From owner-doc-jp-work@jp.FreeBSD.org Wed Aug  7 18:18:17 2002
Received: (from daemon@localhost)
	by castle.jp.FreeBSD.org (8.11.6+3.4W/8.11.3) id g779IHW80250;
	Wed, 7 Aug 2002 18:18:17 +0900 (JST)
	(envelope-from owner-doc-jp-work@jp.FreeBSD.org)
Received: from smtp.eos.ocn.ne.jp (eos.ocn.ne.jp [211.6.83.117])
	by castle.jp.FreeBSD.org (8.11.6+3.4W/8.11.3) with ESMTP/inet id g779IGn80245
	for <doc-jp-work@jp.FreeBSD.org>; Wed, 7 Aug 2002 18:18:16 +0900 (JST)
	(envelope-from hrs@eos.ocn.ne.jp)
Received: from mail.allbsd.org (p11163-adsan10hon-acca.tokyo.ocn.ne.jp [218.43.54.163])
	by smtp.eos.ocn.ne.jp (Postfix) with ESMTP id D2C6E379
	for <doc-jp-work@jp.FreeBSD.org>; Wed,  7 Aug 2002 18:18:15 +0900 (JST)
Received: from localhost (alph.allbsd.org [192.168.0.10])
	by mail.allbsd.org (8.12.3/3.7W/DomainMaster) with ESMTP id g779HaLu094751
	for <doc-jp-work@jp.FreeBSD.org>; Wed, 7 Aug 2002 18:17:36 +0900 (JST)
	(envelope-from hrs@eos.ocn.ne.jp)
Message-Id: <20020807.181550.65986578.hrs@eos.ocn.ne.jp>
To: doc-jp-work@jp.FreeBSD.org
From: Hiroki Sato <hrs@eos.ocn.ne.jp>
In-Reply-To: <20020807.011141.130625066.hino@ccrl.sj.nec.com>
References: <200208052351.g75Np6cY097801@freefall.freebsd.org>
	<20020806.172153.55999851.hrs@eos.ocn.ne.jp>
	<20020807.011141.130625066.hino@ccrl.sj.nec.com>
X-Mailer: Mew version 2.2 on Emacs 20.7 / Mule 4.0 (HANANOEN)
Mime-Version: 1.0
Content-Type: Multipart/Mixed;
 boundary="--Next_Part(Wed_Aug__7_18:15:51_2002_046)--"
Content-Transfer-Encoding: 7bit
Reply-To: doc-jp-work@jp.FreeBSD.org
Precedence: list
Date: Wed, 07 Aug 2002 18:15:50 +0900
X-Sequence: doc-jp-work 470
Subject: [doc-jp-work 470] Re: ANNOUNCE: FreeBSD Security Advisory
 FreeBSD-SA-02:36.nfs
Errors-To: owner-doc-jp-work@jp.FreeBSD.org
Sender: owner-doc-jp-work@jp.FreeBSD.org
X-Originator: hrs@eos.ocn.ne.jp
X-Distribute: distribute version 2.1 (Alpha) patchlevel 24e+020807

----Next_Part(Wed_Aug__7_18:15:51_2002_046)--
Content-Type: Text/Plain; charset=iso-2022-jp
Content-Transfer-Encoding: 7bit

$B:4F#!wEl5~M}2JBg3X$G$9!#(B

 02:36, 37 $B$N2~D{HG$G$9!#(B

 - typo $B$N=$@5!#(B
 - kqueue $B$N35MW:9$749$((B
 - incoming RPC -> $BE~Ce$7$?(B
 - lock up      -> $BL58B%k!<%W$K4Y$k(B
 - /path/to/patch $B$KLuCmDI2C!#(B

--
| $B:4F#(B $B9-@8!wEl5~M}2JBg3X(B <hrs@eos.ocn.ne.jp>
|                         <hrs@FreeBSD.org> (FreeBSD Project)


----Next_Part(Wed_Aug__7_18:15:51_2002_046)--
Content-Type: Text/Plain; charset=iso-2022-jp
Content-Transfer-Encoding: 7bit
Content-Disposition: inline; filename="02:35-37.diff"

Index: 02:36
===================================================================
RCS file: /home/cvs/private/hrs/announce-jp/FreeBSD-SA/02:36,v
retrieving revision 1.3
retrieving revision 1.4
diff -d -u -I\$FreeBSD:.*\$ -I\$Id:.*\$ -I\$hrs:.*\$ -r1.3 -r1.4
--- 02:36	6 Aug 2002 08:21:46 -0000	1.3
+++ 02:36	7 Aug 2002 09:05:38 -0000	1.4
@@ -69,7 +69,7 @@
 later cause an infinite loop in a different part of the NFS server
 code which tried to traverse the chain.
 
