From owner-doc-jp-work@jp.FreeBSD.org Tue Aug  6 14:24:39 2002
Received: (from daemon@localhost)
	by castle.jp.FreeBSD.org (8.11.6+3.4W/8.11.3) id g765OdM81421;
	Tue, 6 Aug 2002 14:24:39 +0900 (JST)
	(envelope-from owner-doc-jp-work@jp.FreeBSD.org)
Received: from TYO201.gate.nec.co.jp (TYO201.gate.nec.co.jp [202.32.8.214])
	by castle.jp.FreeBSD.org (8.11.6+3.4W/8.11.3) with ESMTP/inet id g765Ocn81416;
	Tue, 6 Aug 2002 14:24:38 +0900 (JST)
	(envelope-from y-koga@jp.FreeBSD.org)
Received: from mailgate4.nec.co.jp ([10.7.69.193])
	by TYO201.gate.nec.co.jp (8.11.6/3.7W01080315) with ESMTP id g765ObS14204;
	Tue, 6 Aug 2002 14:24:37 +0900 (JST)
Received: from mailsv4.nec.co.jp (mailgate51.nec.co.jp [10.7.69.190]) by mailgate4.nec.co.jp (8.11.6/3.7W-MAILGATE-NEC) with ESMTP
	id g765Obp04523; Tue, 6 Aug 2002 14:24:37 +0900 (JST)
Received: from necspl.do.mms.mt.nec.co.jp (necspl.do.mms.mt.nec.co.jp [10.16.5.21]) by mailsv4.nec.co.jp (8.11.6/3.7W-MAILSV4-NEC) with ESMTP
	id g765OaG07323; Tue, 6 Aug 2002 14:24:36 +0900 (JST)
Received: from localhost (localhost [IPv6:::1])
	by  necspl.do.mms.mt.nec.co.jp (8.12.5/8.12.5) with ESMTP id g765Oa3A004998;
	Tue, 6 Aug 2002 14:24:36 +0900 (JST)
Date: Tue, 06 Aug 2002 14:24:35 +0900 (JST)
Message-Id: <20020806.142435.59717401.y-koga@jp.FreeBSD.org>
To: doc-jp-work@jp.FreeBSD.org
From: Koga Youichirou <y-koga@jp.FreeBSD.org>
In-Reply-To: <20020806.131559.31696474.hrs@eos.ocn.ne.jp>
References: <200208052348.g75NmbIS097274@freefall.freebsd.org>
	<20020806.131559.31696474.hrs@eos.ocn.ne.jp>
X-Mailer: Mew version 3.0.60 on Emacs 21.2 / Mule 5.0 (SAKAKI)
Mime-Version: 1.0
Content-Type: Text/Plain; charset=iso-2022-jp
Content-Transfer-Encoding: 7bit
Reply-To: doc-jp-work@jp.FreeBSD.org
Precedence: list
X-Sequence: doc-jp-work 461
Subject: [doc-jp-work 461] Re: ANNOUNCE: FreeBSD Security Advisory
 FreeBSD-SA-02:35.ffs
Errors-To: owner-doc-jp-work@jp.FreeBSD.org
Sender: owner-doc-jp-work@jp.FreeBSD.org
X-Originator: y-koga@jp.FreeBSD.org
X-Distribute: distribute version 2.1 (Alpha) patchlevel 24e+020727

Hiroki Sato <hrs@eos.ocn.ne.jp>:
>  02:35 $B$G$9!#(B

$B$Q$A$Q$A$Q$A!y(B

> =============================================================================
> FreeBSD-SA-02:35.ffs                                        Security Advisory
- snip -
> II.  $BLdBj$N>\:Y(B - Problem Description
> 
> A bug in the calculation of the maximum permitted FFS file size
> allows users to create files that are larger than FreeBSD's virtual
> memory system can handle.
> $BM-8z$J:GBg(B FFS $B%U%!%$%k%5%$%:$N7W;;=hM}$K%P%0$,$"$j!"%f!<%6$O(B
> FreeBSD $B$N2>A[%a%b%j%7%9%F%`$,4IM}2DG=$JBg$-$5$rD6$($k%U%!%$%k$r(B
> $B:n@.$9$k$3$H$,2DG=$G$9!#(B

FFS $B$K$*$1$k:GBg5vMF%U%!%$%k%5%$%:$N7W;;$K%P%0$,$"$j!"!D(B
$B2>A[%a%b%j%7%9%F%`$,=h$&$3$H$,$G$-$k$h$j$bBg$-$J%U%!%$%k$r!D(B

# $B$?$$$7$FJQ$o$i$J$$$+!#(B

> The integer overflows that result when such
> files are accessed may map filesystem metadata into the user file,
> permitting access to arbitrary filesystem blocks.
> $B$=$N$h$&$J%U%!%$%k$X%"%/%;%9$7$?>l9g!"(B
> $B@0?t$N%*!<%P%U%m!<$,H/@8$7!"%U%!%$%k%7%9%F%`$N%a%?%G!<%?$,(B
> $B%f!<%6%U%!%$%kCf$K%^%C%W$5$l$F$7$^$$$^$9!#$3$l$rMxMQ$9$k$H!"(B
> $B%U%!%$%k%7%9%F%`$NG$0U$N%V%m%C%/$K%"%/%;%9$9$k$3$H$,2DG=$K$J$j$^$9!#(B

integer overflow $B$O(B integer overflow $B0J30$N8F$SJ}$r$7$?$/$J$$$J$!!#(B
$B!V@0?t$N%*!<%P%U%m!<!W$@$H%$%^%5%s$/$i$$!#!V(Bint $B7?%G!<%?$N%*!<%P%U%m!<!W(B
$B$H$7$F$b%$%^%$%A(B (int $B$8$c$J$/$F(B u_int64_t $B$@$7(B)$B!#(B

