Technical discussion regarding security issues in NetBSD

NetBSD Security Officer | 8 Jul 2009 06:45

Picon

NetBSD Security Advisory 2009-008: OpenSSL ASN1 parsing denial of service and CMS signature verification weakness


		 NetBSD Security Advisory 2009-008
		 =================================

Topic:		OpenSSL ASN1 parsing denial of service and CMS
		signature verification weakness

Version:	NetBSD-current:		affected prior to 2009-03-27
		NetBSD 5.0:		not affected
		NetBSD 4.0.*:		affected
		NetBSD 4.0:		affected
		pkgsrc:			openssl package prior to 0.9.8k

Severity:	Denial of Service, Forgery of CMS signatures

Fixed:		NetBSD-current:		May 27, 2009
		NetBSD-4 branch:	July 4, 2009 (4.1 will include the fix)
		NetBSD-4-0 branch:	July 4, 2009 (4.0.2 will include the fix)
		pkgsrc 2009Q1:		openssl-0.9.8k corrects this issue

Please note that NetBSD releases prior to 4.0, as well as the pre-release
versions of NetBSD 5.0, are no longer supported. It is recommended that
all users upgrade to a supported release.

Abstract
========

A handling error in the ASN1 parser functions can cause an
application linked against libcrypto to crash. Another
vulnerability in the CMS signature verification algorithm

(Continue reading)

NetBSD Security Officer | 8 Jul 2009 06:46

Picon

NetBSD Security Advisory 2009-009: OpenSSL DTLS Memory Exhaustion and DSA signature verification vulnerabilities


		 NetBSD Security Advisory 2009-009
		 =================================

Topic:		OpenSSL DTLS Memory Exhaustion and DSA signature
		verification vulnerabilities

Version:	NetBSD-current:		affected prior to 2009-07-04
		NetBSD 5.0:		affected
		NetBSD 4.0.*:		affected
		NetBSD 4.0:		affected
		pkgsrc:			openssl package prior to 0.9.8j

Severity:	Denial of Service, DSA signature spoofing

Fixed:		NetBSD-current:		July 4, 2009
		NetBSD-5-0 branch:	July 4, 2009 (NetBSD 5.0.1 will include the fix)
		NetBSD-5 branch:	July 4, 2009 (NetBSD 5.1 will include the fix)
		NetBSD-4-0 branch:	July 4, 2009 (NetBSD 4.0.2 will include the fix)
		NetBSD-4 branch:	July 4, 2009 (NetBSD 4.1 will include the fix)
		pkgsrc 2009Q1:		openssl-0.9.8j corrects this issue

Please note that NetBSD releases prior to 4.0 are no longer supported.
It is recommended that all users upgrade to a supported release.

Abstract
========

Two range check errors in the DTLS code allow a remote attacker
to exhaust memory by executing too many out of sequence handshakes

(Continue reading)

NetBSD Security Officer | 14 Jul 2009 23:31

Picon

NetBSD Security Advisory 2009-010: ISC dhclient subnet-mask flag stack overflow


		 NetBSD Security Advisory 2009-010
		 =================================

Topic:		ISC dhclient subnet-mask flag stack overflow

Version:	NetBSD-current:		affected before June 24, 2009
		NetBSD 5.0:		affected
		NetBSD 4.0.*:		affected
		NetBSD 4.0:		affected
		pkgsrc:			isc-dhclient package prior to
					4.1.0p1, 4.0.1p1, or 3.1.2p1

Severity:	Arbitrary Code Execution

Fixed:		NetBSD-current:		June 24, 2009
		NetBSD-5-0 branch:	July 14, 2009 20:00 UTC
		NetBSD-5 branch:	July 14, 2009 20:00 UTC
		NetBSD-4-0 branch:	July 14, 2009 20:00 UTC
		NetBSD-4 branch:	July 14, 2009 20:00 UTC
		pkgsrc 2009Q2:		isc-dhclient-4.1.0p1, 4.0.1p1 and
					3.1.2p1 correct the issue

Abstract
========

A stack overflow vulnerability in ISC dhclient allows an attacker
operating a rogue DHCP server to execute arbitrary code with root
privileges on the affected system by supplying a specially crafted
subnet-mask parameter.

