SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   OS (UNIX)  >   NetBSD Vendors:   NetBSD
NetBSD PPPoE Discovery Packet Processing Bug Lets Remote Users Deny Service
SecurityTracker Alert ID:  1020749
SecurityTracker URL:  http://securitytracker.com/id/1020749
CVE Reference:   CVE-2008-3584   (Links to External Site)
Updated:  Sep 17 2008
Original Entry Date:  Aug 26 2008
Impact:   Denial of service via network
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): 3.0, 3.1, 4.0
Description:   A vulnerability was reported in NetBSD. A remote user can cause denial of service conditions.

A remote user on the local network can send a specially crafted PPPoE discovery packet to trigger a buffer overflow and cause the kernel to crash.

The system may be affected even if there are no active pppoe(4) interfaces if at least one interface has been created with "ifconfig pppoe0 create".

The report indicates that it is unclear if this flaw can be exploited to trigger code execution.

Yasuoka Masahiko from Internet Initiative Japan Inc. reported this vulnerability.

Impact:   A remote user on the local network can cause the target system to crash.
Solution:   The vendor has issued a source code fix.

The vendor's advisory is available at:

ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2008-010.txt.asc

Vendor URL:  ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2008-010.txt.asc (Links to External Site)
Cause:   Boundary error

Message History:   None.


 Source Message Contents

Subject:  NetBSD Security Advisory 2008-010: Malicious PPPoE discovery packet


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


		 NetBSD Security Advisory 2008-010
		 =================================

Topic:		Malicious PPPoE discovery packet can overrun a kernel buffer

Version:	NetBSD-current:		affected
		NetBSD 4.0:		affected
		NetBSD 3.1.*:		affected
		NetBSD 3.1		affected
		NetBSD 3.0.*:		affected
		NetBSD 3.0:		affected

Severity:	Remote denial-of-service

Fixed:		NetBSD-current:		August 08, 2008
		NetBSD-4-0 branch:	August 08, 2008
			(4.0.1 will include the fix)
		NetBSD-4 branch:	August 08, 2008
			(4.1 will include the fix)
		NetBSD-3-1 branch:	August 08, 2008
			(3.1.2 will include the fix)
                NetBSD-3-0 branch:      August 08, 2008
                        (3.0.4 will include the fix)
		NetBSD-3 branch:	August 08, 2008
			(3.2 will include the fix)


Abstract
========

A problem has been identified in the pppoe(4) code.  A bug in range checking
allows a malicious packet to make the kernel access memory outside of the
allocated buffer and cause a kernel crash.  It is currently unclear if this
issue could be exploited any further than denial of service.


Technical Details
=================

The critical code deals with early states of a PPPoE connection, before
a session between client and access concentrator has been established.
Packets in this "discovery" phase may consist of multiple variable length
"tags" packed together in a pppoe packet. Each tag is checked and the length
validated against to total packet size. A bug in this length check allowed
packets to advance the next tag pointer to up to 4 bytes beyond the end
of the packet. This can cause a kernel crash.

The problematic code path is executed even without active pppoe(4) interfaces,
as long as at least one has been created with "ifconfig pppoe0 create". No
further configuration of the pppoe(4) interface is needed.

The attack is not routable, so attackers would have to have access to the
LAN of an affected machine - or the DSL side would need to be configured
like a shared ethernet segment. This is uncommon, but done by some providers.


Solutions and Workarounds
=========================

The pseudo-device pppoe is present in GENERIC kernels.  The system must
be configured with a pppoe(4) instance.

For all NetBSD versions, you need to obtain fixed kernel sources,
rebuild and install the new kernel, and reboot the system.
                                      
The fixed source may be obtained from the NetBSD CVS repository.        
The following instructions briefly summarise how to upgrade your        
kernel.  In these instructions, replace:

  ARCH     with your architecture (from uname -m), and                  
  KERNCONF with the name of your kernel configuration file.    

To update from CVS, re-build, and re-install the kernel:

	# cd src
	# cvs update -d -P sys/net/if_spppsubr.c
	# ./build.sh kernel=KERNCONF
	# mv /netbsd /netbsd.old
	# cp sys/arch/ARCH/compile/obj/KERNCONF/netbsd /netbsd 
	# shutdown -r now

For more information on how to do this, see:    

   http://www.NetBSD.org/guide/en/chap-kernel.html


Thanks To
=========

Yasuoka Masahiko from Internet Initiative Japan Inc. for discovering the
problem and providing a fix.


Revision History
================

	2008-08-26	Initial release


More Information
================

Advisories may be updated as new information becomes available.
The most recent version of this advisory (PGP signed) can be found at 
  ftp://ftp.NetBSD.org/pub/NetBSD/security/advisories/NetBSD-SA2008-010.txt.asc

Information about NetBSD and NetBSD security can be found at
http://www.NetBSD.org/ and http://www.NetBSD.org/Security/.


Copyright 2008, The NetBSD Foundation, Inc.  All Rights Reserved.
Redistribution permitted only in full, unmodified form.

$NetBSD: NetBSD-SA2008-010.txt,v 1.1 2008/08/25 22:51:57 adrianp Exp $

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (NetBSD)

iQCVAwUBSLM39j5Ru2/4N2IFAQK01QP+P2xq4d/W2Z5JIZ11T399mRD7NMS6N/Dl
rjGb0/cQwyF3LcwRlT4kPzwuTYqaSvbS37sdDr0Fb3F7c86GfGCkLVvmcVgNtJbe
qwg4rcUkWTW3ENsIZE18ZHH83nrf4dkXXZZ71nMw/cGTTzy034pPUf/rm1GSbR4v
MbwV26ZHx6I=
=ebPm
-----END PGP SIGNATURE-----

 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2020, SecurityGlobal.net LLC