Technical discussion regarding security issues in NetBSD

comfooc | 21 Apr 2008 23:17

Picon

openssl speed part 2

Hello, I've updated system to the NetBSD-current (with opencrypto improvement).
I didn't notice significant performance improvement as a matter of
fact OpenSSL with perl is still two times better than one without. So
ssh transfer rates are still low.

Cheers...

With  perl:

OpenSSL 0.9.8g 19 Oct 2007
built on: Wed Apr  9 19:09:48 CEST 2008
options:bn(64,32) md2(int) rc4(idx,int) des(ptr,risc1,16,long)
aes(partial) blowfish(idx)
compiler: gcc -fPIC -DOPENSSL_PIC -DOPENSSL_THREADS -pthread
-D_THREAD_SAFE -D_REENTRANT -DDSO_DLFCN -DHAVE_DLFCN_H -O2 -mmmx -msse
-mtune=pentium3 -march=pentium3 -pipe -O2 -DL_ENDIAN -DTERMIOS -O3
-fomit-frame-pointer -Wall -DOPENSSL_BN_ASM_PART_WORDS
-DOPENSSL_IA32_SSE2 -DSHA1_ASM -DMD5_ASM -DRMD160_ASM -DAES_ASM
available timing options: USE_TOD HZ=100 [sysconf value]
timing function used: getrusage
The 'numbers' are in 1000s of bytes per second processed.
type             16 bytes     64 bytes    256 bytes   1024 bytes   8192 bytes
md2                434.55k      938.39k     1322.92k     1474.75k     1525.56k
mdc2                 0.00         0.00         0.00         0.00         0.00
md4               2936.95k    10678.82k    33880.37k    73907.26k   112942.80k
md5               2446.63k     8884.57k    27089.53k    54867.74k    77392.82k
hmac(md5)         4300.14k    14269.69k    37790.81k    64430.43k    78934.13k
sha1              2330.37k     7787.09k    20313.70k    33964.94k    42288.17k
rmd160            2176.58k     6816.74k    16250.08k    24889.27k    29489.08k
rc4              54190.07k    59411.69k    64501.92k    65627.58k    65356.25k

(Continue reading)

NetBSD Security-Officer | 22 Apr 2008 00:30

Picon

NetBSD Security Advisory 2008-004: bzip2(1) Multiple issues


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

		 NetBSD Security Advisory 2008-004
		 =================================

Topic:		bzip2(1) Multiple issues

Version:	NetBSD-current:		affected
		NetBSD 4.0:		affected
		NetBSD 3.1.*:		affected
		NetBSD 3.1:		affected
		NetBSD 3.0:		affected
		NetBSD 3.0.*:		affected

Severity:	Denial of Service and Race Condition

Fixed:		NetBSD-current:		March 18, 2008
		NetBSD-4 branch:	March 24, 2008
			(4.1 will include the fix)
		NetBSD-4-0 branch:	March 24, 2008
			(4.0.1 will include the fix)
		NetBSD-3-1 branch:	March 26, 2008
			(3.1.2 will include the fix)
		NetBSD-3-0 branch:	March 26, 2008
			(3.0.4 will include the fix)
		NetBSD-3 branch:	March 26, 2008
			(3.2 will include the fix)
		pkgsrc:			bzip2-1.0.5 corrects the issue

(Continue reading)

NetBSD Security-Officer | 22 Apr 2008 00:30

Picon

NetBSD Security Advisory 2008-005: OpenSSH Multiple issues


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

		 NetBSD Security Advisory 2008-005
		 =================================

Topic:		OpenSSH Multiple issues

Version:	NetBSD-current:		affected
		NetBSD 4.0:		affected
		NetBSD 3.1.*:		affected
		NetBSD 3.1:		affected
		NetBSD 3.0:		affected
		NetBSD 3.0.*:		affected

