OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
From: FreeBSD Security Advisories (security-advisoriesFreeBSD.org)
Date: Mon Apr 23 2001 - 22:25:34 CDT

  • Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

    -----BEGIN PGP SIGNED MESSAGE-----

    =============================================================================
    FreeBSD-SA-01:37 Security Advisory
                                                                    FreeBSD, Inc.

    Topic: slrn contains remotely-exploitable buffer overflow

    Category: ports
    Module: slrn
    Announced: 2001-04-23
    Credits: Bill Nottingham
    Affects: Ports collection prior to the correction date.
    Corrected: 2001-04-04
    Vendor status: Updated version released
    FreeBSD only: NO

    I. Background

    slrn is a slang-based NNTP news reader.

    II. Problem Description

    The slrn port, versions prior to slrn-0.9.7.0, contains a buffer
    overflow in the wrapping/unwrapping functions of message header
    parsing. If a sufficiently long header is parsed, a buffer may
    overflow allowing the execution of arbitrary code contained in a
    message header as the user running the slrn program.

    The slrn port is not installed by default, nor is it "part of FreeBSD"
    as such: it is part of the FreeBSD ports collection, which contains
    over 5000 third-party applications in a ready-to-install format. The
    ports collections shipped with FreeBSD 3.5.1 and 4.2 contain this
    problem since it was discovered after the releases. The ports
    collection that shipped with FreeBSD 4.3 is not vulnerable since this
    problem was corrected prior to the release.

    FreeBSD makes no claim about the security of these third-party
    applications, although an effort is underway to provide a security
    audit of the most security-critical ports.

    III. Impact

    Arbitrary code may be executed on the local machine as the user
    running the slrn program.

    If you have not chosen to install the slrn port/package, then your
    system is not vulnerable to this problem.

    IV. Workaround

    Deinstall the slrn port/package, it you have installed it.

    V. Solution

    One of the following:

    1) Upgrade your entire ports collection and rebuild the slrn port.

    2) Deinstall the old package and install a new package dated after the
    correction date, obtained from:

    [i386]
    ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/i386/packages-4-stable/news/slrn-0.9.7.0.tgz
    ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/i386/packages-5-current/news/slrn-0.9.7.0.tgz

    [alpha]
    Packages are not automatically generated for the alpha architecture at
    this time due to lack of build resources.

    3) download a new port skeleton for the slrn port from:

    http://www.freebsd.org/ports/

    and use it to rebuild the port.

    4) Use the portcheckout utility to automate option (3) above. The
    portcheckout port is available in /usr/ports/devel/portcheckout or the
    package can be obtained from:

    ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/i386/packages-3-stable/devel/portcheckout-2.0.tgz
    ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/i386/packages-4-stable/devel/portcheckout-2.0.tgz
    ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/alpha/packages-4-stable/devel/portcheckout-2.0.tgz
    ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/i386/packages-5-current/devel/portcheckout-2.0.tgz
    ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/alpha/packages-5-current/devel/portcheckout-2.0.tgz

    -----BEGIN PGP SIGNATURE-----
    Version: GnuPG v1.0.4 (FreeBSD)
    Comment: FreeBSD: The Power To Serve

    iQCVAwUBOuTqtVUuHi5z0oilAQHqsAP+PEzZ8FPPCrKKKDGP7gACN77r5dbbE9LF
    MYSVGp2Z2+vwSysJG2BOtyNrrKlUhaKTLAoWZF+7ytV9ujli+bI06R2iYoe5SqMM
    a7K1N1XKNvXdvq1nYjDuawIzJzl9b2B8XavPFEtwkkxDVAtq2ODKTabAtllrNnfV
    hD4HsUzFMRI=
    =al4w
    -----END PGP SIGNATURE-----

    To Unsubscribe: send mail to majordomoFreeBSD.org
    with "unsubscribe freebsd-security" in the body of the message