Technical discussion regarding security issues in NetBSD

NetBSD Security Officer | 6 Jun 2012 23:40

Picon

NetBSD Security Advisory 2012-001: OpenSSL buffer overflow in DER read function


		NetBSD Security Advisory 2012-001
		=================================

Topic:		OpenSSL buffer overflow in DER read function

Version:	NetBSD-current:		source prior to Apr 20th, 2012
		NetBSD 6.0 Beta:	affected
		NetBSD 5.0.*:		affected
		NetBSD 5.0:		affected
		NetBSD 5.1:		affected
		NetBSD 4.0.*:		affected
		NetBSD 4.0:		affected

Severity:	remote DoS, information disclosure

Fixed:		NetBSD-current:		Apr 19th, 2012
		NetBSD 6.0 Beta:	Apr 23rd, 2012
		NetBSD-5-0 branch:	Apr 21st, 2012
		NetBSD-5-1 branch:	Apr 21st, 2012
		NetBSD-5 branch:	Apr 21st, 2012
		NetBSD-4-0 branch:	May 11th, 2012
		NetBSD-4 branch:	May 11th, 2012

Please note that NetBSD releases prior to 4.0 are no longer supported.
It is recommended that all users upgrade to a supported release.

Abstract
========

(Continue reading)

NetBSD Security Officer | 6 Jun 2012 23:41

Picon

NetBSD Security Advisory 2012-002: OpenSSL Invalid TLS/DTLS record attack


		NetBSD Security Advisory 2012-002
		=================================

Topic:		OpenSSL Invalid TLS/DTLS record attack

Version:	NetBSD-current:		source prior to May 12th, 2012
		NetBSD 6.0 Beta:	affected
		NetBSD 5.0.*:		affected
		NetBSD 5.0:		affected
		NetBSD 5.1:		affected
		NetBSD 4.0.*:		affected
		NetBSD 4.0:		affected

Severity:	remote DoS

Fixed:		NetBSD-current:		May 11th, 2012
		NetBSD 6.0 Beta:	May 22nd, 2012
		NetBSD-5-0 branch:	May 22nd, 2012
		NetBSD-5-1 branch:	May 22nd, 2012
		NetBSD-5 branch:	May 22nd, 2012
		NetBSD-4-0 branch:	May 22nd, 2012
		NetBSD-4 branch:	May 22nd, 2012

Please note that NetBSD releases prior to 4.0 are no longer supported.
It is recommended that all users upgrade to a supported release.

Abstract
========

(Continue reading)

iMil | 10 Jun 2012 12:54

IPSEC not routing back packets on NetBSD 6.0_BETA2


Hi,

I used to have a working IPSEC tunnel using base's racoon between my home
gateway and another server. This setup was working on NetBSD 5.1_STABLE,
and since I've migrated my gateway to NetBSD 6.0 this morning, it seems
there's some kind of routing problem.

The tunnel seems to be ok as the log shows,

On my gateway:

Jun 10 12:34:43 exar racoon: INFO: begin Identity Protection mode.
Jun 10 12:34:43 exar racoon: INFO: received Vendor ID: DPD
Jun 10 12:34:43 exar racoon: INFO: ISAKMP-SA established 
1.1.1.1[500]-2.2.2.2[500] 
spi:4589f12564960cc8:bf2c30c693c93570
Jun 10 12:34:44 exar racoon: INFO: initiate new phase 2 negotiation: 
1.1.1.1[500]<=>2.2.2.2[500]
Jun 10 12:34:44 exar racoon: INFO: IPsec-SA established: ESP/Tunnel 
1.1.1.1[500]->2.2.2.2[500] spi=226782882(0xd846ea2)
Jun 10 12:34:44 exar racoon: INFO: IPsec-SA established: ESP/Tunnel 
1.1.1.1[500]->2.2.2.2[500] spi=67783732(0x40a4c34)

On the remote server:

Jun 10 12:38:43 nadd racoon: INFO: respond new phase 1 negotiation: 
2.2.2.2[500]<=>1.1.1.1[500]
Jun 10 12:38:43 nadd racoon: INFO: begin Identity Protection mode.
Jun 10 12:38:43 nadd racoon: INFO: received Vendor ID: DPD

(Continue reading)

Michael van Elst | 10 Jun 2012 15:21

Picon

Re: IPSEC not routing back packets on NetBSD 6.0_BETA2

imil <at> home.imil.net (iMil) writes:

>I used to have a working IPSEC tunnel using base's racoon between my home
>gateway and another server.

>     authentication_algorithm hmac_sha256,hmac_sha1;

hmac_sha256 became incompatible.

-- 
--

-- 
                                Michael van Elst
Internet: mlelstv <at> serpens.de
                                "A potential Snark may lurk in every tree."

iMil | 10 Jun 2012 15:30

Re: IPSEC not routing back packets on NetBSD 6.0_BETA2


>>     authentication_algorithm hmac_sha256,hmac_sha1;
>
> hmac_sha256 became incompatible.

Fixed, and now works as expected. Thanks for the tip.

