From owner-doc-jp@jp.freebsd.org  Thu Nov  2 09:57:35 2000
Received: (from daemon@localhost)
	by castle.jp.freebsd.org (8.9.3+3.2W/8.7.3) id JAA12028;
	Thu, 2 Nov 2000 09:57:35 +0900 (JST)
	(envelope-from owner-doc-jp@jp.FreeBSD.org)
Received: from eos.ocn.ne.jp (eos.ocn.ne.jp [210.190.142.171])
	by castle.jp.freebsd.org (8.9.3+3.2W/8.7.3) with ESMTP id JAA12022
	for <doc-jp@jp.freebsd.org>; Thu, 2 Nov 2000 09:57:34 +0900 (JST)
	(envelope-from hrs@eos.ocn.ne.jp)
Received: from mail.hrslab.yi.org (p0189-ip01funabasi.chiba.ocn.ne.jp [211.123.225.189])
	by eos.ocn.ne.jp (8.9.1a/OCN/) with ESMTP id JAA04444
	for <doc-jp@jp.freebsd.org>; Thu, 2 Nov 2000 09:58:44 +0900 (JST)
Message-Id: <200011020058.JAA04444@eos.ocn.ne.jp>
Received: from localhost (alph.hrslab.yi.org [192.168.0.10])
	by mail.hrslab.yi.org (8.9.3/3.7W/DomainMaster) with ESMTP id JAA94928
	for <doc-jp@jp.freebsd.org>; Thu, 2 Nov 2000 09:57:51 +0900 (JST)
	(envelope-from hrs@eos.ocn.ne.jp)
To: doc-jp@jp.freebsd.org
In-Reply-To: <20001101230035.B57DC37B696@hub.freebsd.org>
References: <20001101230035.B57DC37B696@hub.freebsd.org>
X-Mailer: Mew version 1.94.1 on Emacs 19.34 / Mule 2.3 (SUETSUMUHANA)
Mime-Version: 1.0
Content-Type: Multipart/Mixed;
 boundary="--Next_Part(Thu_Nov__2_09:57:31_2000_518)--"
Content-Transfer-Encoding: 7bit
Date: Thu, 02 Nov 2000 09:57:50 +0900
From: Hiroki Sato <hrs@eos.ocn.ne.jp>
X-Dispatcher: imput version 20000228(IM140)
Lines: 220
Reply-To: doc-jp@jp.freebsd.org
Precedence: list
X-Distribute: distribute version 2.1 (Alpha) patchlevel 24e+000315
X-Sequence: doc-jp 7786
Subject: [doc-jp 7786] Re: FreeBSD Security Advisory: FreeBSD-SA-00:63.getnameinfo
Errors-To: owner-doc-jp@jp.freebsd.org
Sender: owner-doc-jp@jp.freebsd.org
X-Originator: hrs@eos.ocn.ne.jp

----Next_Part(Thu_Nov__2_09:57:31_2000_518)--
Content-Type: Text/Plain; charset=iso-2022-jp
Content-Transfer-Encoding: 7bit

$B:4F#!wEl5~M}2JBg3X$G$9!#(B

 00:63 $B$NK]Lu$G$9!#(B


----Next_Part(Thu_Nov__2_09:57:31_2000_518)--
Content-Type: Text/Plain; charset=iso-2022-jp
Content-Disposition: attachment; filename="00:63"
Content-Transfer-Encoding: 7bit

 $B$3$N%a!<%k$O(B, announce-jp $B$KN.$l$?(B

  Subject: FreeBSD Security Advisory: FreeBSD-SA-00:63.getnameinfo
  From: FreeBSD Security Advisories <security-advisories@freebsd.org>
  Date: Wed,  1 Nov 2000 15:00:35 -0800 (PST)
  Message-Id: <20001101230035.B57DC37B696@hub.freebsd.org>
  X-Sequence: 

 $B$rF|K\8lLu$7$?$b$N$G$9(B. 

 $B$3$N4+9p$NCf$G>R2p$5$l$F$$$k(B WWW $B%5%$%H(B http://www.FreeBSD.org/ $B$*$h$S(B
 FTP $B%5%$%H(B ftp://ftp.FreeBSD.org/ $B$K$O(B, $BF|K\$N%_%i!<%5%$%H$,B8:_$7$^$9(B.
 $B%_%i!<%5%$%H$rMxMQ$9$k$K$O(B,
 http://www.FreeBSD.org/ $B$r(B http://www.jp.FreeBSD.org/www.freebsd.org/ $B$K(B,
 ftp://ftp.FreeBSD.org/ $B$r(B ftp://ftp.jp.FreeBSD.org/ $B$K(B,
 $B$=$l$>$lCV$-49$($F$/$@$5$$(B.