Severity:	ForceCommand bypass and X11 session hijacking

Fixed:		NetBSD-current:		April 05, 2008
		NetBSD-4 branch:	April 07, 2008
			(4.1 will include the fix)
		NetBSD-4-0 branch:	April 07, 2008
			(4.0.1 will include the fix)
		NetBSD-3-1 branch:	April 08, 2008
			(3.1.2 will include the fix)
		NetBSD-3-0 branch:	April 08, 2008
			(3.0.4 will include the fix)
		NetBSD-3 branch:	April 08, 2008
			(3.2 will include the fix)
		pkgsrc:			openssh-4.7.1nb3 corrects the issue

(Continue reading)

NetBSD Security-Officer | 22 Apr 2008 00:31

Picon

NetBSD Security Advisory 2008-006: Integer overflow in strfmon(3) function


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

		 NetBSD Security Advisory 2008-006
		 =================================

Topic:		Integer overflow in strfmon(3) function

Version:	NetBSD-current:		affected
		NetBSD 4.0:		affected
		NetBSD 3.1.*:		unaffected
		NetBSD 3.1:		unaffected
		NetBSD 3.0:		unaffected
		NetBSD 3.0.*:		unaffected

Severity:	Local user may be able to execute arbitrary code

Fixed:		NetBSD-current:		March 18, 2008
		NetBSD-4 branch:	March 19, 2008
			(4.1 will include the fix)
		NetBSD-4-0 branch:	March 19, 2008
			(4.0.1 will include the fix)

Abstract
========

The strfmon() function contains multiple integer overflows which can be
exploited by a local attacker to cause a crash or potentially execute
arbitrary code.

(Continue reading)

史斌 | 28 Apr 2008 11:23

Picon

about the NetBSD-SA2008-003

As the announcement on 
ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2008-003.txt.asc and
http://www.netbsd.org/support/security/patches-3.1.1.html

1. This security problem affected NetBSD-3.1 release and did not affect
   NetBSD-3.1.1 release.

2. NetBSD-3.1.2 which will be released in the future contains
   the fixed.

3. It can be fixed by fixing sys/netinet6/ipcomp_input.c

   However, I found the source file sys/netinet6/ipcomp_input.c in
NetBSD-3.1.1 release is same to the file in the NetBSD-3.1 release, 
and is different from the file in the source tree of NetBSD-3-1 branch.

   Does it mean that the file in NetBSD-3.1 is not fixed and the 
file in the source tree of NetBSD-3-1 branch is fixed?

   If it is true, why NetBSD-3.1 release is affected but NetBSD-3.1.1
release is not?

   Thank you.

Adrian Portelli | 28 Apr 2008 13:46

Picon

Re: about the NetBSD-SA2008-003

史斌 wrote:
> As the announcement on 
> ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2008-003.txt.asc and
> http://www.netbsd.org/support/security/patches-3.1.1.html
> 
> 1. This security problem affected NetBSD-3.1 release and did not affect
>    NetBSD-3.1.1 release.
> 
> 2. NetBSD-3.1.2 which will be released in the future contains
>    the fixed.
> 
> 3. It can be fixed by fixing sys/netinet6/ipcomp_input.c
> 
>    However, I found the source file sys/netinet6/ipcomp_input.c in
> NetBSD-3.1.1 release is same to the file in the NetBSD-3.1 release, 
> and is different from the file in the source tree of NetBSD-3-1 branch.
> 
>    Does it mean that the file in NetBSD-3.1 is not fixed and the 
> file in the source tree of NetBSD-3-1 branch is fixed?
> 
>    If it is true, why NetBSD-3.1 release is affected but NetBSD-3.1.1
> release is not?
> 
>    Thank you.

Hi,

This is a problem with the advisory.  In the 'Version' section it should 
  also state that the NetBSD 3.1.* releases are affected.  I'll update 
this later today and re-issue the advisory.

(Continue reading)

Group

gmane.os.netbsd.devel.security.

Search Archive

Page

1

Articles in period: 6

April 2008

Language

Change language

Options

Current view: Threads only / Showing only 20 lines / Not hiding cited text.
Change to All messages, whole messages, or hide cited text.

