Slashdot Mirror

← Back to Stories (view on slashdot.org)

NetBSD Announces Four New Security Advisories

Posted by CowboyNeal on from the staying-wary dept.

Dan writes "The NetBSD project has announced four new security advisories. NetBSD ships with the racoon(8) IKE (Internet Key Exchange) daemon, a vulnerability was found in the code for packet validation of "informational exchange" messages. Inconsistent IPv6 path MTU discovery handling vulnerability states that a malicious party can cause a remote kernel panic by using ICMPv6 "too big" messages. The OpenSSL 0.9.6 ASN.1 parser vulnerability could lead to a possible denial-of-service. Finally, shmat reference counting bug - programming error in the shmat(2) system call can result in a shared memory segment's reference count being erroneously incremented."

62 comments

  1. Darn, FreeBSD also affected. by TheLink · · Score: 5, Informative

    ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/ FreeBSD-SA-04:02.shmat.asc

    --
    1. Re:Darn, FreeBSD also affected. by Anonymous Coward · · Score: 0

      Yep. Damn local root holes.

    2. Re:Darn, FreeBSD also affected. by Rotting · · Score: 1


      Is this the same issue or a new one? The freebsd one was released over 2 weeks ago.

    3. Re:Darn, FreeBSD also affected. by Anonymous Coward · · Score: 0

      Same one. All my boxes where patched for this a week ago.

    4. Re:Darn, FreeBSD also affected. by Tuzanor · · Score: 5, Informative
      All of the BSDs were affected. The bug was first found in freebsd about a month ago, then about 2 weeks ago OpenBSD was found to be vulnerable, and now the netbsd guys have found out too. So its the same MTU bug.

      This is no surprise, as they all use the same IPv6 stack (KAME).

    5. Re:Darn, FreeBSD also affected. by Anonymous Coward · · Score: 0

      FreeBSD is not attracted to this IPv6 bug.

    6. Re:Darn, FreeBSD also affected. by kahsim · · Score: 1, Offtopic

      What is the difference between FreeBSD and OpenBSD? It says I acn get OpenBSD for free from their website, but where do I go? How do I post a question, which is original? Sorry, I am new to this site.

    7. Re:Darn, FreeBSD also affected. by TheLink · · Score: 1

      Go to www.freebsd.org for FreeBSD info
      Go to www.openbsd.org for OpenBSD info.

      --
  2. OpenBSD too ... except by Anonymous Coward · · Score: 1, Interesting

    The patches were issued a rather long time ago...

  3. Run this and all your security problems are solved by NEOtaku17 · · Score: 4, Informative

    If your running an i386 just run this baby and it will get rid of any packages that have been flagged as insecure ftp://ftp.netbsd.org/pub/NetBSD/packages/1.6.2/i38 6/All/audit-packages-1.27.tgz Make sure that you don't need any of the packages it get's rid of before you run it. Too see which vulnerabilities it get's rid of check out this list. Also make sure you don't need anything on this list .ftp://ftp.netbsd.org/pub/NetBSD/packages/distfile s/vulnerabilities

    --
    Creative Demolition
  4. Panther by packetbasher · · Score: 1

    Does anyone know if this also affects Panther (OSX 10.3) which also ships with racoon?

  5. Re:Run this and all your security problems are sol by MobyTurbo · · Score: 4, Informative
    If your running an i386 just run this baby and it will get rid of any packages that have been flagged as insecure ftp://ftp.netbsd.org/pub/NetBSD/packages/1.6.2/i38 6/All/audit-packages-1.27.tgz
    Wrong. This tracks security problems of *packages*, as the name suggests. Problems with the base system, on the other hand, are handled by cvsing the proper source files and recompiling them; as per the advice in the security bulletins. (You *are* a subscriber to the NetBsd security announce list, aren't you? It's not high volume. :-) )
  6. Did we copy the Windows Source Code? by sheapshearer · · Score: 3, Interesting

    The OpenSSL 0.9.6 ASN.1 parser vulnerability...

    What is going on? Didn't Microsoft have the same vulnerability recently? How is it that three entirely different operating systems (Linux,Windows,BSD) have the same vulnerability?

    Is this caused by human mistake or laziness?

    1. Re:Did we copy the Windows Source Code? by Anonymous Coward · · Score: 1, Funny

      M$ is copying code from OpenSSL!
      That's why M$ code also has the ASN.1 bug!

      The truth is out there!!!

    2. Re:Did we copy the Windows Source Code? by agent+dero · · Score: 1

      I'd be willing to bet it's because they're all using the same BSD-licensed code.

      Remember, all three have FreeBSD code in there, I can see it easily feasible that this racoon program has some sort of implementation on all three 'genres' of OS.

      --
      Error 407 - No creative sig found
    3. Re:Did we copy the Windows Source Code? by eht · · Score: 2, Informative

      Actually largely all of them have code all intertwined, FreeBSD and NetBSD don't write their own OpenSSH apps for example, they borroww OpenBSD's, then again so does almost everyone else.

      NetBSD is actually the oldest of the current BSD's derived from BSD Net/2 (4.3BSD Lite), 386BSD was derived from that and FreeBSD is derived from 386BSD, both later got code from 4.4BSD Lite, and shortly after that OpenBSD was derived from NetBSD.

      Sort of like the bible, with "And Aramus begat Aramus Junior, who begat Aramus Junior Junior."

    4. Re:Did we copy the Windows Source Code? by bourne · · Score: 1

      What is going on? Didn't Microsoft have the same vulnerability recently? How is it that three entirely different operating systems (Linux,Windows,BSD) have the same vulnerability?

      More likely the root cause of the problem is that parsing (anything) is an error-prone process, and parsing a complex standard is even more likely to result in problems. Parsers have to try to pull the data that is supposed to be there according to the standard, and have to hope that whoever is writing the data is also reading the standard correctly and in the same way, and it's just a huge mess.

    5. Re:Did we copy the Windows Source Code? by Hadji+Baba · · Score: 2, Funny

      No Silly, we all got it from SCO's System V

  7. Re:Quick BSD Factsheet by Anonymous Coward · · Score: 0
    > cd /usr/ports/www/apache13; make install

    What's that? I need this lib? This package? This file here? BUILD ERROR AFTER BUILD ERROR.

    No, you're thinking of RPM-based OS's. The ports collection takes care of all dependencies.

    (Yes, I know, IHBT, IHL, HAND.)