 $B%M%C%H%o!<%/$N:.;($r4KOB$9$k$?$a(B, $B$^$:$O%_%i!<%5%$%H$NMxMQ$r(B
 $B9MN8$9$k$h$&$*4j$$$7$^$9(B.  $B%_%i!<%5%$%H$K4X$9$k>\:Y$O(B

  http://www.FreeBSD.org/handbook/mirror.html ($B1QJ8(B)
  http://www.FreeBSD.org/ja/handbook/mirror.html ($BF|K\8lLu(B)

 $B$K(B, $B$^$?(B, $B2a5n$NF|K\8lHG%;%-%e%j%F%#4+9p$O(B

  http://www.FreeBSD.org/ja/security/

 $B$K$^$H$a$i$l$F$$$^$9(B.

 $B86J8$O(B PGP $B=pL>$5$l$F$$$^$9$,(B, $B$3$NF|K\8lLu$O(B PGP $B=pL>$5$l$F$$$^$;$s(B. 
 $B%Q%C%AEy$NFbMF$,2~cb$5$l$F$$$J$$$3$H$r3NG'$9$k$?$a$K(B PGP $B$N%A%'%C%/$r(B
 $B9T$J$&$K$O(B, $B86J8$r;2>H$7$F$/$@$5$$(B. 

 $BF|K\8lLu$O(B FreeBSD $BF|K\8l%I%-%e%a%s%F!<%7%g%s%W%m%8%'%/%H(B (doc-jp) $B$,;29M$N(B
 $B$?$a$KDs6!$9$k$b$N$G(B, doc-jp $B$O(B $B$=$NFbMF$K$D$$$F$$$+$J$kJ]>Z$b$$$?$7$^$;$s(B.
 $BF|K\8lLu$K$D$$$F$N$*Ld$$9g$o$;$O(B doc-jp@jp.FreeBSD.org $B$^$G$*4j$$$7$^$9(B.

--($B$3$3$+$i(B)
=============================================================================
FreeBSD-SA-00:63                                           Security Advisory
                                                                FreeBSD, Inc.

$B%H%T%C%/(B:	getnameinfo function allows remote denial of service

$BJ,N`(B:		core
$B%b%8%e!<%k(B:	libc
$B9pCNF|(B:		2000-11-01
$B%/%l%8%C%H(B:	Pavel Kankovsky <peak@argo.troja.mff.cuni.cz>
$B1F6AHO0O(B:	FreeBSD 4.x (4.2 $B$h$jA0$N$9$Y$F$N%j%j!<%9(B),
                $B=$@5F|0JA0$N(B 4.1.1-STABLE
$B=$@5F|(B:		2000/09/25 (FreeBSD 4.1.1-STABLE)
FreeBSD $B$K8GM-$+(B:	NO

I.   $BGX7J(B - Background

The getnameinfo() function is part of the protocol-independent
resolver library from the KAME project.

getnameinfo() $B4X?t$O(B, KAME $B%W%m%8%'%/%H$N(B
$B%W%m%H%3%kHs0MB8%j%>%k%P%i%$%V%i%j$K4^$^$l$F$$$k$b$N$G$9(B.

II.  $BLdBj$N>\:Y(B - Problem Description

An off-by-one error exists in the processing of DNS hostnames which
allows a long DNS hostname to crash the getnameinfo() function when an
address resolution of the hostname is performed (e.g. in response to a
connection to a service which makes use of getnameinfo()).

$B$3$N%i%$%V%i%j$N(B DNS $B%[%9%HL>$r=hM}$9$kItJ,$K$O(B, $B%[%9%HL>$N(B
$B%"%I%l%92r7h$r9T$J$&:](B ($B$?$H$($P%5!<%S%9$KBP$9$k@\B3$K(B
$BH?1~$9$k:]$K(B getnameinfo() $B4X?t$,8F$P$l$^$9(B) $B$K(B
$BD9$$(B DNS $B%[%9%HL>$rF~$l$k$3$H$G(B, getnameinfo() $B4X?t$r(B
$B%/%i%C%7%e$5$;$k$3$H$,$G$-$k$h$&$J!V0l$D0c$$!W$N%(%i!<$,B8:_$7$^$9(B. 

