Vissza a www.andrews.hu-ra

    [guru] FreeBSD biztonsagi frissitesek


    DATE: Tue, 05 Jan 2010 00:43:06 +0100
    Az SSL/TLS protokollok session renegotiation sebezhetőségére a FreeBSD
    OpenSSL csomagjában letiltották az újraegyeztetést, hiszen ezt csak kevesen
    használják.
    
    Az rtld a környezeti változók kezelésének átalakítása miatt már nem
    távolít el minden veszélyes környezeti változót, így setuid root programok
    segítségével root jog szerezhető.
    
    A freebsd-update a /var/db/freebsd-update munkakönyvtárát olyan jogokkal
    hozza létre, hogy azt mindenki láthatja. Előfordulhat, hogy az alá mentett
    backup állományokhoz a támadó hozzáférhet, pedig az eredeti helyén nem
    tehette volna meg.
    
    
    --- Begin Message ---
    -----BEGIN PGP SIGNED MESSAGE-----
    Hash: SHA1
    
    =============================================================================
    FreeBSD-SA-09:15.ssl                                        Security Advisory
                                                              The FreeBSD Project
    
    Topic:          SSL protocol flaw
    
    Category:       contrib
    Module:         openssl
    Announced:      2009-12-03
    Credits:        Marsh Ray, Steve Dispensa
    Affects:        All supported versions of FreeBSD.
    Corrected:      2009-12-03 09:18:40 UTC (RELENG_8, 8.0-STABLE)
                    2009-12-03 09:18:40 UTC (RELENG_8_0, 8.0-RELEASE-p1)
                    2009-12-03 09:18:40 UTC (RELENG_7, 7.2-STABLE)
                    2009-12-03 09:18:40 UTC (RELENG_7_2, 7.2-RELEASE-p5)
                    2009-12-03 09:18:40 UTC (RELENG_7_1, 7.1-RELEASE-p9)
                    2009-12-03 09:18:40 UTC (RELENG_6, 6.4-STABLE)
                    2009-12-03 09:18:40 UTC (RELENG_6_4, 6.4-RELEASE-p8)
                    2009-12-03 09:18:40 UTC (RELENG_6_3, 6.3-RELEASE-p14)
    CVE Name:       CVE-2009-3555
    
    For general information regarding FreeBSD Security Advisories,
    including descriptions of the fields above, security branches, and the
    following sections, please visit <URL:http://security.FreeBSD.org/>.
    
    I.   Background
    
    The SSL (Secure Sockets Layer) and TLS (Transport Layer Security) protocols
    provide a secure communications layer over which other protocols can be
    utilized.  The most widespread use of SSL/TLS is to add security to the
    HTTP protocol, thus producing HTTPS.
    
    FreeBSD includes software from the OpenSSL Project which implements SSL
    and TLS.
    
    II.  Problem Description
    
    The SSL version 3 and TLS protocols support session renegotiation without
    cryptographically tying the new session parameters to the old parameters.
    
    III. Impact
    
    An attacker who can intercept a TCP connection being used for SSL or TLS
    can cause the initial session negotiation to take the place of a session
    renegotiation.  This can be exploited in several ways, including:
     * Causing a server to interpret incoming messages as having been sent
    under the auspices of a client SSL key when in fact they were not;
     * Causing a client request to be appended to an attacker-supplied
    request, potentially revealing to the attacker the contents of the client
    request (including any authentication parameters); and
     * Causing a client to receive a response to an attacker-supplied request
    instead of a response to the request sent by the client.
    
    IV.  Workaround
    
    No workaround is available.
    
    V.   Solution
    
    NOTE WELL: This update causes OpenSSL to reject any attempt to renegotiate
    SSL / TLS session parameters.  As a result, connections in which the other
    party attempts to renegotiate session parameters will break.  In practice,
    however, session renegotiation is a rarely-used feature, so disabling this
    functionality is unlikely to cause problems for most systems.
    