Post a message
NNTP Newsgroup
Classic Gmane web interface
XML

XML

RSS Feed
List Information

About Gmane

Recent entries

[GSoC 2013] Implement file system flags to scrub data blocks before de (30 Apr 2013)
regarding project to"Implement file system flags to scrub data blocks (14 Apr 2013)
Google Summer of Code 2013. (13 Apr 2013)
OpenCrypto swcrypto(4) enhancements (10 Apr 2013)
NetBSD Security Advisory 2013-003: RNG Bug May Result in Weak Cryptogr (30 Mar 2013)
ECDSA and key leaks due to RNG problems. (25 Mar 2013)
Updated NetBSD Security Advisory 2013-003: RNG Bug May Result in Weak (7 Mar 2013)
NetBSD Security Advisory 2013-003: Pseudo-Random bits weaker than expe (27 Feb 2013)
NetBSD Security Advisory 2013-004: Vulnerabilities in grep (27 Feb 2013)
NetBSD Security Advisory 2013-002: kqueue related kernel panic trigger (27 Feb 2013)
You have (1) new ecard! (26 Feb 2013)
You have (1) new ecard! (8 Feb 2013)
Invitation to Bid - Jared #2528 - Evansville, IN (30 Jan 2013)
Notice of Addendum #: 1 - Oregon Park District (29 Jan 2013)
Invitation to Bid - Spencer Gifts #205 - St. Clair Square (29 Jan 2013)
NetBSD Security Advisory 2013-001: kernel panic triggered from userlan (29 Jan 2013)
Your Blue Book Network Project Leads ( MREF#188430675 ) (27 Jan 2013)
� Last day to save on our website presence package (25 Jan 2013)
Analyst Report: Understanding Responsive Design (25 Jan 2013)
Your Blue Book Network Project Leads ( MREF#188213540 ) (24 Jan 2013)
Invitation to Bid - Fuzzy's Taco (24 Jan 2013)

Archives

2	May 2013
6	April 2013
3	March 2013
6	February 2013
16	January 2013
6	December 2012
28	November 2012
6	October 2012
4	September 2012
2	August 2012
20	July 2012
12	June 2012
4	May 2012
4	April 2012
10	March 2012
16	December 2011
2	November 2011
2	October 2011
1	September 2011
7	August 2011
1	July 2011
3	June 2011
1	May 2011
16	April 2011
2	March 2011
3	February 2011
3	January 2011
2	December 2010
13	November 2010
9	October 2010
10	September 2010
3	August 2010
4	July 2010
1	June 2010
9	April 2010
1	March 2010
11	February 2010
7	January 2010
10	December 2009
2	November 2009
1	October 2009
1	August 2009
12	July 2009
11	June 2009
8	May 2009
7	April 2009
38	March 2009
10	February 2009
19	January 2009
3	December 2008
16	November 2008
11	October 2008
2	September 2008
17	August 2008
18	July 2008
14	June 2008
16	May 2008
6	April 2008
7	March 2008
7	February 2008
37	January 2008
27	December 2007
12	November 2007
12	October 2007
3	September 2007
11	August 2007
12	July 2007
50	June 2007
7	May 2007
2	April 2007
12	March 2007
73	February 2007
32	January 2007
55	December 2006
61	November 2006
28	October 2006
37	September 2006
71	August 2006
18	July 2006
8	June 2006
6	May 2006
22	April 2006
97	March 2006
59	February 2006
111	January 2006
45	December 2005
45	November 2005
41	October 2005
54	September 2005
113	August 2005
107	July 2005
46	June 2005
27	May 2005
87	April 2005
163	March 2005
21	February 2005
30	January 2005
9	December 2004
73	November 2004
10	October 2004
4	September 2004
8	August 2004
62	June 2004
85	May 2004
35	April 2004
28	March 2004
15	February 2004
12	December 2003
21	November 2003
23	October 2003
246	September 2003
27	August 2003
16	July 2003
58	June 2003
22	May 2003
20	April 2003
36	March 2003
3	February 2003
31	January 2003
27	December 2002
56	November 2002
179	October 2002
67	September 2002
87	August 2002
92	July 2002
143	June 2002
87	May 2002
75	April 2002
1	March 2002

Design

Zawodny | Right Menu | Left Menu

Your Own Design

Paste the URL of your CSS below. Download CSS template