FreeBSD Security Advisory FreeBSD-SA-02:38.signed-error

Bron: [url=http://www.bsdforums.org/forums/showthread.php?s=&threadid=2608]BSDForums[/url]

A few system calls were identified that contained assumptions that
a given argument was always a positive integer‚ while in fact the
argument was handled as a signed integer. As a result‚ the boundary
checking code would fail if the system call were entered with a
negative argument.

The affected system calls could be called with large negative
arguments‚ causing the kernel to return a large portion of kernel
memory. Such memory might contain sensitive information‚ such as
portions of the file cache or terminal buffers. This information
might be directly useful‚ or it might be leveraged to obtain elevated
privileges in some way. For example‚ a terminal buffer might include
a user-entered password.

[quote]*************************************
Date: Mon‚ 19 Aug 2002 05:56:23 -0700 (PDT)
From: FreeBSD Security Advisories
To: FreeBSD Security Advisories
Subject: FreeBSD Security Advisory FreeBSD-SA-02:38.signed-error

—–BEGIN PGP SIGNED MESSAGE—–

==================================================
===========================
FreeBSD-SA-02:38.signed-error Security Advisory
The FreeBSD Project

Topic: Boundary checking errors involving signed integers

Category: core
Module: sys
Announced: 2002-08-19
Credits: Silvio Cesare
Affects: All releases of FreeBSD up to and including 4.6.1-RELEASE-p10
Corrected: 2002-08-13 02:42:32 UTC (RELENG_4)
2002-08-13 12:12:36 UTC (RELENG_4_6)
2002-08-13 12:13:05 UTC (RELENG_4_5)
2002-08-13 12:13:49 UTC (RELENG_4_4)
FreeBSD only: YES

I. Background

The issue described in this advisory affects the accept(2)‚
getsockname(2)‚ and getpeername(2) system calls‚ and the vesa(4)
FBIO_GETPALETTE ioctl(2).

II. Problem Description

III. Impact

IV. Workaround

None.

V. Solution

1) Upgrade your vulnerable system to 4.6.2-RELEASE or 4.6-STABLE;
or to any of the RELENG_4_6 (4.6.1-RELEASE-p11)‚ RELENG_4_5
(4.5-RELEASE-p19)‚ or RELENG_4_4 (4.4-RELEASE-p26) security branches
dated after the respective correction dates.

2) To patch your present system:

a) Download the relevant patch from the location below‚ and verify the
detached PGP signature using your PGP utility. The following patch
has been tested to apply to all FreeBSD 4.x releases.

# fetch ftp://ftp.FreeBSD.org/pub/FreeBSD/C…ned-error.patch
# fetch ftp://ftp.FreeBSD.org/pub/FreeBSD/C…error.patch.asc

b) Apply the patch.

# cd /usr/src
# patch < /path/to/patch c) Recompile your kernel as described in
and reboot the system.

VI. Correction details

The following list contains the revision numbers of each file that was
corrected in FreeBSD.

Path Revision
Branch
– ————————————————————————-
src/sys/i386/isa/vesa.c
RELENG_4 1.32.2.1
RELENG_4_6 1.32.10.1
RELENG_4_5 1.32.8.1
RELENG_4_4 1.32.6.1
src/sys/kern/uipc_syscalls.c
RELENG_4 1.65.2.12
RELENG_4_6 1.65.2.9.6.1
RELENG_4_5 1.65.2.9.4.1
RELENG_4_4 1.65.2.9.2.1
src/sys/conf/newvers.sh
RELENG_4_6 1.44.2.23.2.16
RELENG_4_5 1.44.2.20.2.20
RELENG_4_4 1.44.2.17.2.25
– ————————————————————————-

—–BEGIN PGP SIGNATURE—–
Version: GnuPG v1.0.7 (FreeBSD)

iQCVAwUBPWDpxFUuHi5z0oilAQHCWgP+PmomqbDBiBHKG6JWrx
8Kz8M6gnrg4omw
w/ vH5uK2lHGL6ZGecwvhJOTbV4bKXt1C1dKoUyA7WH7l9nQi+1Cr
ZwT/D5mkteU+
XEqtNfRhiaDokj/5I8MA0OM80+jryeAimxYDEi2vm315RIOMeR/sdP7m7H2vl9cZ
V8rt/2zD2wc=
=LpMd
—–END PGP SIGNATURE—–

This is the moderated mailing list freebsd-announce.
The list contains announcements of new FreeBSD capabilities‚
important events and project milestones.
See also the FreeBSD Web pages at http://www.freebsd.org

To Unsubscribe: send mail to majordomo@FreeBSD.org
with “unsubscribe freebsd-announce” in the body of the message
[/quote]