    Perform one of the following:
    
    1) Upgrade your vulnerable system to 6-STABLE, 7-STABLE, or 8-STABLE, or to
    the RELENG_8_0, RELENG_7_2, RELENG_7_1, RELENG_6_4, or RELENG_6_3 security
    branch dated after the correction date.
    
    2) To patch your present system:
    
    The following patches have been verified to apply to FreeBSD 6.3, 6.4,
    7.1, 7.2, and 8.0 systems.
    
    a) Download the relevant patch from the location below, and verify the
    detached PGP signature using your PGP utility.
    
    # fetch http://security.FreeBSD.org/patches/SA-09:15/ssl.patch
    # fetch http://security.FreeBSD.org/patches/SA-09:15/ssl.patch.asc
    
    b) Execute the following commands as root:
    
    # cd /usr/src
    # patch < /path/to/patch
    # cd /usr/src/secure/lib/libcrypto
    # make obj && make depend && make includes && make && make install
    
    NOTE: On the amd64 platform, the above procedure will not update the
    lib32 (i386 compatibility) libraries.  On amd64 systems where the i386
    compatibility libraries are used, the operating system should instead
    be recompiled as described in
    <URL:http://www.FreeBSD.org/handbook/makeworld.html>
    
    VI.  Correction details
    
    The following list contains the revision numbers of each file that was
    corrected in FreeBSD.
    
    CVS:
    
    Branch                                                           Revision
      Path
    - -------------------------------------------------------------------------
    RELENG_6
      src/crypto/openssl/ssl/s3_pkt.c                            1.1.1.10.2.1
      src/crypto/openssl/ssl/s3_srvr.c                           1.1.1.14.2.3
      src/crypto/openssl/ssl/s3_lib.c                            1.1.1.10.2.1
    RELENG_6_4
      src/UPDATING                                            1.416.2.40.2.12
      src/sys/conf/newvers.sh                                  1.69.2.18.2.14
      src/crypto/openssl/ssl/s3_pkt.c                           1.1.1.10.12.1
      src/crypto/openssl/ssl/s3_srvr.c                       1.1.1.14.2.1.6.2
      src/crypto/openssl/ssl/s3_lib.c                           1.1.1.10.12.1
    RELENG_6_3
      src/UPDATING                                            1.416.2.37.2.19
      src/sys/conf/newvers.sh                                  1.69.2.15.2.18
      src/crypto/openssl/ssl/s3_pkt.c                           1.1.1.10.10.1
      src/crypto/openssl/ssl/s3_srvr.c                       1.1.1.14.2.1.4.2
      src/crypto/openssl/ssl/s3_lib.c                           1.1.1.10.10.1
    RELENG_7
      src/crypto/openssl/ssl/s3_pkt.c                            1.1.1.12.2.1
      src/crypto/openssl/ssl/s3_srvr.c                           1.1.1.17.2.2
      src/crypto/openssl/ssl/s3_lib.c                            1.1.1.13.2.1
    RELENG_7_2
      src/UPDATING                                             1.507.2.23.2.8
      src/sys/conf/newvers.sh                                   1.72.2.11.2.9
      src/crypto/openssl/ssl/s3_pkt.c                            1.1.1.12.8.1
      src/crypto/openssl/ssl/s3_srvr.c                       1.1.1.17.2.1.2.1
      src/crypto/openssl/ssl/s3_lib.c                            1.1.1.13.8.1
    RELENG_7_1
      src/UPDATING                                            1.507.2.13.2.12
      src/sys/conf/newvers.sh                                   1.72.2.9.2.13
      src/crypto/openssl/ssl/s3_pkt.c                            1.1.1.12.6.1
      src/crypto/openssl/ssl/s3_srvr.c                           1.1.1.17.6.2
      src/crypto/openssl/ssl/s3_lib.c                            1.1.1.13.6.1
    RELENG_8
      src/crypto/openssl/ssl/s3_pkt.c                                 1.2.2.1
      src/crypto/openssl/ssl/s3_srvr.c                                1.3.2.1
      src/crypto/openssl/ssl/s3_lib.c                                 1.2.2.1
    RELENG_8_0
      src/UPDATING                                              1.632.2.7.2.4
      src/sys/conf/newvers.sh                                    1.83.2.6.2.4
      src/crypto/openssl/ssl/s3_pkt.c                                 1.2.4.1
      src/crypto/openssl/ssl/s3_srvr.c                                1.3.4.1
      src/crypto/openssl/ssl/s3_lib.c                                 1.2.4.1
    - -------------------------------------------------------------------------
    
