From owner-doc-jp-work@jp.FreeBSD.org Fri Aug  2 16:03:39 2002
Received: (from daemon@localhost)
	by castle.jp.FreeBSD.org (8.11.6+3.4W/8.11.3) id g7273dW21148;
	Fri, 2 Aug 2002 16:03:39 +0900 (JST)
	(envelope-from owner-doc-jp-work@jp.FreeBSD.org)
Received: from smtp.eos.ocn.ne.jp (eos.ocn.ne.jp [211.6.83.117])
	by castle.jp.FreeBSD.org (8.11.6+3.4W/8.11.3) with ESMTP/inet id g7273bn21137
	for <doc-jp-work@jp.FreeBSD.org>; Fri, 2 Aug 2002 16:03:37 +0900 (JST)
	(envelope-from hrs@eos.ocn.ne.jp)
Received: from mail.allbsd.org (p8065-adsah09hon-acca.tokyo.ocn.ne.jp [218.224.7.65])
	by smtp.eos.ocn.ne.jp (Postfix) with ESMTP id C3C291357
	for <doc-jp-work@jp.FreeBSD.org>; Fri,  2 Aug 2002 16:03:34 +0900 (JST)
Received: from localhost (alph.allbsd.org [192.168.0.10])
	by mail.allbsd.org (8.12.3/3.7W/DomainMaster) with ESMTP id g726nXLv070935
	for <doc-jp-work@jp.FreeBSD.org>; Fri, 2 Aug 2002 15:49:35 +0900 (JST)
	(envelope-from hrs@eos.ocn.ne.jp)
Date: Fri, 02 Aug 2002 15:47:01 +0900 (JST)
Message-Id: <20020802.154701.28469941.hrs@eos.ocn.ne.jp>
To: doc-jp-work@jp.FreeBSD.org
From: Hiroki Sato <hrs@eos.ocn.ne.jp>
In-Reply-To: <20020802.080957.105435807.rushani@bl.mmtr.or.jp>
References: <20020802.080957.105435807.rushani@bl.mmtr.or.jp>
X-Mailer: Mew version 2.2 on Emacs 20.7 / Mule 4.0 (HANANOEN)
Mime-Version: 1.0
Content-Type: Text/Plain; charset=iso-2022-jp
Content-Transfer-Encoding: 7bit
Reply-To: doc-jp-work@jp.FreeBSD.org
Precedence: list
X-Sequence: doc-jp-work 450
Subject: [doc-jp-work 450] Re: ANNOUNCE: FreeBSD Security Advisory
 FreeBSD-SA-02:34.rpc [REVISED]
Errors-To: owner-doc-jp-work@jp.FreeBSD.org
Sender: owner-doc-jp-work@jp.FreeBSD.org
X-Originator: hrs@eos.ocn.ne.jp
X-Distribute: distribute version 2.1 (Alpha) patchlevel 24e+020727

$B:4F#!wEl5~M}2JBg3X$G$9!#(B

 $B8eH>$O(B 02:33 $B$H$[$\0l=o$G$9!#(B

Hideyuki KURASHINA <rushani@bl.mmtr.or.jp> wrote
  in <20020802.080957.105435807.rushani@bl.mmtr.or.jp>:

rushani> Sun RPC is a remote procedure call framework which allows clients
rushani> to invoke procedures in a server process over a network somewhat
rushani> transparently.  XDR is a mechanism for encoding data structures for
rushani> use with RPC.  NFS, NIS, and many other network services are built
rushani> upon Sun RPC.
rushani> Sun RPC $B$O!"%M%C%H%o!<%/1[$7$K%/%i%$%"%s%H$X%5!<%P%W%m%;%9$X$N<jB3$-$r(B
rushani> $BF)2aE*$KMW5a$9$k$3$H$r2DG=$K$9$k%j%b!<%H%W%m%7!<%8%c%3!<%k%U%l!<%`%o!<%/$G$9!#(B
rushani> XDR $B$O(B RPC $B$NMxMQ$K:]$7$F%G!<%?9=B$$r%(%s%3!<%I$9$k$?$a$N5!9=$G$9!#(B
rushani> NFS$B!"(BNIS $B$=$7$FB>$N%M%C%H%o!<%/%5!<%S%9$NB?$/$,(B Sun RPC $B$r4pHW$H$7$F(B
rushani> $B@.$jN)$C$F$$$^$9!#(B

 hrs> Sun RPC $B$O!"%5!<%P%W%m%;%9$N%W%m%7!<%8%c$r!"%/%i%$%"%s%H$+$i(B
 hrs> $B%M%C%H%o!<%/7PM3$G$[$\F)2aE*$K8F$S=P$;$k$h$&$K$9$k$?$a$N!"(B
 hrs> $B%j%b!<%H%W%m%7!<%8%c%3!<%k%U%l!<%`%o!<%/$N0l$D$G$9!#(B
 hrs> XDR $B$O(B RPC $B$G;HMQ$5$l$k%G!<%?9=B$$N%(%s%3!<%IK!$G$9!#(B
 hrs> NFS, NIS $B$J$I$NB?$/$N%M%C%H%o!<%/%5!<%S%9$,!"(BSun RPC $B$rMxMQ$7$F$$$^$9!#(B

