From owner-doc-jp@jp.freebsd.org  Sun Feb 27 05:52:10 2000
Received: (from daemon@localhost)
	by castle.jp.freebsd.org (8.9.3+3.2W/8.7.3) id FAA85351;
	Sun, 27 Feb 2000 05:52:10 +0900 (JST)
	(envelope-from owner-doc-jp@jp.FreeBSD.org)
Received: from sv01.geocities.co.jp (sv01.geocities.co.jp [210.153.89.155])
	by castle.jp.freebsd.org (8.9.3+3.2W/8.7.3) with ESMTP id FAA85345
	for <doc-jp@jp.freebsd.org>; Sun, 27 Feb 2000 05:52:10 +0900 (JST)
	(envelope-from hrs@geocities.co.jp)
Received: from mail.geocities.co.jp (mail.geocities.co.jp [210.153.89.137]) by sv01.geocities.co.jp (8.9.3+3.2W/3.7W) with ESMTP id FAA24996 for <doc-jp@jp.freebsd.org>; Sun, 27 Feb 2000 05:52:09 +0900 (JST)
Received: from mail.hrs.jp (sutnmax1-ppp42.ed.noda.sut.ac.jp [133.31.173.52]) by mail.geocities.co.jp (1.3G-GeocitiesJ-3.3) with ESMTP id FAA19406 for <doc-jp@jp.freebsd.org>; Sun, 27 Feb 2000 05:52:05 +0900 (JST)
Message-Id: <200002262052.FAA19406@mail.geocities.co.jp>
Received: from localhost (alph.hrs.jp [192.168.0.10])
	by mail.hrs.jp (8.9.3/3.7W/DomainMaster) with ESMTP id EAA36234
	for <doc-jp@jp.freebsd.org>; Sun, 27 Feb 2000 04:21:09 +0900 (JST)
	(envelope-from hrs@hrs.jp)
To: doc-jp@jp.freebsd.org
In-Reply-To: <20000225001107V.hino@nwk.cl.nec.co.jp>
References: <200002221920.EAA06816@mail.geocities.co.jp>
	<20000225001107V.hino@nwk.cl.nec.co.jp>
X-Mailer: Mew version 1.94 on Emacs 19.34 / Mule 2.3 (SUETSUMUHANA)
Mime-Version: 1.0
Content-Type: Multipart/Mixed;
 boundary="--Next_Part(Sun_Feb_27_04:20:04_2000_809)--"
Content-Transfer-Encoding: 7bit
Date: Sun, 27 Feb 2000 04:21:08 +0900
From: Hiroki Sato <hrs@geocities.co.jp>
X-Dispatcher: imput version 990905(IM130)
Lines: 396
Reply-To: doc-jp@jp.freebsd.org
Precedence: list
X-Distribute: distribute version 2.1 (Alpha) patchlevel 24e+990727
X-Sequence: doc-jp 7113
Subject: [doc-jp 7113] Re: ANNOUNCE: FreeBSD Security Advisory:
 FreeBSD-SA-00:04.delegate
Errors-To: owner-doc-jp@jp.freebsd.org
Sender: owner-doc-jp@jp.freebsd.org
X-Originator: hrs@geocities.co.jp

----Next_Part(Sun_Feb_27_04:20:04_2000_809)--
Content-Type: Text/Plain; charset=iso-2022-jp
Content-Transfer-Encoding: 7bit

$B:4F#!wEl5~M}2JBg3X$G$9!#(B

hino@ccm.cl.nec.co.jp wrote
 in <20000225001107V.hino@nwk.cl.nec.co.jp>:

> :>  $B!&:G=i!"(Bexploit $B$rLu=P$7$F9M$($F$$$?$N$G$9$,!"(B
> :>    passive exploit $B$"$?$j$NJ8$G$D$^$:$$$?$N$G!"(B
> :>    $B$"$-$i$a$FA4It$=$N$^$^=P$9$h$&$KJQ$($F$^$9!#(B
> 
> $B!V967b!W$G==J,$J$h$&$J(B? $BLuCm$O$"$C$?J}$,NI$$$G$9$M!%(B
> $B!t(B $B!V967b!W$r!VMQ8l!W$H$$$&$N$O$A$g$C$HJQ$+$J(B? 

 $B$3$l!"967b$K$9$k$H(B "amanda" exploit $B$H$+$H(B DDoS attack $B$,(B
 $BF1Ns$K$J$C$F!"6hJL$,IU$+$J$/$J$C$A$c$&$s$G$9!#(B
 $B%j%b!<%H$+$i(B exploit $B$5$l$k$N$H(B attack $B$5$l$k$N$G$O(B
 $B$+$J$j0c$$$,$"$j$^$9$h$M!#(B

 $B:#2s$N$O967b$G$bNI$$$+$J$!!"$H$+;W$C$?$N$G$9$,!"(B
 $BE,Ev$K07$($J$$C18l$J$N$G!"Lu$O7k6I$"$-$i$a$^$7$?!#(B

