From owner-doc-jp-work@jp.FreeBSD.org Tue Oct  5 07:10:37 2004
Received: (from daemon@localhost)
	by castle.jp.FreeBSD.org (8.11.6p2+3.4W/8.11.3) id i94MAbB54687;
	Tue, 5 Oct 2004 07:10:37 +0900 (JST)
	(envelope-from owner-doc-jp-work@jp.FreeBSD.org)
Received: from smtp.eos.ocn.ne.jp (eos.ocn.ne.jp [222.146.51.150])
	by castle.jp.FreeBSD.org (8.11.6p2+3.4W/8.11.3) with ESMTP/inet id i94MAa854682
	for <doc-jp-work@jp.FreeBSD.org>; Tue, 5 Oct 2004 07:10:36 +0900 (JST)
	(envelope-from hrs@FreeBSD.org)
Received: from delta.allbsd.org (p2244-adsau13honb4-acca.tokyo.ocn.ne.jp [220.98.51.244])
	by smtp.eos.ocn.ne.jp (Postfix) with ESMTP id D803344AD
	for <doc-jp-work@jp.FreeBSD.org>; Tue,  5 Oct 2004 07:10:35 +0900 (JST)
Received: from localhost (alph.allbsd.org [192.168.0.10])
	by delta.allbsd.org (8.12.9p2/8.12.9) with ESMTP id i94MA8bT001695
	for <doc-jp-work@jp.FreeBSD.org>; Tue, 5 Oct 2004 07:10:08 +0900 (JST)
	(envelope-from hrs@FreeBSD.org)
Message-Id: <20041005.070939.74747074.hrs@eos.ocn.ne.jp>
To: doc-jp-work@jp.FreeBSD.org
From: Hiroki Sato <hrs@FreeBSD.org>
In-Reply-To: <200410042054.i94KsBK3021953@freefall.freebsd.org>
References: <200410042054.i94KsBK3021953@freefall.freebsd.org>
X-PGPkey-fingerprint: BDB3 443F A5DD B3D0 A530  FFD7 4F2C D3D8 2793 CF2D
X-Mailer: Mew version 4.0.68 on Emacs 21.3 / Mule 5.0 (SAKAKI)
Mime-Version: 1.0
Content-Type: Multipart/Signed; protocol="application/pgp-signature";
 micalg=pgp-sha1;
 boundary="--Security_Multipart0(Tue_Oct__5_07_09_39_2004_627)--"
Content-Transfer-Encoding: 7bit
Reply-To: doc-jp-work@jp.FreeBSD.org
Precedence: list
Date: Tue, 05 Oct 2004 07:09:39 +0900
X-Sequence: doc-jp-work 956
Subject: [doc-jp-work 956] Re: [FreeBSD-Announce] FreeBSD Security Advisory
 FreeBSD-SA-04:15.syscons
Sender: owner-doc-jp-work@jp.FreeBSD.org
X-Originator: hrs@FreeBSD.org
X-Distribute: distribute version 2.1 (Alpha) patchlevel 24e+041003

----Security_Multipart0(Tue_Oct__5_07_09_39_2004_627)--
Content-Type: Multipart/Mixed;
 boundary="--Next_Part(Tue_Oct__5_07_09_39_2004_364)--"
Content-Transfer-Encoding: 7bit

----Next_Part(Tue_Oct__5_07_09_39_2004_364)--
Content-Type: Text/Plain; charset=iso-2022-jp
Content-Transfer-Encoding: 7bit

$B:4F#!wEl5~M}2JBg3X$G$9!#(B

 04:15 $B$G$9!#(B

--
| $B:4F#(B $B9-@8!wEl5~M}2JBg3X(B

----Next_Part(Tue_Oct__5_07_09_39_2004_364)--
Content-Type: Text/Plain; charset=iso-2022-jp
Content-Transfer-Encoding: 7bit
Content-Disposition: inline; filename="04:15"


FreeBSD $B%;%-%e%j%F%#4+9p(B $BF|K\8lHG(B
=============================================================================
FreeBSD-SA-04:15.syscons (2004-10-04)
 * Boundary checking errors in syscons
=============================================================================