(Continue reading)

Taylor R Campbell | 17 Jul 2009 22:39

Re: NetBSD Security Advisory 2009-009: OpenSSL DTLS Memory Exhaustion and DSA signature verification vulnerabilities

I learned the hard way when following these instructions *not* to
additionally update src/lib/libcrypto, which, in combination with the
installation of the freshly built libraries, rendered su(1) broken.
Fortunately I found a root shell prompt among my screens, so I was
able to diagnose and work around the problem.

The problem was that Updating src/lib/libcrypto brought in Joerg
Sonnenberger's change to make libcrypto use libc's new SHA-224
implementation -- but since I had not also installed a new libc,
loading any object linked against libcrypto would fail.

This makes me wonder, though: how sensitive are the security advisory
instructions to changes in the CVS tree?  If this vulnerability had
required a change in src/lib/libcrypto, and the instructions said to
update src/lib/libcrypto, would that have stopped Joerg Sonnenberger
from making libcrypto use libc's new SHA-224 implementation?  Is it
recommended instead just to update the entire tree whenever these
things come out, rather than parts of the tree incrementally?

Tonnerre LOMBARD | 18 Jul 2009 16:36

Picon

Re: NetBSD Security Advisory 2009-009: OpenSSL DTLS Memory Exhaustion and DSA signature verification vulnerabilities

Salut,

On Fri, Jul 17, 2009 at 04:39:13PM -0400, Taylor R Campbell wrote:
> The problem was that Updating src/lib/libcrypto brought in Joerg
> Sonnenberger's change to make libcrypto use libc's new SHA-224
> implementation -- but since I had not also installed a new libc,
> loading any object linked against libcrypto would fail.

I guess so, but I don't think we can guarantee that the instructions
of an advisory won't "go bad" due to a separate advisory (which will
be issued soon, by the way).

I think the binary updates I was working on would solve this problem,
but due to too many demands on various sides ("You must send full file
replacements", "You must use PGP, not SSL") I had to put this project
in the fridge until I have time to take care of them all.

				Tonnerre

NetBSD Security Officer | 28 Jul 2009 23:51

Picon

NetBSD Security Advisory 2009-011: ISC DHCP server Denial of Service vulnerability


		 NetBSD Security Advisory 2009-011
		 =================================

Topic:		ISC DHCP server Denial of Service vulnerability

Version:	NetBSD-current:		affected prior to 2009-07-16
		NetBSD 5.0:		affected
		NetBSD 4.0.*:		affected
		NetBSD 4.0:		affected
		pkgsrc:			isc-dhcpd package prior to 3.1.1p1

Severity:	Denial of Service

Fixed:		NetBSD-current:		Jul 16, 2009
		NetBSD-5-0 branch:	Jul 17, 2009
		NetBSD-5 branch:	Jul 17, 2009
		NetBSD-4-0 branch:	Jul 17, 2009
		NetBSD-4 branch:	Jul 17, 2009
		pkgsrc 2009Q2:		isc-dhcpd-3.1.1p1 corrects this issue

Please note that NetBSD releases prior to 4.0 are no longer supported.
It is recommended that all users upgrade to a supported release.

Abstract
========

A reference counting error in dhcpd allows a remote attacker to cause
a daemon crash by submitting requests with the same client ID on
different interfaces served by the same daemon.

