Home » Mailing list archives » netbsd-announce » 2006 » March » 29

NetBSD Security Advisory 2006-004: Denial of services issues with pf

Previous message: [thread] [date] [author]
Next message: [thread] [date] [author]
[view in full thread]
From: NetBSD Security-Officer <security-officer@...>
Subject: NetBSD Security Advisory 2006-004: Denial of services issues with pf
Date: Wednesday, March 29, 2006 - 9:30 pm

-----BEGIN PGP SIGNED MESSAGE-----

Hash: SHA1


		 NetBSD Security Advisory 2006-004

		 =================================


Topic:		Denial of services issues with pf


Version:	NetBSD-current:	source prior to January 25, 2006

		NetBSD 3.0:	affected

		NetBSD 2.1:	not affected

		NetBSD 2.0.*:	not affected

		NetBSD 2.0:	not affected

		NetBSD 1.6.*:	not affected

		NetBSD 1.6:	not affected


Severity:	Denial of service


Fixed:		NetBSD-current:		January 25, 2006

		NetBSD-3-0 branch: 	January 28, 2006

						(3.0.1 will include the fix)

		NetBSD-3 branch: 	January 28, 2006


Abstract

========


There is a logical bug in pf's scrub fragment cache, which in certain

configurations may lead to a remotely exploitable denial of service

attack.


This vulnerability has been assigned CVE reference CVE-2006-0381.


Technical Details

=================


When 'scrub fragment crop/drop-ovl' is used, certain combinations of fragments

cause double insertion into the fragment cache, which violates an

invariant, and subsequently triggers a kernel panic through KASSERT().


pf is not enabled by default on NetBSD.


Solutions and Workarounds

=========================


Do not use 'scrub fragment drop-ovl' or 'scrub fragment crop' rules on NetBSD

systems where pf has been enabled.


For all NetBSD versions, if you are using pf, you need to obtain

fixed kernel sources, rebuild and install the new kernel, and reboot

the system.


The fixed source may be obtained from the NetBSD CVS repository.


The following instructions briefly summarize how to upgrade your

kernel.  In these instructions, replace:


  ARCH     with your architecture (from uname -m), and

  KERNCONF with the name of your kernel configuration file.


To update from CVS, re-build, and re-install the kernel:


	# cd src

	# cvs update -d -P src/sys/dist/pf/net/pf_norm.c

	# ./build.sh kernel=KERNCONF

	# mv /netbsd /netbsd.old

	# cp sys/arch/ARCH/compile/obj/KERNCONF/netbsd /netbsd

	# shutdown -r now


For more information on how to do this, see:


	http://www.NetBSD.org/guide/en/chap-kernel.html


Thanks To

=========


Daniel Hartmeier for notification of the issue and a suggested fix.

Peter Postma for implementing the fix in the NetBSD CVS tree.


Revision History

================


	2006-03-29	Initial release


More Information

================


Advisories may be updated as new information becomes available.

The most recent version of this advisory (PGP signed) can be found at

  ftp://ftp.NetBSD.org/pub/NetBSD/security/advisories/NetBSD-SA2006-004.tx...


Information about NetBSD and NetBSD security can be found at

http://www.NetBSD.org/ and http://www.NetBSD.org/Security/.


Copyright 2006, The NetBSD Foundation, Inc.  All Rights Reserved.

Redistribution permitted only in full, unmodified form.


$NetBSD: NetBSD-SA2006-004.txt,v 1.7 2006/03/29 11:14:28 adrianp Exp $


-----BEGIN PGP SIGNATURE-----

Version: GnuPG v1.4.2.2 (NetBSD)


iQCVAwUBRCsC7D5Ru2/4N2IFAQJAIgP7BBovVKFuB82H+q4p8lN7ChIgzeCSzEHU

pu4sX5Od0f40fVDi97pvM14x1aWOdR81VpE7t7MyouSi7XIjMN1/b64ZP1L/Ks+3

6Kk9guTWkeDja1bAhW3V7WL5XURudSE7NZgGeKbS/CWzpH8mLYpTBE1vl5soumKi

qofNlxZVbKQ=

=o1H0

-----END PGP SIGNATURE-----
Previous message: [thread] [date] [author]
Next message: [thread] [date] [author]
Messages in current thread:
NetBSD Security Advisory 2007-005: IPv6 Type 0 Routing Header, NetBSD Security-Officer, (Thu Sep 13, 5:56 pm)
NetBSD developer's summit @ NYCBSDCon 2008, Jan Schaumann, (Sat Jul 12, 3:40 pm)
NetBSD Security Advisory 2008-001: file(1) Integer overflow, NetBSD Security-Officer, (Thu Feb 28, 7:36 pm)
New "regional" mailing lists, Luke Mewburn, (Tue May 20, 11:07 pm)
Summer of Code projects selected, Jan Schaumann, (Mon Apr 20, 10:44 pm)
Regional-pt mailing list is now available, Christos Zoulas, (Sun Jan 25, 3:02 pm)
The NetBSD project celebrates its fifteenth anniversary, Alistair Crooks, (Thu Mar 20, 2:57 am)
New NetBSD Developer, Simas Mockevicius, (Wed Nov 3, 1:00 pm)
NetBSD Security Advisory 2004-010: Insufficient argument val..., NetBSD Security-Officer, (Fri Dec 17, 1:29 am)
NetBSD Security Advisory 2008-011: ICMPv6 MLD query, NetBSD Security-Officer, (Thu Sep 4, 5:52 pm)
cvsweb maintenance, SODA Noriyuki, (Mon May 2, 7:25 am)
Announcing NetBSD and the Google "Summer of Code" Projects, Hubert Feyrer, (Sat Jun 25, 9:44 pm)
Brief outage of ftp.netbsd.org TODAY, 2009-07-14 02:45 UTC, Thor Simon, (Mon Jul 13, 8:35 pm)
Thank you for your donations!, Christos Zoulas, (Tue Jul 19, 9:05 am)
Summary of Changes to the Packages Collection in September 2..., Alistair Crooks, (Sat Oct 22, 8:41 am)
NetBSD 5.0_RC1 binaries available for download, Soren Jacobsen, (Thu Jan 29, 4:38 pm)
Manuel Bouyer interviewed on NetBSD/xen integration, Emmanuel Dreyfus, (Sun Feb 19, 4:24 am)
NetBSD Security Advisory 2006-004: Denial of services issues..., NetBSD Security-Officer, (Wed Mar 29, 9:30 pm)
NetBSD Security Advisory 2006-012: SIOCGIFALIAS ioctl may ca..., NetBSD Security-Officer, (Wed Apr 12, 10:34 pm)
NetBSD/vax is now ELF; New snapshot available, Matt Thomas, (Sun Mar 31, 10:56 pm)
NetBSD Security Advisory 2002-006: buffer overrun in libc DN..., NetBSD Security Officer, (Thu Jun 27, 1:14 pm)
NetBSD Security Advisory 2006-017: Sendmail malformed multip..., NetBSD Security-Officer, (Wed Jun 14, 5:44 pm)
NetBSD Security Advisory 2006-019: Malicious PPP options can..., NetBSD Security-Officer, (Wed Aug 23, 5:32 pm)
Mailinglist Archives not updated, Jan Schaumann, (Mon Jan 6, 2:57 pm)