From owner-doc-jp-work@jp.FreeBSD.org Mon Aug 19 23:27:27 2002
Received: (from daemon@localhost)
	by castle.jp.FreeBSD.org (8.11.6+3.4W/8.11.3) id g7JERRU36259;
	Mon, 19 Aug 2002 23:27:27 +0900 (JST)
	(envelope-from owner-doc-jp-work@jp.FreeBSD.org)
Received: from smtp.eos.ocn.ne.jp (eos.ocn.ne.jp [211.6.83.117])
	by castle.jp.FreeBSD.org (8.11.6+3.4W/8.11.3) with ESMTP/inet id g7JERR336254
	for <doc-jp-work@jp.FreeBSD.org>; Mon, 19 Aug 2002 23:27:27 +0900 (JST)
	(envelope-from hrs@eos.ocn.ne.jp)
Received: from mail.allbsd.org (p17010-adsao04hon-acca.tokyo.ocn.ne.jp [61.199.22.10])
	by smtp.eos.ocn.ne.jp (Postfix) with ESMTP id 3B396133A
	for <doc-jp-work@jp.FreeBSD.org>; Mon, 19 Aug 2002 23:27:26 +0900 (JST)
Received: from localhost (alph.allbsd.org [192.168.0.10])
	by mail.allbsd.org (8.12.3/3.7W/DomainMaster) with ESMTP id g7JEQiLu045767
	for <doc-jp-work@jp.FreeBSD.org>; Mon, 19 Aug 2002 23:26:45 +0900 (JST)
	(envelope-from hrs@eos.ocn.ne.jp)
Message-Id: <20020819.232617.23004895.hrs@eos.ocn.ne.jp>
To: doc-jp-work@jp.FreeBSD.org
From: Hiroki Sato <hrs@eos.ocn.ne.jp>
In-Reply-To: <200208191256.g7JCuNAd018797@freefall.freebsd.org>
References: <200208191256.g7JCuNAd018797@freefall.freebsd.org>
X-Mailer: Mew version 2.2 on Emacs 20.7 / Mule 4.0 (HANANOEN)
Mime-Version: 1.0
Content-Type: Multipart/Mixed;
 boundary="--Next_Part(Mon_Aug_19_23:26:17_2002_519)--"
Content-Transfer-Encoding: 7bit
Reply-To: doc-jp-work@jp.FreeBSD.org
Precedence: list
Date: Mon, 19 Aug 2002 23:26:17 +0900
X-Sequence: doc-jp-work 478
Subject: [doc-jp-work 478] Re: FreeBSD Security Advisory FreeBSD-SA-02:38.signed-error
Errors-To: owner-doc-jp-work@jp.FreeBSD.org
Sender: owner-doc-jp-work@jp.FreeBSD.org
X-Originator: hrs@eos.ocn.ne.jp
X-Distribute: distribute version 2.1 (Alpha) patchlevel 24e+020815

----Next_Part(Mon_Aug_19_23:26:17_2002_519)--
Content-Type: Text/Plain; charset=iso-2022-jp
Content-Transfer-Encoding: 7bit

$B:4F#!wEl5~M}2JBg3X$G$9!#(B

 02:38 $B$G$9!#IaCJ$K$b$^$7$F0ULu5$L#$J$N$GC!$$$F$/$@$5$$!#(B

--
| $B:4F#(B $B9-@8!wEl5~M}2JBg3X(B <hrs@eos.ocn.ne.jp>
|                         <hrs@FreeBSD.org> (FreeBSD Project)

----Next_Part(Mon_Aug_19_23:26:17_2002_519)--
Content-Type: Text/Plain; charset=iso-2022-jp
Content-Transfer-Encoding: 7bit
Content-Disposition: inline; filename="02:38"

FreeBSD $B%;%-%e%j%F%#4+9p(B $BF|K\8lHG(B
=============================================================================
FreeBSD-SA-02:38.signed-error (2002-08-19)
 * Boundary checking errors involving signed integers
=============================================================================