-NFS $B%5!<%P$N%3!<%I$K$*$1$k!"E~Ce(B RPC $B%a%C%;!<%8$N=hM}$r(B
+NFS $B%5!<%P$N%3!<%I$K4^$^$l$k!"E~Ce$7$?(B RPC $B%a%C%;!<%8$N=hM}$r(B
 $B9T$J$&ItJ,$K$O!"(B0 $B%P%$%H$N%Z%$%m!<%I$r;}$D%a%C%;!<%8$r(B
 $B%5!<%P$,<u$1$H$C$?;~$K!"$=$NA0$K<u$1$H$C$?%a%C%;!<%8$N(B
 $B%Z%$%m!<%I$r;2>H$7$F$7$^$$!"$=$N7k2L%a%C%;!<%8%A%'!<%s$K%k!<%W$,(B
@@ -87,14 +87,14 @@
 Linux $B$N(B NFS $B<BAu$N0lIt$K$O!"$"$k>r7o2<$G%G!<%?%5%$%:$,(B 0 $B$N(B
 RPC $B%a%C%;!<%8$r@8@.$9$k$b$N$,$"$j$^$9!#(BNFS $B%5!<%P$H$7$FF0:n$7$F$$$k(B
 FreeBSD $B%7%9%F%`$O!"$=$N$h$&$J%/%i%$%"%s%H$,@\B3$7$?>l9g$K(B
-$B%m%C%/%"%C%W$7$F$7$^$&2DG=@-$,$"$j$^$9!#(B
+$BL58B%k!<%W$K4Y$C$F$7$^$&2DG=@-$,$"$j$^$9!#(B
 
 An attacker in a position to send RPC messages to an affected FreeBSD
 system can construct a sequence of malicious RPC messages that cause
 the target system to lock up.
 
 $B<eE@$r;}$D(B FreeBSD $B%7%9%F%`$K(B RPC $B%a%C%;!<%8$rAw$k$3$H$,(B
-$B$G$-$k967b<T$O!"%7%9%F%`$r%m%C%/%"%C%W$5$;$k$h$&$J0-0U$r;}$C$?(B
+$B$G$-$k967b<T$O!"%7%9%F%`$rL58B%k!<%W$K4Y$i$;$k$h$&$J0-0U$r;}$C$?(B
 RPC $B%a%C%;!<%8$r:n@.$9$k$3$H$,2DG=$G$9!#(B
 
 
@@ -143,6 +143,8 @@
 # cd /usr/src
 # patch < /path/to/patch
 
+ ($BLuCm(B: /path/to/patch $B$NItJ,$O=$@5%Q%C%A$N%Q%9L>$KCV$-49$($F$/$@$5$$(B)
+
 c) Recompile your kernel and modules as described in
 <URL:http://www.freebsd.org/handbook/kernelconfig.html> and reboot the
 system.
Index: 02:37
===================================================================
RCS file: /home/cvs/private/hrs/announce-jp/FreeBSD-SA/02:37,v
retrieving revision 1.2
retrieving revision 1.3
diff -d -u -I\$FreeBSD:.*\$ -I\$Id:.*\$ -I\$hrs:.*\$ -r1.2 -r1.3
--- 02:37	6 Aug 2002 08:12:18 -0000	1.2
+++ 02:37	7 Aug 2002 09:05:38 -0000	1.3
@@ -57,10 +57,10 @@
 asynchronous notification when these events occur on the selected
 descriptors.
 
-kqueue $B$O!"%W%m%;%9$,%U%!%$%k5-=R;R$GH/@8$9$k%$%Y%s%H$r4F;k$G$-$k(B
-$B$h$&$K$9$k$?$a$N5!9=$G$9!#%U%!%$%k5-=R;R$H$=$3$GH/@8$9$k%$%Y%s%H$r(B
-$B;XDj$9$k$3$H$G!"%W%m%;%9$O;XDj$7$?%$%Y%s%H$NH/@8;~$K!"$=$NDLCN$r(B
-$BHsF14|$K<u$1$H$k$3$H$,$G$-$^$9!#(B
+kqueue $B$O!"%W%m%;%9$,%U%!%$%k5-=R;R$H$=$3$GH/@8$9$k%$%Y%s%H$r(B
+$B4F;kBP>]$H$7$FEPO?$G$-$k$h$&$K$7!"$5$i$K!"$=$l$i$N%$%Y%s%H$,(B
+$BEPO?$7$?%U%!%$%k5-=R;R$GH/@8$7$?;~$K!"$=$NDLCN$rHsF14|$K(B
+$B<u$1$H$k$3$H$,$G$-$k$h$&$K$9$k$?$a$N5!9=$G$9!#(B
 
 
 II.  $BLdBj$N>\:Y(B - Problem Description
@@ -69,7 +69,7 @@
 pipe was closed, registering an EVFILT_WRITE filter on the other end
 would cause a kernel panic.
 
-pipe(2) $B%7%9%F%`%3!<%k$r;H$C$F%Q%$%W$,:n@.$7$FJRC<$r%/%m!<%:$7$?8e!"(B
+pipe(2) $B%7%9%F%`%3!<%k$r;H$C$F%Q%$%W$r:n@.$7$FJRC<$r%/%m!<%:$7$?8e!"(B
 $B$b$&0lJ}$N%Q%$%W=*C<$K(B EVFILT_WRITE $B%U%#%k%?$rEPO?$9$k$H(B
 $B%+!<%M%k%Q%K%C%/$,H/@8$7$^$9!#(B
 
@@ -122,6 +122,8 @@
 # cd /usr/src
 # patch < /path/to/patch
 
+ ($BLuCm(B: /path/to/patch $B$NItJ,$O=$@5%Q%C%A$N%Q%9L>$KCV$-49$($F$/$@$5$$(B)
+
 c) Recompile your kernel as described in
 <URL:http://www.freebsd.org/handbook/kernelconfig.html> and reboot the
 system.

----Next_Part(Wed_Aug__7_18:15:51_2002_046)----
