-----BEGIN PGP SIGNED MESSAGE-----
=============================================================================
FreeBSD-SA-00:63 Security Advisory
FreeBSD, Inc.
Topic: getnameinfo function allows remote denial of service
Category: core
Module: libc
Announced: 2000-11-01
Credits: Pavel Kankovsky <[email protected]>
Affects: FreeBSD 4.x (all releases prior to 4.2), 4.1.1-STABLE prior
to the correction date.
Corrected: 2000/09/25 (FreeBSD 4.1.1-STABLE)
FreeBSD only: NO
I. Background
The getnameinfo() function is part of the protocol-independent
resolver library from the KAME project.
II. Problem Description
An off-by-one error exists in the processing of DNS hostnames which
allows a long DNS hostname to crash the getnameinfo() function when an
address resolution of the hostname is performed (e.g. in response to a
connection to a service which makes use of getnameinfo()).
Under the following conditions, this bug can be used as a denial of
service attack against vulnerable services:
All released versions of FreeBSD 4.x prior to the correction date
including 4.0, 4.1, and 4.1.1 are vulnerable to this problem, but it
was fixed in the 4.1.1-STABLE branch prior to the release of FreeBSD
4.2-RELEASE. The FreeBSD 3.x branch is unaffected since it does not
include the KAME code.
Note that this vulnerability is not believed to pose a vulnerability
for any servers included in the FreeBSD base system. It is only a
potential problem for certain third party servers fulfilling the above
conditions (none of which are currently known). Therefore the impact
on the vast majority of FreeBSD systems is expected to be nonexistent.
III. Impact
Remote users may be able to cause a very small class of network
servers to terminate abnormally, causing a denial of service
condition.
IV. Workaround
None practical.
V. Solution
One of the following:
1) Upgrade your vulnerable FreeBSD 4.x system to 4.1.1-STABLE after
the correction date.
2) Apply the patch below and recompile the relevant files:
Either save this advisory to a file, or download the patch and
detached PGP signature from the following locations, and verify the
signature using your PGP utility.
ftp://ftp.freebsd.org/pub/FreeBSD/CERT/patches/SA-00:63/getnameinfo.patch
ftp://ftp.freebsd.org/pub/FreeBSD/CERT/patches/SA-00:63/getnameinfo.patch.asc
Execute the following commands as root:
Patch for vulnerable systems:
--- net/getnameinfo.c 2000/07/05 05:09:17 1.5
+++ net/getnameinfo.c 2000/09/25 23:04:36 1.6
@@ -154,12 +153,12 @@
(flags & NI_DGRAM) ? "udp" : "tcp");
}
if (sp) {
- if (strlen(sp->s_name) > servlen)
+ if (strlen(sp->s_name) + 1 > servlen)
return ENI_MEMORY;
strcpy(serv, sp->s_name);
} else {
snprintf(numserv, sizeof(numserv), "%d", ntohs(port));
- if (strlen(numserv) > servlen)
+ if (strlen(numserv) + 1 > servlen)
return ENI_MEMORY;
strcpy(serv, numserv);
}
@@ -253,7 +252,7 @@
*p = '\0';
}
#endif
- if (strlen(hp->h_name) > hostlen) {
+ if (strlen(hp->h_name) + 1 > hostlen) {
freehostent(hp);
return ENI_MEMORY;
}
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.4 (FreeBSD)
Comment: For info see http://www.gnupg.org
iQCVAwUBOgCgVlUuHi5z0oilAQGqfwP/SYLG0yD0uR4wdPHy5S9eXH4HqtNrVpF7
NlN3iMjHrzIDqeFSYoRTbMEhrbTTGMWYIEadadW9zjlnHfGNRniYx2oOhm+0tqsI
C3wlqsGAo2GXsXfr1hOpcVc1GqLhsK3oLgz9RRMoMlRWJ+K0bHHLwKlB9uEoxPJ2
X/WHJ//RQXI=
=YFwv
-----END PGP SIGNATURE-----
To Unsubscribe: send mail to [email protected]
with "unsubscribe freebsd-security" in the body of the message