 $B$3$N%a!<%k$O(B, announce-jp $B$KN.$l$?(B

  Subject: ANNOUNCE: FreeBSD Security Advisory FreeBSD-SA-02:38.signed-error
  From: FreeBSD Security Advisories <security-advisories@FreeBSD.ORG>
  Date: Mon, 19 Aug 2002 05:56:23 -0700 (PDT)
  Message-Id: <200208191256.g7JCuNAd018797@freefall.freebsd.org>
  X-Sequence: announce-jp xxx

 $B$rF|K\8lLu$7$?$b$N$G$9!#(B

 $B86J8$O(B PGP $B=pL>$5$l$F$$$^$9$,!"$3$NF|K\8lLu$O(B PGP $B=pL>$5$l$F$$$^$;$s!#(B
 $B=$@5%Q%C%AEy$NFbMF$,2~$6$s$5$l$F$$$J$$$3$H$r3NG'$9$k$?$a$K(B PGP $B=pL>$N(B
 $B%A%'%C%/$r9T$J$&$K$O!"86J8$r;2>H$7$F$/$@$5$$!#(B

 $BF|K\8lLu$*$h$S%_%i!<%5%$%HMxMQ$N>\:Y$K$D$$$F$O!"J8Kv$N!V(BA. FreeBSD
 $B%;%-%e%j%F%#4+9p(B $BF|K\8lHG$K$D$$$F!W$r$4Mw$/$@$5$$!#(B


                                     [$BK]Lu<T(B: $B:4F#(B $B9-@8(B <hrs@jp.FreeBSD.org>]
--($B$3$3$+$i(B)
=============================================================================
FreeBSD-SA-02:38.signed-error                               Security Advisory
                                                          The FreeBSD Project

$B%H%T%C%/(B:	$BId9fIU$-@0?t$K5/0x$9$k6-3&%A%'%C%/$N%(%i!<LdBj(B
                (Boundary checking errors involving signed integers)

$BJ,N`(B:		core
$B%b%8%e!<%k(B:	sys
$B9pCNF|(B:		2002-08-19
$B%/%l%8%C%H(B:	Silvio Cesare <silvio@qualys.com>
$B1F6AHO0O(B:	4.6.1-RELEASE-p10 $B$*$h$S!"$=$l0JA0$N$9$Y$F$N(B FreeBSD $B%j%j!<%9(B
$B=$@5F|(B:		2002-08-13 02:42:32 UTC (RELENG_4)
                2002-08-13 12:12:36 UTC (RELENG_4_6)
                2002-08-13 12:13:05 UTC (RELENG_4_5)
                2002-08-13 12:13:49 UTC (RELENG_4_4)
FreeBSD $B$K8GM-$+(B:	YES


I.   $BGX7J(B - Background

The issue described in this advisory affects the accept(2),
getsockname(2), and getpeername(2) system calls, and the vesa(4)
FBIO_GETPALETTE ioctl(2).

$B$3$N4+9p$G2r@b$7$F$$$kLdBj$O!"(Baccept(2), getsockname(2),
getpeername(2) $B$N3F%7%9%F%`%3!<%k$*$h$S!"(Bvesa(4) $B$N(B
FBIO_GETPALETTE ioctl(2) $B$KB8:_$9$k$b$N$G$9!#(B


II.  $BLdBj$N>\:Y(B - Problem Description

A few system calls were identified that contained assumptions that
a given argument was always a positive integer, while in fact the
argument was handled as a signed integer.  As a result, the boundary
checking code would fail if the system call were entered with a
negative argument.

$B$$$/$D$+$N%7%9%F%`%3!<%k$O!"8F$S=P$7;~$N0z?t$,>o$K@5$N@0?tCM$G$"$k$3$H$r(B
$BA[Dj$7$F$$$k$K$b$+$+$o$i$:!"<B:]$K$O0z?t$rId9fIU$-@0?t7?$G=hM}$7$F$$$^$9!#(B
$B$3$N$3$H$O!"0z?t$KIi$N@0?tCM$rM?$($F$=$N%7%9%F%`%3!<%k$r8F$S=P$7$?>l9g$K!"(B
$B%7%9%F%`%3!<%kCf$N6-3&%A%'%C%/%3!<%I$,8mF0:n$9$k860x$H$J$k4m81@-$,$"$j$^$9!#(B


III. $B1F6AHO0O(B - Impact

The affected system calls could be called with large negative
arguments, causing the kernel to return a large portion of kernel
memory.  Such memory might contain sensitive information, such as
portions of the file cache or terminal buffers.  This information
might be directly useful, or it might be leveraged to obtain elevated
privileges in some way.  For example, a terminal buffer might include
a user-entered password.