> III. $B1F6AHO0O(B - Impact
> 
> Local attackers may cause a denial of service by simply corrupting the
> filesystem.  A local attacker may also be able to read and write
> arbitrary files on local filesystems, allowing them to gain superuser
> privileges.
> $B%m!<%+%k$N967b<T$O!"%U%!%$%k%7%9%F%`$rGK2u$7$F%5!<%S%9K832$r(B
> $B<B8=$9$k$3$H$,2DG=$G$9!#$^$?!"%m!<%+%k%U%!%$%k%7%9%F%`$N(B
> $BG$0U$N%U%!%$%k$KFI$_=q$-%"%/%;%9$9$k$3$H$,$G$-$k$?$a!"(B
> $B%9!<%Q%f!<%68"8B$rIT@5$KF~<j$G$-$k2DG=@-$,$"$j$^$9!#(B

$B!V%5!<%S%9K832$r<B8=!W$h$j$b!V%5!<%S%9K832$r(B($B9T$J$&(B|$B5/$3$9(B|$B0z$-5/$3$9(B)$B!W(B
$B$+$J!#$"$H!"(Bsimply $B$rLu$7$?$$$H$3$m$G$9!#(B

# $B$G$b!"%U%!%$%k%7%9%F%`$rGK2u$9$k$C$F0lBN!D(B

$B!V$G$-$k$?$a!W$,K\Ev$+$I$&$+$OCN$j$^$;$s$,!"(Bmay $B$r!V2DG=@-$,$"$k!W$H$7(B
$B$F!V$G$-$k2DG=@-$,$"$k!W$/$i$$$J5$$,$7$^$9$,$I$&$G$7$g$&(B?

# $B$J$s$H$J$/$G$-$k$h$&$J5$$O$9$k$1$I!"<B>Z$5$l$F$J$$$HJ,$+$i$J$$!#(B

> FFS filesystems with a block size less than 16k (on the i386
> architecture) or 32k (on the alpha architecture), such as those
> created using the default FFS filesystem block size prior to
> 4.5-RELEASE, are not vulnerable.
> 4.5-RELEASE $B$h$jA0$K;H$o$l$F$$$?(B FFS $B%U%!%$%k%7%9%F%`$N(B
> $B%G%U%)%k%H%V%m%C%/%5%$%:$r;H$C$F:n@.$5$l$?(B FFS $B%U%!%$%k%7%9%F%`$J$I!"(B
> FFS $B%U%!%$%k%7%9%F%`$N%V%m%C%/%U%!%$%k%5%$%:$,(B 16k $B%P%$%HL$K~(B
> (i386 $B%"!<%-%F%/%A%c$N>l9g(B)$B!"$"$k$$$O(B 32k $B%P%$%HL$K~(B (alpha
> $B%"!<%-%F%/%A%c$N>l9g(B) $B$K$O!"$3$NLdBj$N1F6A$O$"$j$^$;$s!#(B

$B!D$N$h$&$K!"%V%m%C%/%5%$%:$,!D$N(B FFS $B%U%!%$%k%7%9%F%`$K$O!"$3$NLdBj$N!D(B

> IV.  $B2sHrJ}K!(B - Workaround
- snip -
> It is the responsibility of applications such as `login' and `sshd' to
> read and honor login.conf.
> $B%"%W%j%1!<%7%g%s$N;}$C$F$$$k5!G=$G$9!#(B

s/$BFI$_9~$_@_Dj$r(B/$BFI$_9~$_!"@_Dj$r(B/

> V.   $B2r7h:v(B - Solution
> 
> 1) Upgrade your vulnerable system to 4.6-STABLE; or to any of the
> RELENG_4_6 (4.6.1-RELEASE-p5), RELENG_4_5 (4.5-RELEASE-p14), or
> RELENG_4_4 (4.4-RELEASE-p21) security branches dated after the
> respective correction dates.
> 1) $B<eE@$r;}$C$?(B FreeBSD $B%7%9%F%`$r=$@5F|0J9_$N(B 4.6-STABLE $B$K(B
>    $B%"%C%W%0%l!<%I$9$k$+!"$b$7$/$O(B RELENG_4_6 (4.6.1-RELEASE-p5)$B!"(B
>    RELENG_4_5 (4.5-RELEASE-p14)$B!"(BRELENG_4_4 (4.4-RELEASE-p21)
>    $B%;%-%e%j%F%#%V%i%s%A$N$$$:$l$+$K%"%C%W%0%l!<%I$9$k!#(B

4.6-STABLE $B$K$D$$$F$O!V=$@5F|0J9_$N!W$H$$$&=$>~$O$+$+$i$J$$$h$&$K(B
$B;W$$$^$9(B ($B%;%_%3%m%s$O6/$$(B)$B!#$H$O$$$(!"$=$l$G$OFI<T$O8m2r$9$k$N$G!"(B
$B!V=$@5F|0J9_$N!W$r$3$A$i$K$b$+$1$k$+!"!V:G?7$N!W$/$i$$$K$7$F$*$1$P$$$$(B
$B$s$@$H;W$$$^$9!#(B

$B$^$?!"(BRELENG_4_x $B$N%;%-%e%j%F%#%V%i%s%A$K$D$$$F$O$b$A$m$s!V=$@5F|0J9_(B
$B$N!W$,$+$+$j$^$9$,!"Lu$G$O$=$l$,%$%^%$%AFI$a$^$;$s(B ($B!V$b$7$/$O!W$G@Z$l(B
$B$F$$$k$N$G(B)$B!#$A$g$C$H9)IW$,MW$j$=$&$G$9!#(B
----
$B$3$,$h$&$$$A$m$&(B