 $B$3$N%a!<%k$O(B, announce-jp $B$KN.$l$?(B

  Subject: ANNOUNCE: [FreeBSD-Announce] FreeBSD Security Advisory FreeBSD-SA-04:15.syscons
  From: FreeBSD Security Advisories <security-advisories@FreeBSD.org>
  Date: Mon, 4 Oct 2004 20:54:11 GMT
  Message-Id: <200410042054.i94KsBK3021953@freefall.freebsd.org>
  X-Sequence: announce-jp xxx

 $B$rF|K\8lLu$7$?$b$N$G$9!#(B

 $B86J8$O(B PGP $B=pL>$5$l$F$$$^$9$,!"$3$NF|K\8lLu$O(B PGP $B=pL>$5$l$F$$$^$;$s!#(B
 $B=$@5%Q%C%AEy$NFbMF$,2~$6$s$5$l$F$$$J$$$3$H$r3NG'$9$k$?$a$K(B PGP $B=pL>$N(B
 $B%A%'%C%/$r$*$3$J$&$K$O!"86J8$r;2>H$7$F$/$@$5$$!#(B

 $BF|K\8lLu$*$h$S%_%i!<%5%$%HMxMQ$N>\:Y$K$D$$$F$O!"J8Kv$N!V(BA. FreeBSD
 $B%;%-%e%j%F%#4+9p(B $BF|K\8lHG$K$D$$$F!W$r$4Mw$/$@$5$$!#(B


                                     [$BK]Lu<T(B: $B:4F#(B $B9-@8(B <hrs@jp.FreeBSD.org>]
--($B$3$3$+$i(B)
=============================================================================
FreeBSD-SA-04:15.syscons                                    Security Advisory
                                                          The FreeBSD Project

$B%H%T%C%/(B:	syscons $B$K$*$1$k6-3&%A%'%C%/$N%(%i!<(B
		(Boundary checking errors in syscons)

$BJ,N`(B:		core
$B%b%8%e!<%k(B:	sys_dev_syscons
$B9pCNF|(B:		2004-10-04
$B%/%l%8%C%H(B:	Christer Oberg
$B1F6AHO0O(B:	$B$9$Y$F$N(B FreeBSD 5.x $B%j%j!<%9(B
$B=$@5F|(B:		2004-09-30 17:49:15 UTC (RELENG_5, 5.3-BETA6)
                2004-10-04 17:04:25 UTC (RELENG_5_2, 5.2.1-RELEASE-p11)
CVE Name:       CAN-2004-0919
FreeBSD $B$K8GM-$+(B:	YES

For general information regarding FreeBSD Security Advisories,
including descriptions of the fields above, security branches, and the
following sections, please visit
<URL:http://www.freebsd.org/security/>.

$B>e5-$N9`L\$d%;%-%e%j%F%#%V%i%s%A!"0J2<$N3F@a$D$$$F$N@bL@$J$I!"(B
FreeBSD $B%;%-%e%j%F%#4+9p$K$D$$$F$N0lHLE*$J>pJs$O!"(B
<URL:http://www.freebsd.org/security/> $B$r$4Mw$/$@$5$$!#(B


I.   $BGX7J(B - Background

syscons(4) is the default console driver for FreeBSD.  Using the
physical keyboard and screen, it provides multiple virtual terminals
which appear as if they were separate terminals.  One virtual terminal
is considered current and exclusively occupies the screen and the
keyboard; the other virtual terminals are placed in the background.

syscons(4) $B$O!"(BFreeBSD $B$N%G%U%)%k%H$N%3%s%=!<%k%I%i%$%P$G$9!#$3$l$O<B:]$N(B
$B%-!<%\!<%I$H2hLL$r;H$C$F!"J#?t$N$=$l$>$lFHN)$7$?2>A[C<Kv$rDs6!$9$k$b$N$G$9!#(B
$B$"$k;~E@$G$O!"$R$H$D$N2>A[C<Kv$@$1$,%-!<%\!<%I$H2hLL$rFH@j$7$^$9!#$=$7$F(B
$B;D$j$N2>A[C<Kv$O!"%P%C%/%0%i%&%s%I$KCV$+$l$^$9!#(B


II.  $BLdBj$N>\:Y(B - Problem Description

The syscons CONS_SCRSHOT ioctl(2) does insufficient validation of
its input arguments.  In particular, negative coordinates or large
coordinates may cause unexpected behavior.

syscons $B$N(B CONS_SCRSHOT $B$H$$$&(B ioctl(2) $B$O!"F~NO0z?t$N%A%'%C%/$r(B
$B==J,$K$*$3$J$C$F$$$^$;$s!#FC$K!"Ii$N0z?t$dHs>o$KBg$-$J0z?t$rM?$($k$H!"(B
$BM=B,$G$-$J$$F0:n$r0z$-5/$3$92DG=@-$,$"$j$^$9!#(B


III. $B1F6AHO0O(B - Impact

It may be possible to cause the CONS_SCRSHOT ioctl to return portions of
kernel memory.  Such memory might contain sensitive information, such as
portions of the file cache or terminal buffers.  This information might
be directly useful, or it might be leveraged to obtain elevated
privileges in some way.  For example, a terminal buffer might include a
user-entered password.