    Subversion:
    
    Branch/path                                                      Revision
    - -------------------------------------------------------------------------
    stable/6/                                                         r200054
    releng/6.4/                                                       r200054
    releng/6.3/                                                       r200054
    stable/7/                                                         r200054
    releng/7.2/                                                       r200054
    releng/7.1/                                                       r200054
    - -------------------------------------------------------------------------
    
    VII. References
    
    http://extendedsubset.com/Renegotiating_TLS.pdf
    
    http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3555
    
    The latest revision of this advisory is available at
    http://security.FreeBSD.org/advisories/FreeBSD-SA-09:15.ssl.asc
    -----BEGIN PGP SIGNATURE-----
    Version: GnuPG v1.4.10 (FreeBSD)
    
    iEYEARECAAYFAksXg+oACgkQFdaIBMps37JenACfdPIoOc1uHHsBap0FkH1uctHp
    VeoAnirgLeaG00lD6Um6qJK2EjlU8hEg
    =dioq
    -----END PGP SIGNATURE-----
    
    
    
    

    --- End Message ---
    --- Begin Message ---
    -----BEGIN PGP SIGNED MESSAGE-----
    Hash: SHA1
    
    =============================================================================
    FreeBSD-SA-09:16.rtld                                       Security Advisory
                                                              The FreeBSD Project
    
    Topic:          Improper environment sanitization in rtld(1)
    
    Category:       core
    Module:         rtld
    Announced:      2009-12-03
    Affects:        FreeBSD 7.0 and later.
    Corrected:      2009-12-01 02:59:22 UTC (RELENG_8, 8.0-STABLE)
                    2009-12-03 09:18:40 UTC (RELENG_8_0, 8.0-RELEASE-p1)
                    2009-12-01 03:00:16 UTC (RELENG_7, 7.2-STABLE)
                    2009-12-03 09:18:40 UTC (RELENG_7_2, 7.2-RELEASE-p5)
                    2009-12-03 09:18:40 UTC (RELENG_7_1, 7.1-RELEASE-p9)
    CVE Name:       CVE-2009-4146, CVE-2009-4147
    
    For general information regarding FreeBSD Security Advisories,
    including descriptions of the fields above, security branches, and the
    following sections, please visit <URL:http://security.FreeBSD.org/>.
    
    I.   Background
    
    The run-time link-editor, rtld, links dynamic executable with their
    needed libraries at run-time.  It also allows users to explicitly
    load libraries via various LD_ environmental variables.
    
    II.  Problem Description
    
    When running setuid programs rtld will normally remove potentially
    dangerous environment variables.  Due to recent changes in FreeBSD
    environment variable handling code, a corrupt environment may
    result in attempts to unset environment variables failing.
    
    III. Impact
    
    An unprivileged user who can execute programs on a system can gain
    the privileges of any setuid program which he can run.  On most
    systems configurations, this will allow a local attacker to execute
    code as the root user.
    
    IV.  Workaround
    
    No workaround is available, but systems without untrusted local users,
    where all the untrusted local users are jailed superusers, and/or where
    untrusted users cannot execute arbitrary code (e.g., due to use of read
    only and noexec mount options) are not affected.
    
    Note that "untrusted local users" include users with the ability to
    upload and execute web scripts (CGI, PHP, Python, Perl etc.), as they
    may be able to exploit this issue.
    