 # $BLu$7$?J}$,NI$$$H$$$&0U8+$N?M$,$$$?$i!"(B
 # $B$<$R:4F#$r@bF@$7$F2<$5$$(B :-)
 
> :>  $B!&(Bbuffer overflow $B$,$"$j$^$9$C$FI=8=$bJQ$+$b!#(B
> :>    buffer overflow $B$r5/$3$92DG=@-$N$"$k%3!<%I$H$+@bL@$9$Y$-(B?
> 
> $B!V(Bbuffer overflow $BLdBj(B{$B$,$"$j$^$9(B,$B$r4^$s$G$$$^$9(B,$B$r$+$+$($F$$$^$9(B}$B!W$J(B
> $B$s$F$H$3$m$,L\$K$d$5$7$$$+$J$!!%(B

 $B$3$l$OJQ99$7$F$*$-$^$9!#(B

 # Bugtraq-JP $B$G$O!V$"$j$^$9!W$C$F=q$$$F$"$k!D!#(B

 $B0J2<!"=$@5HG$rE:IU$7$^$9!#(B
 $B$A$g$$CY$l$F$7$^$C$?$N$G!"(B02/27 $B$NM<J}$K$O=P2Y$7$^$9!#(B

--
| $B:4F#(B $B9-@8!wEl5~M}2JBg3X(B <hrs@geocities.co.jp>
|
|                                  j7397067@ed.noda.sut.ac.jp(univ)
|                        hrs@jp.FreeBSD.org(FreeBSD doc-jp Project)

----Next_Part(Sun_Feb_27_04:20:04_2000_809)--
Content-Type: Text/Plain; charset=iso-2022-jp
Content-Transfer-Encoding: 7bit
Content-Disposition: attachment; filename="sa0003.txt"


 $B$3$N%a!<%k$O(B, announce-jp $B$KN.$l$?(B

  Subject: ANNOUNCE: FreeBSD Security Advisory: FreeBSD-SA-00:03.asmon
  From: FreeBSD Security Officer <security-officer@freebsd.org>
  Date: Sat, 19 Feb 2000 22:42:28 -0800 (PST)
  Message-Id: <200002200642.WAA10401@freefall.freebsd.org>
  X-Sequence: announce-jp 388

 $B$rF|K\8lLu$7$?$b$N$G$9(B. 

 $B86J8$O(B PGP $B=pL>$5$l$F$$$^$9$,(B, $B$3$NF|K\8lLu$O(B PGP $B=pL>$5$l$F$$$^$;$s(B. 
 $B%Q%C%AEy$NFbMF$,2~cb$5$l$F$$$J$$$3$H$r3NG'$9$k$?$a$K(B PGP $B$N%A%'%C%/$r(B
 $B9T$J$&$K$O(B, $B86J8$r;2>H$7$F$/$@$5$$(B. 

 $BF|K\8lLu$O(B FreeBSD $BF|K\8l%I%-%e%a%s%F!<%7%g%s%W%m%8%'%/%H(B(doc-jp)$B$,(B
 $B;29M$N$?$a$KDs6!$9$k$b$N$G(B, $BK]Lu<T$*$h$S(B doc-jp $B$O(B $B$=$NFbMF$K$D$$$F(B
 $B$$$+$J$kJ]>Z$b$$$?$7$^$;$s(B. $BF|K\8lLu$K$D$$$F$N$*Ld$$9g$o$;$O(B,
 doc-jp@jp.freebsd.org $B$^$G$*4j$$$7$^$9(B.

--($B$3$3$+$i(B)

=============================================================================
FreeBSD-SA-00:03                                           Security Advisory
                                                                FreeBSD, Inc.

$B%H%T%C%/(B:       Asmon/Ascpu ports fail to drop privileges

$BJ,N`(B:           ports
$B%b%8%e!<%k(B:     asmon/ascpu
$B9pCNF|;~(B:       2000-02-19
$B1F6AHO0O(B:       $B=$@5F|0JA0$N$9$Y$F$N(B Ports $B%3%l%/%7%g%s(B
$B=$@5F|(B:         2000-01-29
FreeBSD $B8GM-@-(B: yes

I.   $BGX7J(B - Background 

Two optional third-party ports distributed with FreeBSD can be used to
execute commands with elevated privileges, specifically setgid kmem
privileges. This may lead to a local root compromise.

$B$3$NFs$D$N%5!<%I%Q!<%F%#@=(B ports $B$O(B FreeBSD $B$NG[I[J*$K(B
$B4^$^$l$F$$$k$b$N$G$9(B. $B$3$l$i$O9b$$8"8B(B, $B6qBNE*$K$O(B kmem $B%0%k!<%W$G(B
setgid $B$5$l$?8"8B$G%3%^%s%I$r<B9T$9$k$N$KMxMQ$9$k$3$H$,$G$-$^$9(B.
$B$3$N$?$a(B, $B%m!<%+%k$N(B root $B8"8B$,C%$o$l$k2DG=@-$,$"$j$^$9(B.