 [$BLuCm(B] $B!V0l$D0c$$!W%(%i!<(B ($B86J8(B: off-by-one error) $B$K$D$$$F$O(B
        $BE:IU$N=$@5%Q%C%A$r;2>H$7$F$/$@$5$$(B.

Under the following conditions, this bug can be used as a denial of
service attack against vulnerable services:

$B$3$N%P%0$O0J2<$N>r7o2<$K$*$$$F(B, $B<eE@$r;}$D%5!<%S%9$KBP$9$k(B
$B%5!<%S%9K832967b$KMxMQ$5$l$k2DG=@-$,$"$j$^$9(B.

* The attacker must control their DNS server.
* $B967b<T$,<+J,$N(B DNS $B%5!<%P$rA`:n$G$-$k$3$H(B.

* The service must be run as a persistent daemon (i.e. running
  "standalone", not spawned as-needed from a supervisor process such
  as inetd)
* $B%5!<%S%9$,91>oE*$J%G!<%b%s$H$7$F<B9T$5$l$F$$$k$3$H(B ($B$D$^$j(B
  inetd $B$J$I$N4IM}MQ%W%m%;%9$+$iI,MW$K1~$8$F8F$S=P$5$l$k$N$G$O$J$/(B,
  $B!V%9%?%s%I%"%m%s!W$GF0:n$7$F$$$k$3$H(B).

* The daemon must perform the getnameinfo() call on the remote
  hostname prior to forking a child process to handle the connection
  (otherwise it is just the child process which dies, and the parent
  remains running).
* $B$=$N%G!<%b%s$,(B, $B@\B3$r=hM}$9$k;R%W%m%;%9$r(B fork $B$9$kA0$K(B
  $B%j%b!<%H$N%[%9%HL>$G(B getnameinfo() $B4X?t$r8F$S=P$7$F$$$k$3$H(B
  ($B$b$7$=$&$G$J$1$l$P(B, $BC1$K;R%W%m%;%9$,=*N;$9$k$@$1$G?F%W%m%;%9$O(B
  $B<B9T$5$lB3$1$^$9(B).

* The daemon is not automatically restarted by a "watchdog" process.
* $B$=$N%G!<%b%s$,(B, $B%G!<%b%s$r4F;k$9$kB>$N%W%m%;%9$K$h$C$F<+F0E*$K(B
  $B:F5/F0$5$l$J$$$3$H(B.

All released versions of FreeBSD 4.x prior to the correction date
including 4.0, 4.1, and 4.1.1 are vulnerable to this problem, but it
was fixed in the 4.1.1-STABLE branch prior to the release of FreeBSD
4.2-RELEASE.  The FreeBSD 3.x branch is unaffected since it does not
include the KAME code.

FreeBSD 4.0, 4.1, 4.1.1 $B$r4^$`(B, $B=$@5F|0JA0$N$9$Y$F$N(B
FreeBSD 4.x $B%j%j!<%9$,$3$NLdBj$N1F6A$r<u$1$^$9(B.  $BLdBjE@$N=$@5$O(B
FreeBSD 4.2-RELEASE $B$N8x3+A0$N(B 4.1.1-STABLE $B%V%i%s%A$G9T$J$o$l$^$7$?(B.
FreeBSD 3.x $B%V%i%s%A$O(B KAME $B$N%3!<%I$,4^$^$l$F$$$J$$$?$a(B, $B$3$NLdBj$N(B
$B1F6A$O$"$j$^$;$s(B.

Note that this vulnerability is not believed to pose a vulnerability
for any servers included in the FreeBSD base system.  It is only a
potential problem for certain third party servers fulfilling the above
conditions (none of which are currently known).  Therefore the impact
on the vast majority of FreeBSD systems is expected to be nonexistent.