    V.   Solution
    
    Perform one of the following:
    
    1) Upgrade your vulnerable system to 7-STABLE or 8-STABLE,
    or to the RELENG_8_0, RELENG_7_2, or RELENG_7_1 security branch dated
    after the correction date.
    
    2) To patch your present system:
    
    The following patches have been verified to apply to FreeBSD 7.1, 7.2,
    and 8.0 systems.
    
    a) Download the relevant patch from the location below, and verify the
    detached PGP signature using your PGP utility.
    
    [FreeBSD 7.x]
    # fetch http://security.FreeBSD.org/patches/SA-09:16/rtld7.patch
    # fetch http://security.FreeBSD.org/patches/SA-09:16/rtld7.patch.asc
    
    [FreeBSD 8.0]
    # fetch http://security.FreeBSD.org/patches/SA-09:16/rtld.patch
    # fetch http://security.FreeBSD.org/patches/SA-09:16/rtld.patch.asc
    
    b) Execute the following commands as root:
    
    # cd /usr/src
    # patch < /path/to/patch
    # cd /usr/src/libexec/rtld-elf
    # make obj && make depend && make && make install
    
    NOTE: On the amd64 platform, the above procedure will not update the
    ld-elf32.so.1 (i386 compatibility) run-time link-editor (rtld).  On
    amd64 systems where the i386 rtld are installed, the operating system
    should instead be recompiled as described in
    <URL:http://www.FreeBSD.org/handbook/makeworld.html>
    
    VI.  Correction details
    
    The following list contains the revision numbers of each file that was
    corrected in FreeBSD.
    
    CVS:
    
    Branch                                                           Revision
      Path
    - -------------------------------------------------------------------------
    RELENG_7
      src/libexec/rtld-elf/rtld.c                                   1.124.2.7
    RELENG_7_2
      src/UPDATING                                             1.507.2.23.2.8
      src/sys/conf/newvers.sh                                   1.72.2.11.2.9
      src/libexec/rtld-elf/rtld.c                               1.124.2.4.2.2
    RELENG_7_1
      src/UPDATING                                            1.507.2.13.2.12
      src/sys/conf/newvers.sh                                   1.72.2.9.2.13
      src/libexec/rtld-elf/rtld.c                               1.124.2.3.2.2
    RELENG_8
      src/libexec/rtld-elf/rtld.c                                   1.139.2.4
    RELENG_8_0
      src/UPDATING                                              1.632.2.7.2.4
      src/sys/conf/newvers.sh                                    1.83.2.6.2.4
      src/libexec/rtld-elf/rtld.c                               1.139.2.2.2.2
    - -------------------------------------------------------------------------
    
    Subversion:
    
    Branch/path                                                      Revision
    - -------------------------------------------------------------------------
    stable/7/                                                         r199981
    releng/7.2/                                                       r200054
    releng/7.1/                                                       r200054
    stable/8/                                                         r199980
    releng/8.0/                                                       r200054
    - -------------------------------------------------------------------------
    
    VII. References
    
    http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-4146
    http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-4147
    
    The latest revision of this advisory is available at
    http://security.FreeBSD.org/advisories/FreeBSD-SA-09:16.rtld.asc
    -----BEGIN PGP SIGNATURE-----
    Version: GnuPG v1.4.10 (FreeBSD)
    
    iEUEARECAAYFAksXg/IACgkQFdaIBMps37KrLwCdH4JsCrvdS1RGoGj7MlNgV3+/
    nhYAliVcz9tL8Ll6pYKpIalR740sZ5s=
    =jK/a
    -----END PGP SIGNATURE-----
    
    
    
    

    --- End Message ---
    --- Begin Message ---
    -----BEGIN PGP SIGNED MESSAGE-----
    Hash: SHA1
    
    =============================================================================
    FreeBSD-SA-09:17.freebsd-update                             Security Advisory
                                                              The FreeBSD Project
    
    Topic:          Inappropriate directory permissions in freebsd-update(8)
    