CONS_SCRSHOT ioctl $B$rMxMQ$7$F!"%+!<%M%k%a%b%j$NFbMF$N0lIt$rF~<j$G$-$k(B
$B2DG=@-$,$"$j$^$9!#$3$N$h$&$J%a%b%j$K$O!"%U%!%$%k%-%c%C%7%e$d(B
$BC<Kv%P%C%U%!$H$$$C$?%;%-%e%j%F%#>e=EMW$J>pJs$,4^$^$l$F$$$k2DG=@-$,$"$j$^$9!#(B
$B$3$N>pJs$OD>@\0-MQ2DG=$+$b$7$l$^$;$s$7!"9b$$8"8B$rIT@5$KF@$k$?$a$K(B
$B0-MQ$5$l$k$+$b$7$l$^$;$s!#$?$H$($P!"C<Kv%P%C%U%!$K$O%f!<%6$,(B
$BF~NO$7$?%Q%9%o!<%I$,4^$^$l$F$$$k$+$b$7$l$^$;$s!#(B


IV.  $B2sHrJ}K!(B - Workaround

There is no known workaround.  However, this bug is only exploitable
by users who have access to the physical console or can otherwise open
a /dev/ttyv* device node.

$B2sHrJ}K!$O$"$j$^$;$s!#$?$@$7$3$N%P%0$,0-MQ$G$-$k$N$O!"%f!<%6$,(B
$BJ*M}E*$K%3%s%=!<%k$rA`:n$G$-$k$+!"(B/dev/ttyv* $B%G%P%$%9%N!<%I$r(B
open $B$9$k$3$H$,$G$-$k>l9g$@$1$G$9!#(B


V.   $B2r7h:v(B - Solution

Perform one of the following:
$B<!$N$$$:$l$+$R$H$D$K=>$C$F$/$@$5$$!#(B

1) Upgrade your vulnerable system to the RELENG_5_2 security branch
dated after the correction date.
1) $B<eE@$r;}$C$?(B FreeBSD $B%7%9%F%`$r!"=$@5F|0J9_$N(B RELENG_5_2
   $B%;%-%e%j%F%#%V%i%s%A$K%"%C%W%0%l!<%I$9$k!#(B

2) To patch your present system:
2) $B8=:_$N%7%9%F%`$K=$@5%Q%C%A$rE,MQ$9$k!#(B

The following patches have been verified to apply to FreeBSD 5.2
systems.
$B0J2<$N=$@5%Q%C%A$O!"(BFreeBSD 5.2 $B$KE,MQ2DG=$J$3$H$,3NG'$5$l$F$$$k$b$N$G$9!#(B

a) Download the relevant patch from the location below, and verify the
detached PGP signature using your PGP utility.
a) $B0J2<$N>l=j$+$i=$@5%Q%C%A$r%@%&%s%m!<%I$7!"(BPGP $B%f!<%F%#%j%F%#$r;H$C$F(B
   PGP $B=pL>$r3NG'$7$^$9!#(B

# fetch ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-04:15/syscons.patch
# fetch ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-04:15/syscons.patch.asc

b) Apply the patch.
b) $B=$@5%Q%C%A$rE,MQ$7$^$9!#(B

# cd /usr/src
# patch < /path/to/patch

($BLuCm(B: /path/to/patch $B$NItJ,$O=$@5%Q%C%A$N%Q%9L>$KCV$-49$($F$/$@$5$$(B)

c) Recompile your kernel as described in
<URL:http://www.freebsd.org/handbook/kernelconfig.html> and reboot the
system.

c) <URL:http://www.freebsd.org/handbook/kernelconfig.html> $B$K=q$+$l$F$$$k(B
   $B<j=g$K=>$C$F%+!<%M%k$r:F9=C[$7$F!"%7%9%F%`$r:F5/F0$7$^$9!#(B


VI.  $B=$@5$N>\:Y(B - Correction details

The following list contains the revision numbers of each file that was
corrected in FreeBSD.