-------------------------------------------
Emile "iMil" Heitor .°. <imil <at> home.imil.net>                               _
                         http://gcu-squad.org        ASCII ribbon campaign ( )
                                                      - against HTML email  X
                                                                  & vCards / \

iMil | 10 Jun 2012 16:11

Re: IPSEC not routing back packets on NetBSD 6.0_BETA2


>> hmac_sha256 became incompatible.
>
> Fixed, and now works as expected. Thanks for the tip.

FWIW, NetBSD 6.0 racoon.conf manpage still says:

              authentication_algorithm algorithms;
                      des, 3des, des_iv64, des_iv32, hmac_md5, hmac_sha1,
                      hmac_sha256, hmac_sha384, hmac_sha512, non_auth (used
                      with ESP authentication and AH)

Where did you get that information? is it a well known fact?

-------------------------------------------
Emile "iMil" Heitor .°. <imil <at> home.imil.net>                               _
                         http://gcu-squad.org        ASCII ribbon campaign ( )
                                                      - against HTML email  X
                                                                  & vCards / \

Michael van Elst | 10 Jun 2012 19:26

Picon

Re: IPSEC not routing back packets on NetBSD 6.0_BETA2

imil <at> home.imil.net (iMil) writes:

>-----BEGIN PGP SIGNED MESSAGE-----
>Hash: SHA1

>>> hmac_sha256 became incompatible.
>>
>> Fixed, and now works as expected. Thanks for the tip.

>FWIW, NetBSD 6.0 racoon.conf manpage still says:

>              authentication_algorithm algorithms;
>                      des, 3des, des_iv64, des_iv32, hmac_md5, hmac_sha1,
>                      hmac_sha256, hmac_sha384, hmac_sha512, non_auth (used
>                      with ESP authentication and AH)

>Where did you get that information? is it a well known fact?

I got hit by it too.

The change is a bit older:

http://mail-index.netbsd.org/source-changes/2011/02/25/msg019329.html

but you only saw it if you built a kernel with FAST_IPSEC. Since netbsd-6
went to use FAST_IPSEC instead of the old KAME code, it is now also
standards compliant but will not interoperate with netbsd-5 or older
if you use hmac_sha256.

--

--

(Continue reading)

NetBSD Security Officer | 14 Jun 2012 11:52

Picon

NetBSD Security Advisory 2012-003: Intel processors sysret to non-canonical address behaviour


		NetBSD Security Advisory 2012-003
		=================================

Topic:		Intel processors sysret to non-canonical address behaviour

Version:	NetBSD-current:		source prior to June 11, 2012
		NetBSD 6.0 Beta:	affected
		NetBSD 5.1.*:		affected
		NetBSD 5.1:		affected
		NetBSD 5.0.*:		affected
		NetBSD 5.0:		affected
		NetBSD 4.0.*:		affected
		NetBSD 4.0:		affected

Severity:	local DoS, possibly local user privilege escalation

Fixed:		NetBSD-current:		June 12th, 2012
		NetBSD-6 branch:	June 12th, 2012
		NetBSD-5 branch:	June 12th, 2012
		NetBSD-5-1 branch:	June 12th, 2012
		NetBSD-5-0 branch:	June 12th, 2012
		NetBSD-4 branch:	June 12th, 2012
		NetBSD-4-0 branch:	June 12th, 2012

Please note that NetBSD releases prior to 4.0 are no longer supported.
It is recommended that all users upgrade to a supported release.

Abstract
========

(Continue reading)

Jean-Yves Migeon | 25 Jun 2012 20:24

Picon

crypto_memset (was: Re: Zero it if you're going to copy it out.)

On 25.06.2012 15:20, Thor Lancelot Simon wrote:
> On Mon, Jun 25, 2012 at 02:16:33PM +0100, Roger Pau Monne wrote:
>>
>> Yes, it doesn't hurt to zero memory if returning it to the user. Who
>> knows what might be there previously.
> 
> I'm sorry, I can't let this go.
> 
> This is not a case of "it doesn't hurt" -- it's a case of "it's absolutely
> necessary".  It is completely unacceptable to leak the contents of kernel
> memory to the user!

BTW, did we get the {crypto,safe,secure}:
_memset: not optimized by compiler away,
_memcmp: constant-time memcmp for a given size

? I can't find anything in the commit logs.

I am sure these will find their place in the kernel, and also in some
places in userland (except for cache manipulation, maybe).

--

-- 
Jean-Yves Migeon
jeanyves.migeon <at> free.fr

Matthias Drochner | 26 Jun 2012 20:51

Picon

Picon

Re: crypto_memset (was: Re: Zero it if you're going to copy it out.)


> BTW, did we get the {crypto,safe,secure}:
> _memset: not optimized by compiler away,
> _memcmp: constant-time memcmp for a given size

I have an implementation of explicit_bzero in my tree.
The name is from OpenBSD. It certainly makes sense to
use a bzero-like API because there is no need to carry
the '0' fill pattern around.
Didn't commit because someone suggested to use memset_s
(from C1x Annex K).