rushani> The FreeBSD C runtime library (libc) contains an XDR encoder/decoder
rushani> derived from Sun's RPC implementation.
rushani> FreeBSD C $B%i%s%?%$%`%i%$%V%i%j(B (libc) $B$K$O(B Sun $B<R$N(B RPC $B$N<BAu$KGI@8$7$?(B
rushani> XDR $B%(%s%3!<%@(B / $B%G%3!<%@$,4^$^$l$F$$$^$9!#(B

 s/$BGI@8(B/$BM3Mh(B/

rushani> An error in the calculation of memory needed for unpacking arrays in
rushani> the XDR decoder can result in a heap buffer overflow.
rushani> XDR $B%G%3!<%@$NCf$N$^$@E83+$5$l$F$$$J$$G[Ns$KI,MW$J%a%b%j$N7W;;$K$*$1$k(B
rushani> $B%(%i!<$,%R!<%W%P%C%U%!%*!<%P%U%m!<$K$D$J$,$k$3$H$,$"$j$^$9!#(B

 hrs> XDR $B%G%3!<%@$G$NG[Ns$N%"%s%Q%C%/=hM}$K;H$o$l$k%a%b%jNL$N7W;;$K!"(B
 hrs> $B%R!<%W%P%C%U%!%*!<%P%U%m!<$r0z$-5/$3$92DG=@-$N$"$k8m$j$,4^$^$l$F$$$^$9!#(B

rushani> Any application using Sun RPC may be vulnerable to the heap buffer
rushani> overflow.  Depending upon the application, this vulnerability may be
rushani> exploitable and lead to arbitrary code execution.
rushani> Sun RPC $B$rMxMQ$7$F$$$k%"%W%j%1!<%7%g%s$O%R!<%W%P%C%U%!%*!<%P%U%m!<$K(B
rushani> $BBP$7$F@H<e@-$r;}$D2DG=@-$,$"$j$^$9!#%"%W%j%1!<%7%g%s$K$h$C$F$O!"$3$N(B
rushani> $B@H<e@-$N$?$a$K0-MQ$5$l$k2DG=@-$,$"$j!"$=$7$FG$0U$N%3!<%I$r<B9T$5$l$k(B
rushani> $B$3$H$K$D$J$,$j$($^$9!#(B

 hrs> $B%"%W%j%1!<%7%g%s$K$h$C$F$O!"$3$N%;%-%e%j%F%#>e$N<eE@$r0-MQ$7$F(B
 hrs> $BG$0U$N%3!<%I$r<B9T$G$-$k4m81@-$,$"$j$^$9!#(B

rushani> Though no exploits are known to exist currently, many RPC-based
rushani> services run as the superuser (such as NFS, the NIS server, rpc.statd,
rushani> and others) and thus this vulnerability should be considered
rushani> high-risk.
rushani> $B:#$N$H$3$m!"0-MQJ}K!$H$7$FB8:_$9$k$b$N$O$"$j$^$;$s$,!"B?$/$N(B RPC $B$K(B
rushani> $B4p$E$$$?%5!<%S%9(B (NFS$B!"(BNIS $B%5!<%P!"(Brpc.statd $B$J$I(B) $B$O(B
rushani> $B%9!<%Q!<%f!<%68"8B$GF0:n$9$k$?$a!"$3$N@H<e@-$O9b$$4m81@-$r$O$i$s$G$$$k(B
rushani> $B$H$$$&$3$H$r9MN8$9$Y$-$G$9!#(B

 hrs> $B8=;~E@$G$O6qBNE*$J0-MQJ}K!$O3NG'$5$l$F$$$^$;$s$,!"(B(NFS, NIS $B%5!<%P!"(B
 hrs> rpc.statd $B$J$I$N(B) RPC $B%Y!<%9$N%5!<%S%9$NB?$/$O!"%9!<%Q%f!<%68"8B$G(B
 hrs> $BF0:n$7$F$$$^$9!#$=$N$?$a!"$3$N<eE@$OHs>o$K9b$$4m81@-$r;}$C$F$$$k$H(B
 hrs> $B9M$($k$Y$-$G$9!#(B

rushani> Do not run any RPC-based services.  The RPC-based services running
rushani> on a machine may be determined by:
rushani> RPC $B$K4p$E$$$?%5!<%S%9$rDs6!$9$k$N$r;_$a$F$/$@$5$$!#%^%7%s$N>e$G(B
rushani> $BDs6!$5$l$F$$$k(B RPC $B$K4p$E$$$?%5!<%S%9$O0J2<$N$h$&$K$7$F8!=P$9$k$3$H$,(B
rushani> $B$G$-$^$9(B:

 s/RPC $B$K4p$E$$$?(B/RPC $B%Y!<%9$N(B/g

 hrs> RPC $B%Y!<%9$N%5!<%S%9$r$9$Y$FDd;_$7$F$/$@$5$$!#<B9TCf$N(B RPC $B%Y!<%9$N%5!<%S%9$O!"(B
 hrs> $B<!$N$h$&$K$7$F3NG'$9$k$3$H$,$G$-$^$9!#(B

--
| $B:4F#(B $B9-@8!wEl5~M}2JBg3X(B <hrs@eos.ocn.ne.jp>
|                         <hrs@FreeBSD.org> (FreeBSD Project)