(Continue reading)

NetBSD Security Officer | 28 Jul 2009 23:52

Picon

NetBSD Security Advisory 2009-012: SHA2 implementation potential buffer overflow


		 NetBSD Security Advisory 2009-012
		 =================================

Topic:		SHA2 implementation potential buffer overflow

Version:	NetBSD-current:		affected prior to 2009-05-26
		NetBSD 5.0:		affected
		NetBSD 4.0.*:		affected
		NetBSD 4.0:		affected

Severity:	Denial of Service

Fixed:		NetBSD-current:		May 26, 2009
		NetBSD-5-0 branch:	Jul 11, 2009
		NetBSD-5 branch:	Jul 11, 2009
		NetBSD-4-0 branch:	Jul 22, 2009
		NetBSD-4 branch:	Jul 22, 2009

Please note that NetBSD releases prior to 4.0 are no longer supported.
It is recommended that all users upgrade to a supported release.

Abstract
========

An error initializing a SHA2 context causes vulnerable applications using
libcrypto to suffer from a 4- or 8-byte buffer overflow (for SHA256 and
SHA512 correspondingly) with fixed content, potentially causing
applications to crash.

(Continue reading)

NetBSD Security Officer | 29 Jul 2009 09:30

Picon

NetBSD Security Advisory 2009-013: BIND named dynamic update Denial of Service vulnerability


		 NetBSD Security Advisory 2009-013
		 =================================

Topic:		BIND named dynamic update Denial of Service vulnerability

Version:	NetBSD-current:		affected prior to 2009-07-29
		NetBSD 5.0:		affected
		NetBSD 4.0.*:		affected
		NetBSD 4.0:		affected
		pkgsrc:			bind package prior to 9.5.1pl3 and 9.6.1pl1

Severity:	Denial of Service

Fixed:		NetBSD-current:		July 28, 2009 21:13 UTC
		NetBSD-5-0 branch:	July 28, 2009 22:26 UTC
		NetBSD-5 branch:	July 28, 2009 22:26 UTC
		NetBSD-4-0 branch:	July 28, 2009 22:19 UTC
		NetBSD-4 branch:	July 28, 2009 22:19 UTC
		pkgsrc 2009Q2:		bind-9.5.1pl3 and bind-9.6.1pl1 corrects this issue

Please note that NetBSD releases prior to 4.0 are no longer supported.
It is recommended that all users upgrade to a supported release.

Abstract
========

An assertion failure in the Berkeley Internet Name Domain server
software shipped in NetBSD can be used by a remote attacker to
cause the server process to crash by sending specially crafted

(Continue reading)

Darren Reed | 30 Jul 2009 07:49

Picon

sshd_config and pam...

I don't know if this is known or not, but it appears that enabling PAM
in your sshd_conf file makes entries such as "PasswordAuthentication"
meaningless. With PAM enabled, I was able to login with ssh using a
password even with the aforementioned setting at "no".

Is it worthwhile adding some sort of warning to sshd that spits out a
message of some sort about this if UsePAM is set to yes and there
are other authentication driven directives present and not commented
out?

Darren

Soren Jacobsen | 30 Jul 2009 08:07

Picon

Re: sshd_config and pam...

On Jul 29, 2009, at 10:49 PM, Darren Reed wrote:

> I don't know if this is known or not

http://www.NetBSD.org/cgi-bin/query-pr-single.pl?number=32313

Group

gmane.os.netbsd.devel.security.

Search Archive

Page

1 | 2

Articles in period: 12

July 2009

Language

Change language

Options

Current view: Threads only / Showing only 20 lines / Not hiding cited text.
Change to All messages, whole messages, or hide cited text.