    Category:       core
    Module:         usr.sbin
    Announced:      2009-12-03
    Credits:        KAMADA Ken'ichi
    Affects:        All supported versions of FreeBSD.
    Corrected:      2009-12-03 09:18:40 UTC (RELENG_8, 8.0-STABLE)
                    2009-12-03 09:18:40 UTC (RELENG_8_0, 8.0-RELEASE-p1)
                    2009-12-03 09:18:40 UTC (RELENG_7, 7.2-STABLE)
                    2009-12-03 09:18:40 UTC (RELENG_7_2, 7.2-RELEASE-p5)
                    2009-12-03 09:18:40 UTC (RELENG_7_1, 7.1-RELEASE-p9)
                    2009-12-03 09:18:40 UTC (RELENG_6, 6.4-STABLE)
                    2009-12-03 09:18:40 UTC (RELENG_6_4, 6.4-RELEASE-p8)
                    2009-12-03 09:18:40 UTC (RELENG_6_3, 6.3-RELEASE-p14)
    
    For general information regarding FreeBSD Security Advisories,
    including descriptions of the fields above, security branches, and the
    following sections, please visit <URL:http://security.FreeBSD.org/>.
    
    I.   Background
    
    The freebsd-update(8) utility is used to fetch, install, and rollback
    updates to the FreeBSD base system, and also to upgrade from one FreeBSD
    release to another.
    
    II.  Problem Description
    
    When downloading updates to FreeBSD via 'freebsd-update fetch' or
    'freebsd-update upgrade', the freebsd-update(8) utility copies currently
    installed files into its working directory (/var/db/freebsd-update by
    default) both for the purpose of merging changes to configuration files
    and in order to be able to roll back installed updates.
    
    The default working directory used by freebsd-update(8) is normally
    created during the installation of FreeBSD with permissions which allow
    all local users to see its contents, and freebsd-update(8) does not take
    any steps to restrict access to files stored in said directory.
    
    III. Impact
    
    A local user can read files which have been updated by freebsd-update(8),
    even if those files have permissions which would normally not allow users
    to read them.  In particular, on systems which have been upgraded using
    'freebsd-update upgrade', local users can read freebsd-update's backed-up
    copy of the master password file.
    
    IV.  Workaround
    
    Set the permissions on the freebsd-update(8) working directory to not
    allow unprivileged users to read said directory:
    
    # chmod 0700 /var/db/freebsd-update
    
    Note that if freebsd-update(8) is run using the '-d workdir' option, the
    directory which should have its permissions adjusted will be different.
    
    V.   Solution
    
    Perform one of the following:
    
    1) Upgrade your vulnerable system to 6-STABLE, 7-STABLE or 8-STABLE,
    or to the RELENG_8_0, RELENG_7_2, RELENG_7_1, RELENG_6_4, or
    RELENG_6_3 security branch dated after the correction date.
    
    2) To patch your present system:
    
    The following patch has been verified to apply to FreeBSD 6.3, 6.4,
    7.1, 7.2, and 8.0 systems.
    
    a) Download the relevant patch from the location below, and verify the
    detached PGP signature using your PGP utility.
    
    # fetch http://security.FreeBSD.org/patches/SA-09:17/freebsd-update.patch
    # fetch http://security.FreeBSD.org/patches/SA-09:17/freebsd-update.patch.asc
    
    b) Execute the following commands as root:
    
    # cd /usr/src
    # patch < /path/to/patch
    # cd /usr/src/usr.sbin/freebsd-update
    # make obj && make depend && make && make install
    # chmod 0700 /var/db/freebsd-update
    
    VI.  Correction details
    
    The following list contains the revision numbers of each file that was
    corrected in FreeBSD.
    
