-----BEGIN PGP SIGNED MESSAGE-----

                 NetBSD Security Advisory 2002-019
                 =================================

Topic: Buffer overrun in talkd

Version: NetBSD-current: source prior to September 20, 2002
                NetBSD 1.6: affected
                NetBSD-1.5.3: affected
                NetBSD-1.5.2: affected
                NetBSD-1.5.1: affected
                NetBSD-1.5: affected

Severity: Possible local root compromise (not confirmed)

Fixed: NetBSD-current: September 20, 2002
                NetBSD-1.6 branch: October 3, 2002
                                        (1.6.1 will include the fix)
                NetBSD-1.5 branch: September 20, 2002

Abstract
========

Rogue talk client is able to cause talkd to overrun the buffer,
and could be able to compromise root privilege of the machine running talkd.

Actual attack script is yet to be found.

Technical Details
=================

talkd did not make proper check against inbound messages and can make
unbounded copy into a destination buffer.

Solutions and Workarounds
=========================

To remedy this problem, talkd binary has to be updated to the latest one.

The following instructions describe how to upgrade your talkd
binaries by updating your source tree and rebuilding and
installing a new version of talkd.

* NetBSD-current:

        Systems running NetBSD-current dated from before 2002-09-20
        should be upgraded to NetBSD-current dated 2002-09-20 or later.

        The following directories need to be updated from the
        netbsd-current CVS branch (aka HEAD):
                libexec/talkd

        To update from CVS, re-build, and re-install talkd:
                # cd src
                # cvs update -d -P libexec/talkd
                # cd libexec/talkd

                # make cleandir dependall
                # make install

* NetBSD 1.6:

        Systems running NetBSD 1.6 branch dated from before 2002-10-03
        should be upgraded to NetBSD 1.6 branch dated 2002-10-03 or later.

        The following directories need to be updated from the
        netbsd-1-6 CVS branch:
                libexec/talkd

        To update from CVS, re-build, and re-install talkd:
                # cd src
                # cvs update -d -P -r netbsd-1-6 libexec/talkd
                # cd libexec/talkd

                # make cleandir dependall
                # make install

* NetBSD 1.5, 1.5.1, 1.5.2, 1.5.3:

        Systems running NetBSD 1.5 branch dated from before 2002-09-20
        should be upgraded to NetBSD 1.5 branch dated 2002-09-20 or later.

        The following directories need to be updated from the
        netbsd-1-5 CVS branch:
                libexec/talkd

        To update from CVS, re-build, and re-install talkd:
                # cd src
                # cvs update -d -P -r netbsd-1-5 libexec/talkd
                # cd libexec/talkd

                # make cleandir dependall
                # make install

Thanks To
=========

xskittenz.org

Revision History
================

        2002-10-08 Initial release

More Information
================

Advisories may be updated as new information comes to hand. The most
recent version of this advisory (PGP signed) can be found at
  ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2002-019.txt.asc

Information about NetBSD and NetBSD security can be found at
http://www.NetBSD.ORG/ and http://www.NetBSD.ORG/Security/.

Copyright 2002, The NetBSD Foundation, Inc. All Rights Reserved.

$NetBSD: NetBSD-SA2002-019.txt,v 1.6 2002/10/08 03:43:35 itojun Exp $

-----BEGIN PGP SIGNATURE-----
Version: 2.6.3ia
Charset: noconv

iQCVAwUBPaJUWj5Ru2/4N2IFAQHlxAP/cRktEeD1NK4UjLK3wFWcz+wdEWY6e1KM
s4DMRD0Jf123A4/yXEA7pzBImhP+guvJu5FE+AVEhLWozursc/0lhaBedl4pJXp5
dZjgaK+iE+EiVeXPZhNKquAYxO5dYFk0TS4MYUWtBh9DhgXYxtF08jTq0JMKuAGu
HGjCuPb8rvc=
=PZcD
-----END PGP SIGNATURE-----

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]