-----BEGIN PGP SIGNED MESSAGE-----
		 NetBSD Security Advisory 2004-002

		 =================================
Topic:		Inconsistent IPv6 path MTU discovery handling
Version:	NetBSD-current:	source prior to February 5, 2004

		netBSD 1.6.2:	not affected (fixed)

		NetBSD 1.6.1:	affected

		NetBSD 1.6:	affected

		NetBSD-1.5.x:	not affected
Severity:	Remote kernel panic could be possible
Fixed:		NetBSD-current:		February 5, 2004

		NetBSD-1.6 branch:	February 9, 2004 (1.6.2 includes the fix)

		NetBSD-1.5 branch:	not affected
Abstract

========
A malicious party can cause a remote kernel panic by using ICMPv6 "too

big" messages.  
Technical Details

=================
Once a specially-crafted ICMPv6 "too big" message is sent to a victim

node, a routing table entry with a small path-MTU is installed.  
The victim system may later experience a kernel panic (due to a kernel

stack overflow) if a TCP session that uses the routing table entry is

later established.
For further details, see:
	http://www.guninski.com/obsdmtu.html
Solutions and Workarounds

=========================
The default NetBSD kernels (GENERIC*) ship with IPv6 compiled in.  If

you are using a kernel without IPv6, your system is not affected.

Kernels with the "options INET6" line removed, or commented out, from

the kernel configuration file do not include IPv6.
Additionally, an attacker requires IPv6 connectivity to the host to

send the packets that exploit this vulnerability.  Note, however, that

systems without external IPv6 routed connectivity may still be exposed

via LAN or similar connections, where neighbouring systems can send

IPv6 packets to the node.  This potentially includes shared external

segments and wireless networks.
The following instructions describe how to upgrade your kernel by

updating your source tree and rebuilding and installing a new version

of the kernel.  After replacing the kernel, a reboot is necessary.
* NetBSD-current:
	Systems running NetBSD-current dated from before 2004-02-04

	should be upgraded to NetBSD-current dated 2004-02-05 or later.
	The following directories need to be updated from the

	netbsd-current CVS branch (aka HEAD):

		sys/netinet

		sys/netinet6
	To update from CVS, re-build, and re-install kernel:
		# cd src

		# cvs update -d -P sys/netinet sys/netinet6

		# cd sys/arch/ARCH/conf

		# config KERNELCONF

		# cd ../../compile/KERNELCONF

		# make clean depend; make

		# mv /netbsd /netbsd.old

		# cp netbsd /
	Then perform a reboot.

		# reboot
* NetBSD 1.6, 1.6.1:
	The binary distributions of NetBSD 1.6 and 1.6.1 are vulnerable.
        * Binary patch:
	Binary patches are being provided, in the form of replacement

	kernels built with the patches from the GENERIC kernel

	configuration.  If you use a custom kernel configuration,

	these may not be suitable for you.
	NOTE: The same kernel includes fixes for NetBSD-SA2004-002 and

	NetBSD-SA2004-004. If you already updated for 2004-004, you do

	not need to perform these steps again.
        To apply the binary patch, perform the following steps,

        replacing ARCH with the NetBSD architecture you are running

        (i.e. i386):
        ftp://ftp.netbsd.org/pub/NetBSD/security/patches/SA2004-002-kernel/netbs...

        cd / && cp /path/to/ARCH-kernel.gz /

	gzip -d ARCH-kernel.gz
        The tar file will extract a new copy of:

                ARCH-kernel
	Back up your old kernel:

	mv netbsd netbsd.old
        Then either rename:

	mv ARCH-kernel netbsd
	or link, as per local site policy:

	ln ARCH-kernel netbsd
	Then, reboot.
        * Updating from sources:
	Systems running NetBSD 1.6 sources dated from before

	2004-02-08 should be upgraded from NetBSD 1.6 sources dated

	2004-02-09 or later.
	NetBSD 1.6.2 includes the fix.
	The following directories need to be updated from the

	netbsd-1-6 CVS branch:

		sys/netinet

		sys/netinet6
	To update from CVS, re-build, and re-install kernel:
		# cd src

		# cvs update -d -P -r netbsd-1-6 sys/netinet sys/netinet6

		# cd sys/arch/ARCH/conf

		# config KERNELCONF

		# cd ../../compile/KERNELCONF

		# make clean depend; make

		# mv /netbsd /netbsd.old

		# cp netbsd /
	Then perform a reboot.

		# reboot
Thanks To

=========
Georgi Guninski

Markus Friedl

Daniel Hartmeier

IIJ seil team
Revision History

================
	2004-02-18	Initial release
More Information

================
Advisories may be updated as new information becomes available.

The most recent version of this advisory (PGP signed) can be found at

  ftp://ftp.NetBSD.org/pub/NetBSD/security/advisories/NetBSD-SA2004-002.tx...
Information about NetBSD and NetBSD security can be found at

http://www.NetBSD.org/ and http://www.NetBSD.org/Security/.
Copyright 2004, The NetBSD Foundation, Inc.  All Rights Reserved.

Redistribution permitted only in full, unmodified form.
$NetBSD: NetBSD-SA2004-002.txt.asc,v 1.1 2004/02/18 14:13:24 david Exp $
-----BEGIN PGP SIGNATURE-----

Version: GnuPG v1.2.3 (NetBSD)
iQCVAwUBQDNz2D5Ru2/4N2IFAQEbcQP+MKBT8iS7hlZhQn24yIVDBo2NfkZKxBtH

kUnzsFBc6kce3ekWzRGqkC0xn7OpYbx99LEZQFIwpUfVNJmVyDOYP2WMQO2AERdw

lP+TRBQ2P90cF/q6RhYBpI7n3lsurehPXxgDiwYcyfgHTB7n2NxN/+2kTXwliRMz

ZRsBXm/cn/g=

=50/l

-----END PGP SIGNATURE-----