates numerous vi recovery files. >How-To-Repeat: 1. Set the sendmail_enable entry to "NONE" 2. Create some vi recovery files as a normal user (start up a session and kill it works easy enough) 3. Wait for a reboot of the system >Fix: A check against sendmail_enable set to "NONE" to avoid timeouts should be performed within all the startup scripts wherever sendmail is being used. Issuing a ^C during startup should also stop the delay during a reboot, if at the console. >Release-Note: >Audit-Trail: >Unformatted: To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-bugs" in the body of the message