$B$?$@$7(B, $B$3$N%;%-%e%j%F%#>e$N<eE@$O(B FreeBSD $B%Y!<%9%7%9%F%`$K4^$^$l$k(B
$B$$$:$l$N%5!<%P%W%m%0%i%`$K$*$$$F$b<eE@$K$O$J$i$J$$$H9M$($i$l$F$$$^$9(B.
$B$3$l$O(B ($B8=;~E@$G$O0l$D$b8+$D$+$C$F$$$^$;$s$,(B) $B>e5-$N>r7o$r$9$Y$F(B
$BK~$?$9$h$&$J%5!<%I%Q!<%F%#@=$N%5!<%P$K$*$$$F$N$_(B, $B@x:_E*$JLdBj$H(B
$B$J$k$b$N$G$"$j(B, $B$[$\$9$Y$F$N(B FreeBSD $B%7%9%F%`$O<B:]$K1F6A$r(B
$B<u$1$J$$$@$m$&$H9M$($i$l$^$9(B.

III. $B1F6AHO0O(B - Impact

Remote users may be able to cause a very small class of network
servers to terminate abnormally, causing a denial of service
condition.

$B%j%b!<%H%f!<%6$O6K0lIt$N(B ($BLuCm(B: II $B$N>r7o$rK~$?$9(B) $B%M%C%H%o!<%/%5!<%P$K(B
$BBP$7(B, $B0[>o=*N;$r0z$-5/$3$7$F%5!<%S%9ITG=>uBV$K4Y$i$;$k$3$H$,2DG=$G$9(B.

IV.  $B2sHrJ}K!(B - Workaround

None practical.
$B8=<BE*$J2sHrJ}K!$O$"$j$^$;$s(B.

V.   $B2r7h:v(B - Solution

One of the following:
$B<!$N$$$:$l$+$K=>$C$F$/$@$5$$(B.

1) Upgrade your vulnerable FreeBSD 4.x system to 4.1.1-STABLE after
the correction date.
1) $B<eE@$r;}$C$?(B FreeBSD 4.x $B%7%9%F%`$r(B, $B=$@5F|0J9_$N(B
   4.1.1-STABLE $B$K%"%C%W%0%l!<%I$7$^$9(B.

2) Apply the patch below and recompile the relevant files:
2) $B2<$N=$@5%Q%C%A$rE,MQ$7(B, $B4XO"%U%!%$%k$r:F9=C[$7$F$/$@$5$$(B.

Either save this advisory to a file, or download the patch and
detached PGP signature from the following locations, and verify the
signature using your PGP utility.
$B$3$N4+9p$r%U%!%$%k$KJ]B8$9$k$+(B, $B=$@5%Q%C%A$H(B PGP $B=pL>$r0J2<$N>l=j$+$i(B
$B%@%&%s%m!<%I$7(B, PGP $B%f!<%F%#%j%F%#$r;H$C$F=pL>$r3NG'$7$^$9(B.

ftp://ftp.freebsd.org/pub/FreeBSD/CERT/patches/SA-00:63/getnameinfo.patch
ftp://ftp.freebsd.org/pub/FreeBSD/CERT/patches/SA-00:63/getnameinfo.patch.asc

Execute the following commands as root:
root $B8"8B$G<!$N%3%^%s%I$r<B9T$7$^$9(B.

# cd /usr/src/lib/libc
# patch -p < /path/to/patch_or_advisory
# make depend && make all install

Patch for vulnerable systems:
$B<eE@$r;}$C$?%7%9%F%`MQ$N=$@5%Q%C%A(B:

    --- net/getnameinfo.c	2000/07/05 05:09:17	1.5
    +++ net/getnameinfo.c	2000/09/25 23:04:36	1.6
    @@ -154,12 +153,12 @@
     				(flags & NI_DGRAM) ? "udp" : "tcp");
     		}
     		if (sp) {
    -			if (strlen(sp->s_name) > servlen)
    +			if (strlen(sp->s_name) + 1 > servlen)
     				return ENI_MEMORY;
     			strcpy(serv, sp->s_name);
     		} else {
     			snprintf(numserv, sizeof(numserv), "%d", ntohs(port));
    -			if (strlen(numserv) > servlen)
    +			if (strlen(numserv) + 1 > servlen)
     				return ENI_MEMORY;
     			strcpy(serv, numserv);
     		}
    @@ -253,7 +252,7 @@
     					*p = '\0';
     			}
     #endif
    -			if (strlen(hp->h_name) > hostlen) {
    +			if (strlen(hp->h_name) + 1 > hostlen) {
     				freehostent(hp);
     				return ENI_MEMORY;
     			}
$hrs: FreeBSD-SA/00:63,v 1.1 2000/11/02 00:55:22 hrs Exp $

----Next_Part(Thu_Nov__2_09:57:31_2000_518)----