FreeBSD $B$K$*$$$F:#2s=$@5$5$l$?3F%U%!%$%k$N%j%S%8%g%sHV9f$O!"0J2<$N$H$*$j$G$9!#(B

Branch                                                           Revision
$B%V%i%s%A(B                                                         $B%j%S%8%g%s(B
  Path
  $B%Q%9L>(B
- -------------------------------------------------------------------------
RELENG_5_2
  src/UPDATING                                                 1.282.2.19
  src/sys/conf/newvers.sh                                       1.56.2.18
  src/sys/dev/syscons/syscons.c                                 1.409.2.1
- -------------------------------------------------------------------------


VII. $B;29M;qNA(B - References

<URL:http://cvsweb.freebsd.org/src/sys/dev/syscons/syscons.c.diff?r1=1.428&r2=1.429>


A.   FreeBSD $B%;%-%e%j%F%#4+9p(B $BF|K\8lHG$K$D$$$F(B

$BF|K\8lLu$O(B FreeBSD $BF|K\8l%I%-%e%a%s%F!<%7%g%s%W%m%8%'%/%H(B (doc-jp) $B$,(B
$B;29M$N$?$a$KDs6!$9$k$b$N$G$9!#2a5n$NF|K\8lHG%;%-%e%j%F%#4+9p$O(B

 http://www.FreeBSD.org/ja/security/

$B$K$^$H$a$i$l$F$$$^$9!#(B

$B$?$@$7K]Lu<T$*$h$S(B doc-jp $B$O!"$=$NFbMF$K$D$$$F$$$+$J$kJ]>Z$b(B
$B$$$?$7$^$;$s$N$G$4Cm0U$/$@$5$$!#F|K\8lLu$K$D$$$F$N$40U8+!"$4MWK>!"(B
$B$*Ld$$9g$o$;Ey$O(B doc-jp@jp.FreeBSD.org $B$^$G$*4j$$$7$^$9!#(B

$B$3$N4+9p$NCf$G>R2p$5$l$F$$$k(B WWW $B%5%$%H(B http://www.FreeBSD.org/ $B$*$h$S(B
FTP $B%5%$%H(B ftp://ftp.FreeBSD.org/ $B$K$O(B, $BF|K\$N%_%i!<%5%$%H$,B8:_$7$^$9!#(B
$B%M%C%H%o!<%/$N:.;($r4KOB$9$k$?$a!"$^$:$O%_%i!<%5%$%H$NMxMQ$r(B
$B9MN8$9$k$h$&$*4j$$$7$^$9!#(B

$BF|K\$N%_%i!<%5%$%H$rMxMQ$9$k$K$O!"(B
http://www.FreeBSD.org/ $B$r(B http://www.jp.FreeBSD.org/www.freebsd.org/ $B$K!"(B
ftp://ftp.FreeBSD.org/ $B$r(B ftp://ftp.jp.FreeBSD.org/ $B$K!"(B
$B$=$l$>$lCV$-49$($F$/$@$5$$!#(B

$BB>$NCO0h$r4^$`%_%i!<%5%$%H$K4X$9$k>\:Y$O(B

 http://www.FreeBSD.org/doc/en_US.ISO8859-1/books/handbook/mirrors.html ($B1QJ8(B)
 http://www.FreeBSD.org/doc/ja_JP.eucJP/books/handbook/mirrors.html ($BF|K\8lLu(B)

$B$K$^$H$a$i$l$F$$$^$9!#(B

$hrs: announce-jp/FreeBSD-SA/04:15,v 1.2 2004/10/04 22:08:58 hrs Exp $

----Next_Part(Tue_Oct__5_07_09_39_2004_364)----

----Security_Multipart0(Tue_Oct__5_07_09_39_2004_627)--
Content-Type: application/pgp-signature
Content-Transfer-Encoding: 7bit

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (FreeBSD)

iD8DBQBBYcomTyzT2CeTzy0RAhzmAKDfdYJemtbow+2J7tFQI1EZZMpftwCfXDR5
qPkNIfgzWtUQk4ScYFs7KlM=
=O5NL
-----END PGP SIGNATURE-----

----Security_Multipart0(Tue_Oct__5_07_09_39_2004_627)----