Post a message
NNTP Newsgroup
Classic Gmane web interface
XML

XML

RSS Feed
List Information

About Gmane

Recent entries

[GSoC 2013] Implement file system flags to scrub data blocks before de (30 Apr 2013)
regarding project to"Implement file system flags to scrub data blocks (14 Apr 2013)
Google Summer of Code 2013. (13 Apr 2013)
OpenCrypto swcrypto(4) enhancements (10 Apr 2013)
NetBSD Security Advisory 2013-003: RNG Bug May Result in Weak Cryptogr (30 Mar 2013)
ECDSA and key leaks due to RNG problems. (25 Mar 2013)
Updated NetBSD Security Advisory 2013-003: RNG Bug May Result in Weak (7 Mar 2013)
NetBSD Security Advisory 2013-003: Pseudo-Random bits weaker than expe (27 Feb 2013)
NetBSD Security Advisory 2013-004: Vulnerabilities in grep (27 Feb 2013)
NetBSD Security Advisory 2013-002: kqueue related kernel panic trigger (27 Feb 2013)
You have (1) new ecard! (26 Feb 2013)
You have (1) new ecard! (8 Feb 2013)
Invitation to Bid - Jared #2528 - Evansville, IN (30 Jan 2013)
Notice of Addendum #: 1 - Oregon Park District (29 Jan 2013)
Invitation to Bid - Spencer Gifts #205 - St. Clair Square (29 Jan 2013)
NetBSD Security Advisory 2013-001: kernel panic triggered from userlan (29 Jan 2013)
Your Blue Book Network Project Leads ( MREF#188430675 ) (27 Jan 2013)
� Last day to save on our website presence package (25 Jan 2013)
Analyst Report: Understanding Responsive Design (25 Jan 2013)
Your Blue Book Network Project Leads ( MREF#188213540 ) (24 Jan 2013)
Invitation to Bid - Fuzzy's Taco (24 Jan 2013)

Archives

2	May 2013
6	April 2013
3	March 2013
6	February 2013
16	January 2013
6	December 2012
28	November 2012
6	October 2012
4	September 2012
2	August 2012
20	July 2012
12	June 2012
4	May 2012
4	April 2012
10	March 2012
16	December 2011
2	November 2011
2	October 2011
1	September 2011
7	August 2011
1	July 2011
3	June 2011
1	May 2011
16	April 2011
2	March 2011
3	February 2011
3	January 2011
2	December 2010
13	November 2010
9	October 2010
10	September 2010
3	August 2010
4	July 2010
1	June 2010
9	April 2010
1	March 2010
11	February 2010
7	January 2010
10	December 2009
2	November 2009
1	October 2009
1	August 2009
12	July 2009
11	June 2009
8	May 2009
7	April 2009
38	March 2009
10	February 2009
19	January 2009
3	December 2008
16	November 2008
11	October 2008
2	September 2008
17	August 2008
18	July 2008
14	June 2008
16	May 2008
6	April 2008
7	March 2008
7	February 2008
37	January 2008
27	December 2007
12	November 2007
12	October 2007
3	September 2007
11	August 2007
12	July 2007
50	June 2007
7	May 2007
2	April 2007
12	March 2007
73	February 2007
32	January 2007
55	December 2006
61	November 2006
28	October 2006
37	September 2006
71	August 2006
18	July 2006
8	June 2006
6	May 2006
22	April 2006
97	March 2006
59	February 2006
111	January 2006
45	December 2005
45	November 2005
41	October 2005
54	September 2005
113	August 2005
107	July 2005
46	June 2005
27	May 2005
87	April 2005
163	March 2005
21	February 2005
30	January 2005
9	December 2004
73	November 2004
10	October 2004
4	September 2004
8	August 2004
62	June 2004
85	May 2004
35	April 2004
28	March 2004
15	February 2004
12	December 2003
21	November 2003
23	October 2003
246	September 2003
27	August 2003
16	July 2003
58	June 2003
22	May 2003
20	April 2003
36	March 2003
3	February 2003
31	January 2003
27	December 2002
56	November 2002
179	October 2002
67	September 2002
87	August 2002
92	July 2002
143	June 2002
87	May 2002
75	April 2002
1	March 2002

Design

Zawodny | Right Menu | Left Menu

Your Own Design

Paste the URL of your CSS below. Download CSS template