$BLdBj$N$"$k%7%9%F%`%3!<%k$r@dBPCM$NBg$-$$Ii$NCM$r0z?t$K$7$F8F$S=P$9$3$H$G!"(B
$B%+!<%M%k$,%+!<%M%k%a%b%j$N0lItJ,$rJV$7$F$7$^$&2DG=@-$,$"$j$^$9!#(B
$B%+!<%M%k%a%b%j$K$O!"%U%!%$%k$N%-%c%C%7%e$dC<Kv%P%C%U%!$J$I$N(B
$B%;%-%e%j%F%#>e=EMW$J>pJs$N0lIt$,4^$^$l$F$$$k2DG=@-$,$"$j!"(B
$B$3$l$i$N>pJs$rD>@\0-MQ$7$?$j!"$5$i$K9b$$8"8B$rF@$k$?$a$K(B
$B2?$i$+$N7A$GMxMQ$G$-$k$+$bCN$l$^$;$s!#$?$H$($P!"C<Kv%P%C%U%!$K$O(B
$B%f!<%6$,F~NO$7$?%Q%9%o!<%I$,4^$^$l$F$$$k2DG=@-$,$"$j$^$9!#(B


IV.  $B2sHrJ}K!(B - Workaround

None.

$B2sHrJ}K!$O8+$D$+$C$F$$$^$;$s!#(B


V.   $B2r7h:v(B - Solution

1) Upgrade your vulnerable system to 4.6.2-RELEASE or 4.6-STABLE;
or to any of the RELENG_4_6 (4.6.1-RELEASE-p11), RELENG_4_5
(4.5-RELEASE-p19), or RELENG_4_4 (4.4-RELEASE-p26) security branches
dated after the respective correction dates.

1) $B<eE@$r;}$C$?(B FreeBSD $B%7%9%F%`$r(B 4.6.2-RELEASE$B!"$b$7$/$O(B
   $B:G?7$N(B 4.6-STABLE $B$K%"%C%W%0%l!<%I$9$k!#(B
   $B$"$k$$$O!"=$@5F|0J9_$N(B RELENG_4_6 (4.6.1-RELEASE-p11)$B!"(B
   RELENG_4_5 (4.5-RELEASE-p19)$B!"(BRELENG_4_4 (4.4-RELEASE-p26)
   $B%;%-%e%j%F%#%V%i%s%A$N$$$:$l$+$K%"%C%W%0%l!<%I$9$k!#(B

2) To patch your present system:
2) $B8=:_$N%7%9%F%`$K=$@5%Q%C%A$rE,MQ$9$k!#(B

a) Download the relevant patch from the location below, and verify the
detached PGP signature using your PGP utility.  The following patch
has been tested to apply to all FreeBSD 4.x releases.
a) $B0J2<$N>l=j$+$i=$@5%Q%C%A$r%@%&%s%m!<%I$7!"(BPGP $B%f!<%F%#%j%F%#$r;H$C$F(B
   PGP $B=pL>$r3NG'$7$^$9!#$3$N=$@5%Q%C%A$O!"(BFreeBSD 4.x $B%j%j!<%9$9$Y$F$K(B
   $BE,MQ$G$-$k$3$H$,3NG'$5$l$F$$$k$b$N$G$9!#(B

# fetch ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-02:38/signed-error.patch
# fetch ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-02:38/signed-error.patch.asc

b) Apply the patch.
b) $B=$@5%Q%C%A$rE,MQ$7$^$9!#(B

# cd /usr/src
# patch < /path/to/patch

 ($BLuCm(B: /path/to/patch $B$NItJ,$O=$@5%Q%C%A$N%Q%9L>$KCV$-49$($F$/$@$5$$(B)

c) Recompile your kernel as described in
<URL:http://www.freebsd.org/handbook/kernelconfig.html>
and reboot the system.
c) <URL:http://www.freebsd.org/handbook/kernelconfig.html> $B$K=q$+$l$F$$$k(B
   $B<j=g$K$7$?$,$C$F%+!<%M%k$r:F9=C[$7!"%7%9%F%`$r:F5/F0$7$^$9!#(B


VI.  $B=$@5$N>\:Y(B - Correction details

The following list contains the revision numbers of each file that was
corrected in FreeBSD.

