Sign Up for Your FREE Weekly SecurityTracker E-mail Alert Summary
|
|
|
|
|
|
|
Put SecurityTracker Vulnerability Alerts on Your Web Site -- It's Free!
|
|
|
|
Become a Partner and License Our Database or Notification Service
|
|
|
|
|
|
|
|
|
|
|
|
|
|
FreeBSD pf(4) Scrub Rule Error Lets Remote Users Deny Service
|
|
SecurityTracker Alert ID: 1015542
|
|
SecurityTracker URL: http://securitytracker.com/id?1015542
|
|
CVE Reference: CVE-2006-0381
(Links to External Site)
|
Date: Jan 25 2006
|
Impact: Denial of service via network
|
Fix Available: Yes
Vendor Confirmed: Yes
|
Advisory: FreeBSD Security Advisory
|
Version(s): 5.3, 5.4, 6.0
|
Description: A vulnerability was reported in FreeBSD in the pf(4) packet filter function. A remote user can cause the kernel to crash.
A remote user can send specially crafted IP packet fragments to trigger a logic error in writing to the pf IP fragment cache when
the 'scrub fragment crop' or 'scrub fragment drop-ovl' rules are used. The packet fragment may be inserted twice, causing the kernel
to crash.
Systems that do not use pf are not affected.
Systems that do not use the 'scrub fragment crop' or 'scrub fragment
drop-ovl' pf rules are also not affected.
The vendor credits Jakob Schlyter and Daniel Hartmeier with reporting this vulnerability.
|
Impact: A remote user can cause the kernel to crash.
|
Solution: The vendor has provided the following solution information [quoted]:
Perform one of the following:
1) Upgrade your vulnerable
system to 5-STABLE or 6-STABLE, or to the
RELENG_6_0, RELENG_5_4, or RELENG_5_3 security branch dated after the
correction date.
2)
To patch your present system:
The following patches have been verified to apply to FreeBSD 5.3, 5.4,
and 6.0 systems.
a)
Download the relevant patch from the location below, and verify the
detached PGP signature using your PGP utility.
# fetch ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patc
hes/SA-06:07/pf.patch
# fetch ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-06:07/pf.patch.asc
b) Apply the patch.
#
cd /usr/src
# patch < /path/to/patch
c) Recompile your kernel as described in
<URL:http://www.freebsd.org/handbook/kernelconfig.html>
and reboot the
system.
The vendor's advisory is available at:
ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-06:07.pf.asc
|
Vendor URL: www.freebsd.org/security/ (Links to External Site)
|
Cause: State error
|
Underlying OS: UNIX (FreeBSD)
|
Reported By: FreeBSD Security Advisories <security-advisories@freebsd.org>
|
Message History:
This archive entry has one or more follow-up message(s) listed below.
|
Source Message Contents
|
Date: Wed, 25 Jan 2006 10:13:44 +0000 (GMT)
From: FreeBSD Security Advisories <security-advisories@freebsd.org>
Subject: FreeBSD Security Advisory FreeBSD-SA-06:07.pf
|
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
=============================================================================
FreeBSD-SA-06:07.pf Security Advisory
The FreeBSD Project
Topic: IP fragment handling panic in pf(4)
Category: contrib
Module: sys_contrib
Announced: 2006-01-25
Credits: Jakob Schlyter, Daniel Hartmeier
Affects: FreeBSD 5.3, FreeBSD 5.4, and FreeBSD 6.0
Corrected: 2006-01-25 10:00:59 UTC (RELENG_6, 6.0-STABLE)
2006-01-25 10:01:26 UTC (RELENG_6_0, 6.0-RELEASE-p4)
2006-01-25 10:01:47 UTC (RELENG_5, 5.4-STABLE)
2006-01-25 10:02:07 UTC (RELENG_5_4, 5.4-RELEASE-p10)
2006-01-25 10:02:27 UTC (RELENG_5_3, 5.3-RELEASE-p25)
CVE Name: CVE-2006-0381
For general information regarding FreeBSD Security Advisories,
including descriptions of the fields above, security branches, and the
following sections, please visit
<URL:http://www.freebsd.org/security/>.
I. Background
pf is an Internet Protocol packet filter originally written for OpenBSD.
In addition to filtering packets, it also has packet normalization
capabilities.
II. Problem Description
A logic bug in pf's IP fragment cache may result in a packet fragment
being inserted twice, violating a kernel invariant.
III. Impact
By sending carefully crafted sequence of IP packet fragments, a remote
attacker can cause a system running pf with a ruleset containing a
'scrub fragment crop' or 'scrub fragment drop-ovl' rule to crash.
IV. Workaround
Do not use 'scrub fragment crop' or 'scrub fragment drop-ovl' rules
on systems running pf. In most cases, such rules can be replaced by
'scrub fragment reassemble' rules; see the pf.conf(5) manual page for
more details.
Systems which do not use pf, or use pf but do not use the aforementioned
rules, are not affected by this issue.
V. Solution
Perform one of the following:
1) Upgrade your vulnerable system to 5-STABLE or 6-STABLE, or to the
RELENG_6_0, RELENG_5_4, or RELENG_5_3 security branch dated after the
correction date.
2) To patch your present system:
The following patches have been verified to apply to FreeBSD 5.3, 5.4,
and 6.0 systems.
a) Download the relevant patch from the location below, and verify the
detached PGP signature using your PGP utility.
# fetch ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-06:07/pf.patch
# fetch ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-06:07/pf.patch.asc
b) Apply the patch.
# cd /usr/src
# patch < /path/to/patch
c) Recompile your kernel as described in
<URL:http://www.freebsd.org/handbook/kernelconfig.html> and reboot the
system.
VI. Correction details
The following list contains the revision numbers of each file that was
corrected in FreeBSD.
Branch Revision
Path
- -------------------------------------------------------------------------
RELENG_5
src/sys/contrib/pf/net/pf_norm.c 1.10.2.2
RELENG_5_4
src/UPDATING 1.342.2.24.2.19
src/sys/conf/newvers.sh 1.62.2.18.2.15
src/sys/contrib/pf/net/pf_norm.c 1.10.6.1
RELENG_5_3
src/UPDATING 1.342.2.13.2.28
src/sys/conf/newvers.sh 1.62.2.15.2.30
src/sys/contrib/pf/net/pf_norm.c 1.10.4.1
RELENG_6
src/sys/contrib/pf/net/pf_norm.c 1.11.2.3
RELENG_6_0
src/UPDATING 1.416.2.3.2.9
src/sys/conf/newvers.sh 1.69.2.8.2.5
src/sys/contrib/pf/net/pf_norm.c 1.11.2.1.2.1
- -------------------------------------------------------------------------
VII. References
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0381
The latest revision of this advisory is available at
ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-06:07.pf.asc
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.2 (FreeBSD)
iD8DBQFD105kFdaIBMps37IRAth+AKCPd0puGZJ1u1/gbFRgYMQpQs8TiQCcD1ai
56HQEqlhvzoW09g/05mbPCk=
=hyeL
-----END PGP SIGNATURE-----
_______________________________________________
freebsd-security@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-security
To unsubscribe, send any mail to "freebsd-security-unsubscribe@freebsd.org"
|
|
Go to the Top of This SecurityTracker Archive Page
|