    CVS:
    
    Branch                                                           Revision
      Path
    - -------------------------------------------------------------------------
    RELENG_6
      src/usr.sbin/freebsd-update/freebsd-update.sh                  1.2.2.11
      src/etc/mtree/BSD.var.dist                                     1.71.2.4
    RELENG_6_4
      src/UPDATING                                            1.416.2.40.2.12
      src/sys/conf/newvers.sh                                  1.69.2.18.2.14
      src/usr.sbin/freebsd-update/freebsd-update.sh              1.2.2.10.2.2
      src/etc/mtree/BSD.var.dist                                 1.71.2.3.6.2
    RELENG_6_3
      src/UPDATING                                            1.416.2.37.2.19
      src/sys/conf/newvers.sh                                  1.69.2.15.2.18
      src/usr.sbin/freebsd-update/freebsd-update.sh               1.2.2.8.2.1
      src/etc/mtree/BSD.var.dist                                 1.71.2.3.4.1
    RELENG_7
      src/usr.sbin/freebsd-update/freebsd-update.sh                   1.8.2.5
      src/etc/mtree/BSD.var.dist                                     1.75.2.1
    RELENG_7_2
      src/UPDATING                                             1.507.2.23.2.8
      src/sys/conf/newvers.sh                                   1.72.2.11.2.9
      src/usr.sbin/freebsd-update/freebsd-update.sh               1.8.2.4.4.2
      src/etc/mtree/BSD.var.dist                                     1.75.8.2
    RELENG_7_1
      src/UPDATING                                            1.507.2.13.2.12
      src/sys/conf/newvers.sh                                   1.72.2.9.2.13
      src/usr.sbin/freebsd-update/freebsd-update.sh               1.8.2.4.2.2
      src/etc/mtree/BSD.var.dist                                     1.75.6.2
    RELENG_8
      src/usr.sbin/freebsd-update/freebsd-update.sh                  1.16.2.3
      src/etc/mtree/BSD.var.dist                                    1.75.10.2
    RELENG_8_0
      src/UPDATING                                              1.632.2.7.2.4
      src/sys/conf/newvers.sh                                    1.83.2.6.2.4
      src/usr.sbin/freebsd-update/freebsd-update.sh              1.16.2.2.2.2
      src/etc/mtree/BSD.var.dist                                1.75.10.1.2.2
    - -------------------------------------------------------------------------
    
    Subversion:
    
    Branch/path                                                      Revision
    - -------------------------------------------------------------------------
    stable/6/                                                         r200054
    releng/6.4/                                                       r200054
    releng/6.3/                                                       r200054
    stable/7/                                                         r200054
    releng/7.2/                                                       r200054
    releng/7.1/                                                       r200054
    stable/8/                                                         r200054
    releng/8.0/                                                       r200054
    - -------------------------------------------------------------------------
    
    VII. References
    
    The latest revision of this advisory is available at
    http://security.FreeBSD.org/advisories/FreeBSD-SA-09:17.freebsd-update.asc
    -----BEGIN PGP SIGNATURE-----
    Version: GnuPG v1.4.10 (FreeBSD)
    
    iEYEARECAAYFAksXhA0ACgkQFdaIBMps37Lg+wCfSK5sMXpsxTW9jpgwwcqx+24z
    zzwAniR50V8K8/vI0qshCUaKwryEYDuK
    =/lsC
    -----END PGP SIGNATURE-----
    
    
    
    

    --- End Message ---
    --- Begin Message ---
    -----BEGIN PGP SIGNED MESSAGE-----
    Hash: SHA1
    
    =============================================================================
    FreeBSD-SA-09:15.ssl                                        Security Advisory
                                                              The FreeBSD Project
    
    Topic:          SSL protocol flaw
    
    Category:       contrib
    Module:         openssl
    Announced:      2009-12-03
    Credits:        Marsh Ray, Steve Dispensa
    Affects:        All supported versions of FreeBSD.
    Corrected:      2009-12-03 09:18:40 UTC (RELENG_8, 8.0-STABLE)
                    2009-12-03 09:18:40 UTC (RELENG_8_0, 8.0-RELEASE-p1)
                    2009-12-03 09:18:40 UTC (RELENG_7, 7.2-STABLE)
                    2009-12-03 09:18:40 UTC (RELENG_7_2, 7.2-RELEASE-p5)
                    2009-12-03 09:18:40 UTC (RELENG_7_1, 7.1-RELEASE-p9)
                    2009-12-03 09:18:40 UTC (RELENG_6, 6.4-STABLE)
                    2009-12-03 09:18:40 UTC (RELENG_6_4, 6.4-RELEASE-p8)
                    2009-12-03 09:18:40 UTC (RELENG_6_3, 6.3-RELEASE-p14)
    CVE Name:       CVE-2009-3555
    