FreeBSD $B$K$*$$$F:#2s=$@5$5$l$?3F%U%!%$%k$N%j%S%8%g%sHV9f$O!"0J2<$N$H$*$j$G$9!#(B

Path                                                             Revision
$B%Q%9L>(B                                                          $B%j%S%8%g%s(B
  Branch
  $B%V%i%s%A(B
- -------------------------------------------------------------------------
src/sys/i386/isa/vesa.c
  RELENG_4                                                       1.32.2.1
  RELENG_4_6                                                    1.32.10.1
  RELENG_4_5                                                     1.32.8.1
  RELENG_4_4                                                     1.32.6.1
src/sys/kern/uipc_syscalls.c
  RELENG_4                                                      1.65.2.12
  RELENG_4_6                                                 1.65.2.9.6.1
  RELENG_4_5                                                 1.65.2.9.4.1
  RELENG_4_4                                                 1.65.2.9.2.1
src/sys/conf/newvers.sh
  RELENG_4_6                                               1.44.2.23.2.16
  RELENG_4_5                                               1.44.2.20.2.20
  RELENG_4_4                                               1.44.2.17.2.25
- -------------------------------------------------------------------------


A.   FreeBSD $B%;%-%e%j%F%#4+9p(B $BF|K\8lHG$K$D$$$F(B

$BF|K\8lLu$O(B FreeBSD $BF|K\8l%I%-%e%a%s%F!<%7%g%s%W%m%8%'%/%H(B (doc-jp) $B$,(B
$B;29M$N$?$a$KDs6!$9$k$b$N$G$9!#2a5n$NF|K\8lHG%;%-%e%j%F%#4+9p$O(B

 http://www.FreeBSD.org/ja/security/

$B$K$^$H$a$i$l$F$$$^$9!#(B

$B$?$@$7K]Lu<T$*$h$S(B doc-jp $B$O!"$=$NFbMF$K$D$$$F$$$+$J$kJ]>Z$b(B
$B$$$?$7$^$;$s$N$G$4Cm0U$/$@$5$$!#F|K\8lLu$K$D$$$F$N$40U8+!"$4MWK>!"(B
$B$*Ld$$9g$o$;Ey$O(B doc-jp@jp.FreeBSD.org $B$^$G$*4j$$$7$^$9!#(B

$B$3$N4+9p$NCf$G>R2p$5$l$F$$$k(B WWW $B%5%$%H(B http://www.FreeBSD.org/ $B$*$h$S(B
FTP $B%5%$%H(B ftp://ftp.FreeBSD.org/ $B$K$O(B, $BF|K\$N%_%i!<%5%$%H$,B8:_$7$^$9!#(B
$B%M%C%H%o!<%/$N:.;($r4KOB$9$k$?$a!"$^$:$O%_%i!<%5%$%H$NMxMQ$r(B
$B9MN8$9$k$h$&$*4j$$$7$^$9!#(B

$BF|K\$N%_%i!<%5%$%H$rMxMQ$9$k$K$O!"(B
http://www.FreeBSD.org/ $B$r(B http://www.jp.FreeBSD.org/www.freebsd.org/ $B$K!"(B
ftp://ftp.FreeBSD.org/ $B$r(B ftp://ftp.jp.FreeBSD.org/ $B$K!"(B
$B$=$l$>$lCV$-49$($F$/$@$5$$!#(B

$BB>$NCO0h$r4^$`%_%i!<%5%$%H$K4X$9$k>\:Y$O(B

 http://www.FreeBSD.org/handbook/mirror.html ($B1QJ8(B)
 http://www.FreeBSD.org/ja/handbook/mirror.html ($BF|K\8lLu(B)

$B$K$^$H$a$i$l$F$$$^$9!#(B

$hrs: announce-jp/FreeBSD-SA/02:38,v 1.5 2002/08/19 14:26:13 hrs Exp $

----Next_Part(Mon_Aug_19_23:26:17_2002_519)----
