Home » Mailing list archives » netbsd-announce » 2008 » September » 4

NetBSD Security Advisory 2008-011: ICMPv6 MLD query

Previous message: [thread] [date] [author]
Next message: [thread] [date] [author]
[view in full thread]
From: NetBSD Security-Officer <security-officer@...>
To: <netbsd-announce@...>
Subject: NetBSD Security Advisory 2008-011: ICMPv6 MLD query
Date: Thursday, September 4, 2008 - 5:52 pm

-----BEGIN PGP SIGNED MESSAGE-----

Hash: SHA1


		 NetBSD Security Advisory 2008-011

		 =================================


Topic:		ICMPv6 MLD query


Version:	NetBSD-current:		affected

		NetBSD 4.0:		affected

		NetBSD 3.1.*:		not affected

		NetBSD 3.1:		not affected

		NetBSD 3.0.*:		not affected

		NetBSD 3.0:		not affected


Severity:	Denial of service


Fixed:		NetBSD-current:		August 22, 2008

		NetBSD-4-0 branch:	August 23, 2008

			(4.0.1 will include the fix)

		NetBSD-4 branch:	August 23, 2008

			(4.1 will include the fix)


Abstract

========


A malformed ICMPv6 MLD (RFC 2710) query directed at a NetBSD host can

result in a denial of service (system panic).


This vulnerability has been assigned CVE-2008-2464.


Technical Details

=================


An error occurs when processing an MLD packet with certain values

in the Maximum Response Delay field.


Solutions and Workarounds

=========================


Only kernels compiled with the following option are vulnerable to this issue:


	options INET6


As a temporary workaround recompile the kernel with the above option

commented out.  The default NetBSD GENERIC kernels have this

option enabled.


For all NetBSD versions, you need to obtain fixed kernel sources,

rebuild and install the new kernel, and reboot the system.


The fixed source may be obtained from the NetBSD CVS repository.

The following instructions briefly summarise how to upgrade your

kernel.  In these instructions, replace:


  ARCH     with your architecture (from uname -m), and

  KERNCONF with the name of your kernel configuration file.    


To update from CVS, re-build, and re-install the kernel:


        # cd src

        # cvs update -d -P sys/netinet6/mld6.c

        # ./build.sh kernel=KERNCONF

        # mv /netbsd /netbsd.old

        # cp sys/arch/ARCH/compile/obj/KERNCONF/netbsd /netbsd

        # shutdown -r now


For more information on how to do this, see:    


   http://www.NetBSD.org/guide/en/chap-kernel.html


Thanks To

=========


Matt Thomas for the fix and CERT-FI for co-ordination of the issue.

Miikka Saukko, Ossi Herrala and Jukka Taimisto from the CROSS project

at Codenomicon Ltd. are credited with discovering this issue and providing

an initial fix.


Revision History

================


	2008-09-04	Initial release


More Information

================


Advisories may be updated as new information becomes available.

The most recent version of this advisory (PGP signed) can be found at

  ftp://ftp.NetBSD.org/pub/NetBSD/security/advisories/NetBSD-SA2008-011.tx...


Information about NetBSD and NetBSD security can be found at

http://www.NetBSD.org/ and http://www.NetBSD.org/Security/.


Copyright 2008, The NetBSD Foundation, Inc.  All Rights Reserved.

Redistribution permitted only in full, unmodified form.


$NetBSD: NetBSD-SA2008-011.txt,v 1.4 2008/09/04 20:32:25 adrianp Exp $


-----BEGIN PGP SIGNATURE-----

Version: GnuPG v1.4.9 (NetBSD)


iQCVAwUBSMBF5T5Ru2/4N2IFAQJlswQAwkQI9ituVlp6GTjvruX0ufDYjnWaN2rJ

p37o4AdBXlyQlsnlvyAuDgmW9daTaaRkfKeW9xyk5lI6Z7quRa/rf+r6s8Xk2YA+

iICaaGR5TBPzkSmJ1d7qgdiPvJhstsAzfazazTXlz+GixQzWOUb6P+AJSGbjGX3L

9Ziphg4ZnIA=

=aChz

-----END PGP SIGNATURE-----
Previous message: [thread] [date] [author]
Next message: [thread] [date] [author]
Messages in current thread:
NetBSD Security Advisory 2007-005: IPv6 Type 0 Routing Header, NetBSD Security-Officer, (Thu Sep 13, 5:56 pm)
NetBSD developer's summit @ NYCBSDCon 2008, Jan Schaumann, (Sat Jul 12, 3:40 pm)
NetBSD Security Advisory 2008-001: file(1) Integer overflow, NetBSD Security-Officer, (Thu Feb 28, 7:36 pm)
New "regional" mailing lists, Luke Mewburn, (Tue May 20, 11:07 pm)
Summer of Code projects selected, Jan Schaumann, (Mon Apr 20, 10:44 pm)
Regional-pt mailing list is now available, Christos Zoulas, (Sun Jan 25, 3:02 pm)
The NetBSD project celebrates its fifteenth anniversary, Alistair Crooks, (Thu Mar 20, 2:57 am)
New NetBSD Developer, Simas Mockevicius, (Wed Nov 3, 1:00 pm)
NetBSD Security Advisory 2004-010: Insufficient argument val..., NetBSD Security-Officer, (Fri Dec 17, 1:29 am)
NetBSD Security Advisory 2008-011: ICMPv6 MLD query, NetBSD Security-Officer, (Thu Sep 4, 5:52 pm)
cvsweb maintenance, SODA Noriyuki, (Mon May 2, 7:25 am)
Announcing NetBSD and the Google "Summer of Code" Projects, Hubert Feyrer, (Sat Jun 25, 9:44 pm)
Brief outage of ftp.netbsd.org TODAY, 2009-07-14 02:45 UTC, Thor Simon, (Mon Jul 13, 8:35 pm)
Thank you for your donations!, Christos Zoulas, (Tue Jul 19, 9:05 am)
Summary of Changes to the Packages Collection in September 2..., Alistair Crooks, (Sat Oct 22, 8:41 am)
NetBSD 5.0_RC1 binaries available for download, Soren Jacobsen, (Thu Jan 29, 4:38 pm)
Manuel Bouyer interviewed on NetBSD/xen integration, Emmanuel Dreyfus, (Sun Feb 19, 4:24 am)
NetBSD Security Advisory 2006-004: Denial of services issues..., NetBSD Security-Officer, (Wed Mar 29, 9:30 pm)
NetBSD Security Advisory 2006-012: SIOCGIFALIAS ioctl may ca..., NetBSD Security-Officer, (Wed Apr 12, 10:34 pm)
NetBSD/vax is now ELF; New snapshot available, Matt Thomas, (Sun Mar 31, 10:56 pm)
NetBSD Security Advisory 2002-006: buffer overrun in libc DN..., NetBSD Security Officer, (Thu Jun 27, 1:14 pm)
NetBSD Security Advisory 2006-017: Sendmail malformed multip..., NetBSD Security-Officer, (Wed Jun 14, 5:44 pm)
NetBSD Security Advisory 2006-019: Malicious PPP options can..., NetBSD Security-Officer, (Wed Aug 23, 5:32 pm)
Mailinglist Archives not updated, Jan Schaumann, (Mon Jan 6, 2:57 pm)