    For general information regarding FreeBSD Security Advisories,
    including descriptions of the fields above, security branches, and the
    following sections, please visit <URL:http://security.FreeBSD.org/>.
    
    0.   Revision History
    
    v1.0 2009-12-03  Initial release.
    v1.1 2009-12-03  Corrected instructions in section V.2)b).
    
    I.   Background
    
    The SSL (Secure Sockets Layer) and TLS (Transport Layer Security) protocols
    provide a secure communications layer over which other protocols can be
    utilized.  The most widespread use of SSL/TLS is to add security to the
    HTTP protocol, thus producing HTTPS.
    
    FreeBSD includes software from the OpenSSL Project which implements SSL
    and TLS.
    
    II.  Problem Description
    
    The SSL version 3 and TLS protocols support session renegotiation without
    cryptographically tying the new session parameters to the old parameters.
    
    III. Impact
    
    An attacker who can intercept a TCP connection being used for SSL or TLS
    can cause the initial session negotiation to take the place of a session
    renegotiation.  This can be exploited in several ways, including:
     * Causing a server to interpret incoming messages as having been sent
    under the auspices of a client SSL key when in fact they were not;
     * Causing a client request to be appended to an attacker-supplied
    request, potentially revealing to the attacker the contents of the client
    request (including any authentication parameters); and
     * Causing a client to receive a response to an attacker-supplied request
    instead of a response to the request sent by the client.
    
    IV.  Workaround
    
    No workaround is available.
    
    V.   Solution
    
    NOTE WELL: This update causes OpenSSL to reject any attempt to renegotiate
    SSL / TLS session parameters.  As a result, connections in which the other
    party attempts to renegotiate session parameters will break.  In practice,
    however, session renegotiation is a rarely-used feature, so disabling this
    functionality is unlikely to cause problems for most systems.
    
    Perform one of the following:
    
    1) Upgrade your vulnerable system to 6-STABLE, 7-STABLE, or 8-STABLE, or to
    the RELENG_8_0, RELENG_7_2, RELENG_7_1, RELENG_6_4, or RELENG_6_3 security
    branch dated after the correction date.
    
    2) To patch your present system:
    
    The following patches have been verified to apply to FreeBSD 6.3, 6.4,
    7.1, 7.2, and 8.0 systems.
    
    a) Download the relevant patch from the location below, and verify the
    detached PGP signature using your PGP utility.
    
    # fetch http://security.FreeBSD.org/patches/SA-09:15/ssl.patch
    # fetch http://security.FreeBSD.org/patches/SA-09:15/ssl.patch.asc
    
    b) Execute the following commands as root:
    
    # cd /usr/src
    # patch < /path/to/patch
    # cd /usr/src/secure/lib/libssl
    # make obj && make depend && make includes && make && make install
    
    NOTE: On the amd64 platform, the above procedure will not update the
    lib32 (i386 compatibility) libraries.  On amd64 systems where the i386
    compatibility libraries are used, the operating system should instead
    be recompiled as described in
    <URL:http://www.FreeBSD.org/handbook/makeworld.html>
    
    VI.  Correction details
    
    The following list contains the revision numbers of each file that was
    corrected in FreeBSD.
    