> I am sure these will find their place in the kernel,
> and also in some places in userland

While my implementation lives in src/common, I've only
used it from userland so far because I've found that
the compiler didn't optimize out memset calls in the
kernel even where it could, probably due to optimization
switches. It should certainly be used in the kernel
as well, to avoid surprises in future.
Is anyone working on C1x Annex K support?

best regards
Matthias

------------------------------------------------------------------------------------------------
------------------------------------------------------------------------------------------------
Forschungszentrum Juelich GmbH
52425 Juelich

(Continue reading)

Group

gmane.os.netbsd.devel.security.

Search Archive

Page

1 | 2

Articles in period: 12

June 2012

Language

Change language

Options

Current view: Threads only / Showing only 20 lines / Not hiding cited text.
Change to All messages, whole messages, or hide cited text.

Post a message
NNTP Newsgroup
Classic Gmane web interface
XML

XML

RSS Feed
List Information

About Gmane

Recent entries

[GSoC 2013] Implement file system flags to scrub data blocks before de (30 Apr 2013)
regarding project to"Implement file system flags to scrub data blocks (14 Apr 2013)
Google Summer of Code 2013. (13 Apr 2013)
OpenCrypto swcrypto(4) enhancements (10 Apr 2013)
NetBSD Security Advisory 2013-003: RNG Bug May Result in Weak Cryptogr (30 Mar 2013)
ECDSA and key leaks due to RNG problems. (25 Mar 2013)
Updated NetBSD Security Advisory 2013-003: RNG Bug May Result in Weak (7 Mar 2013)
NetBSD Security Advisory 2013-003: Pseudo-Random bits weaker than expe (27 Feb 2013)
NetBSD Security Advisory 2013-004: Vulnerabilities in grep (27 Feb 2013)
NetBSD Security Advisory 2013-002: kqueue related kernel panic trigger (27 Feb 2013)
You have (1) new ecard! (26 Feb 2013)
You have (1) new ecard! (8 Feb 2013)
Invitation to Bid - Jared #2528 - Evansville, IN (30 Jan 2013)
Notice of Addendum #: 1 - Oregon Park District (29 Jan 2013)
Invitation to Bid - Spencer Gifts #205 - St. Clair Square (29 Jan 2013)
NetBSD Security Advisory 2013-001: kernel panic triggered from userlan (29 Jan 2013)
Your Blue Book Network Project Leads ( MREF#188430675 ) (27 Jan 2013)
� Last day to save on our website presence package (25 Jan 2013)
Analyst Report: Understanding Responsive Design (25 Jan 2013)
Your Blue Book Network Project Leads ( MREF#188213540 ) (24 Jan 2013)
Invitation to Bid - Fuzzy's Taco (24 Jan 2013)

Archives

2	May 2013
6	April 2013
3	March 2013
6	February 2013
16	January 2013
6	December 2012
28	November 2012
6	October 2012
4	September 2012
2	August 2012
20	July 2012
12	June 2012
4	May 2012
4	April 2012
10	March 2012
16	December 2011
2	November 2011
2	October 2011
1	September 2011
7	August 2011
1	July 2011
3	June 2011
1	May 2011
16	April 2011
2	March 2011
3	February 2011
3	January 2011
2	December 2010
13	November 2010
9	October 2010
10	September 2010
3	August 2010
4	July 2010
1	June 2010
9	April 2010
1	March 2010
11	February 2010
7	January 2010
10	December 2009
2	November 2009
1	October 2009
1	August 2009
12	July 2009
11	June 2009
8	May 2009
7	April 2009
38	March 2009
10	February 2009
19	January 2009
3	December 2008
16	November 2008
11	October 2008
2	September 2008
17	August 2008
18	July 2008
14	June 2008
16	May 2008
6	April 2008
7	March 2008
7	February 2008
37	January 2008
27	December 2007
12	November 2007
12	October 2007
3	September 2007
11	August 2007
12	July 2007
50	June 2007
7	May 2007
2	April 2007
12	March 2007
73	February 2007
32	January 2007
55	December 2006
61	November 2006
28	October 2006
37	September 2006
71	August 2006
18	July 2006
8	June 2006
6	May 2006
22	April 2006
97	March 2006
59	February 2006
111	January 2006
45	December 2005
45	November 2005
41	October 2005
54	September 2005
113	August 2005
107	July 2005
46	June 2005
27	May 2005
87	April 2005
163	March 2005
21	February 2005
30	January 2005
9	December 2004
73	November 2004
10	October 2004
4	September 2004
8	August 2004
62	June 2004
85	May 2004
35	April 2004
28	March 2004
15	February 2004
12	December 2003
21	November 2003
23	October 2003
246	September 2003
27	August 2003
16	July 2003
58	June 2003
22	May 2003
20	April 2003
36	March 2003
3	February 2003
31	January 2003
27	December 2002
56	November 2002
179	October 2002
67	September 2002
87	August 2002
92	July 2002
143	June 2002
87	May 2002
75	April 2002
1	March 2002

Design

Zawodny | Right Menu | Left Menu

Your Own Design

Paste the URL of your CSS below. Download CSS template