    CVS:
    
    Branch                                                           Revision
      Path
    - -------------------------------------------------------------------------
    RELENG_6
      src/crypto/openssl/ssl/s3_pkt.c                            1.1.1.10.2.1
      src/crypto/openssl/ssl/s3_srvr.c                           1.1.1.14.2.3
      src/crypto/openssl/ssl/s3_lib.c                            1.1.1.10.2.1
    RELENG_6_4
      src/UPDATING                                            1.416.2.40.2.12
      src/sys/conf/newvers.sh                                  1.69.2.18.2.14
      src/crypto/openssl/ssl/s3_pkt.c                           1.1.1.10.12.1
      src/crypto/openssl/ssl/s3_srvr.c                       1.1.1.14.2.1.6.2
      src/crypto/openssl/ssl/s3_lib.c                           1.1.1.10.12.1
    RELENG_6_3
      src/UPDATING                                            1.416.2.37.2.19
      src/sys/conf/newvers.sh                                  1.69.2.15.2.18
      src/crypto/openssl/ssl/s3_pkt.c                           1.1.1.10.10.1
      src/crypto/openssl/ssl/s3_srvr.c                       1.1.1.14.2.1.4.2
      src/crypto/openssl/ssl/s3_lib.c                           1.1.1.10.10.1
    RELENG_7
      src/crypto/openssl/ssl/s3_pkt.c                            1.1.1.12.2.1
      src/crypto/openssl/ssl/s3_srvr.c                           1.1.1.17.2.2
      src/crypto/openssl/ssl/s3_lib.c                            1.1.1.13.2.1
    RELENG_7_2
      src/UPDATING                                             1.507.2.23.2.8
      src/sys/conf/newvers.sh                                   1.72.2.11.2.9
      src/crypto/openssl/ssl/s3_pkt.c                            1.1.1.12.8.1
      src/crypto/openssl/ssl/s3_srvr.c                       1.1.1.17.2.1.2.1
      src/crypto/openssl/ssl/s3_lib.c                            1.1.1.13.8.1
    RELENG_7_1
      src/UPDATING                                            1.507.2.13.2.12
      src/sys/conf/newvers.sh                                   1.72.2.9.2.13
      src/crypto/openssl/ssl/s3_pkt.c                            1.1.1.12.6.1
      src/crypto/openssl/ssl/s3_srvr.c                           1.1.1.17.6.2
      src/crypto/openssl/ssl/s3_lib.c                            1.1.1.13.6.1
    RELENG_8
      src/crypto/openssl/ssl/s3_pkt.c                                 1.2.2.1
      src/crypto/openssl/ssl/s3_srvr.c                                1.3.2.1
      src/crypto/openssl/ssl/s3_lib.c                                 1.2.2.1
    RELENG_8_0
      src/UPDATING                                              1.632.2.7.2.4
      src/sys/conf/newvers.sh                                    1.83.2.6.2.4
      src/crypto/openssl/ssl/s3_pkt.c                                 1.2.4.1
      src/crypto/openssl/ssl/s3_srvr.c                                1.3.4.1
      src/crypto/openssl/ssl/s3_lib.c                                 1.2.4.1
    - -------------------------------------------------------------------------
    
    Subversion:
    
    Branch/path                                                      Revision
    - -------------------------------------------------------------------------
    stable/6/                                                         r200054
    releng/6.4/                                                       r200054
    releng/6.3/                                                       r200054
    stable/7/                                                         r200054
    releng/7.2/                                                       r200054
    releng/7.1/                                                       r200054
    - -------------------------------------------------------------------------
    
    VII. References
    
    http://extendedsubset.com/Renegotiating_TLS.pdf
    
    http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3555
    
    The latest revision of this advisory is available at
    http://security.FreeBSD.org/advisories/FreeBSD-SA-09:15.ssl.asc
    -----BEGIN PGP SIGNATURE-----
    Version: GnuPG v1.4.10 (FreeBSD)
    
    iEYEARECAAYFAksYIm4ACgkQFdaIBMps37J5jwCZAQurPSu2CyGz2thi8ljb+MlF
    LcwAnjSLYWT1nV5G9a46n9zcrpEqydJ3
    =XuZD
    -----END PGP SIGNATURE-----
    
    
    
    

    --- End Message ---

    Vissza a www.andrews.hu-ra