II.  $BLdBj$N>\:Y(B - Problem Description

Asmon and ascpu allow users to execute arbitrary commands as part of a user
configuration file. Both applications are Linux-centric as distributed by
the vendor and require patching to run under FreeBSD (specifically, using
the kvm interface and setgid kmem privileges to obtain system statistics);
this patching was the source of the present security problem. This is a
similar flaw to one found in the wmmon port, which was corrected on
1999/12/31.

$B$I$A$i$b(B Linux $B8~$1$K%Y%s%@!<$+$iG[I[$5$l$F$$$k$b$N$G$9(B.  
FreeBSD $B$G;HMQ$9$k>l9g(B, $B%Q%C%A$rI,MW$H$7$^$9(B($B6qBNE*$K$O(B, kvm
$B%$%s%?%U%'!<%9$r;HMQ$7$F%7%9%F%`$NE}7W$rF@$k$N$K(B
kmem $B8"8B$G(B setgid $B$7$F$$$^$9(B).
$B$3$N=$@5%Q%C%A$,(B, $B%;%-%e%j%F%#LdBj$N860x$H$J$C$F$$$^$7$?(B.
$B=$@5%Q%C%A$NITHw$O(B, 1999/12/31 $B$K=$@5$5$l$?(B wmmon $B$N(B Ports $B$K(B
$B8+$i$l$?$b$N$HN`;w$7$?$b$N$G$9(B.

Note that neither utility is installed by default, nor are they "part of
FreeBSD" as such: they are part of the FreeBSD ports collection, which
contains over 3100 third-party applications in a ready-to-install format.

$BCm0U$7$FM_$7$$$N$G$9$,(B, $B$I$A$i$N%f!<%F%#%j%F%#$b%G%U%)%k%H$G$O(B
$B%$%s%9%H!<%k$5$l$^$;$s$7(B, FreeBSD $B$NItJ,$r9=@.$9$k$b$N$G$b$"$j$^$;$s(B.
$B$=$l$i$O(B FreeBSD Ports $B%3%l%/%7%g%s$N0l$D$G$9(B.
FreeBSD Ports $B%3%l%/%7%g%s$K$O(B, 3100 $B$rD6$($k%5!<%I%Q!<%F%#@=$N(B
$B%"%W%j%1!<%7%g%s$,$9$0$K%$%s%9%H!<%k$G$-$k7A$G<}$a$i$l$F$$$^$9(B.

FreeBSD makes no claim about the security of these third-party
applications, although an effort is underway to provide a security audit of
the most security-critical ports.

FreeBSD $B$G$O(B, $B$3$N$h$&$J%5!<%I%Q!<%F%#@=%"%W%j%1!<%7%g%s$N%;%-%e%j%F%#(B
$BLdBj$KBP$7$F(B, $BFC$K<gD%$9$k$3$H$O$"$j$^$;$s(B($BLuCm(B: ports $B$KF~$C$F$$$k$+$i(B
$B$H$$$C$F(B, FreeBSD $B$N3+H/<T$?$A$,$=$N%"%W%j%1!<%7%g%s$,0BA4$G$"$k$HI>2A(B
$B$7$?$o$1$G$O$"$j$^$;$s(B).

$B$?$@$7(B, $B%;%-%e%j%F%#LdBj$KBP$7$FBg$-$J1F6A$r;}$D$h$&$J(B ports $B$KBP$9$k(B
$B%;%-%e%j%F%#4F::$rDs6!$9$Y$/(B, $B8=:_EXNOCf$G$9(B. 

III. $B1F6AHO0O(B - Impact

If you have not chosen to install the asmon or ascpu ports/packages, then
your system is not vulnerable. If you have, then local users can obtain
setgid kmem rights, which allows them to manipulate kernel memory, and
thereby compromise root.

asmon $B$b$7$/$O(B ascpu $B$N(B Ports/Packages $B$r%$%s%9%H!<%k$7$F$$$J$1$l$P(B,
$B%7%9%F%`$K%;%-%e%j%F%#>e$NLdBj$O$"$j$^$;$s(B.
$B$b$7(B, $B$=$l$i$r%$%s%9%H!<%k$7$F$$$k$J$i(B,
$B%m!<%+%k%f!<%6$,(B kmem $B%0%k!<%W$X(B setgid $B$9$k8"8B$rF@$k$3$H$,$G$-$k$?$a(B,
$B%+!<%M%k%a%b%j$rA`:n$9$k$3$H$K$h$j(B, root $B8"8B$,C%$o$l$k4m81@-$,$"$j$^$9(B.

IV.  $BBP1~:v(B - Workaround

Remove the asmon and ascpu ports/packages, if you have installed them.

asmon $B$*$h$S(B ascpu $B$N(B Ports/Packages $B$,%$%s%9%H!<%k$5$l$F$$$k>l9g$K$O(B,
$B$=$l$i$r:o=|$7$F2<$5$$(B.

V.   $B=$@5=hCV(B - Solution

One of the following:

1) Upgrade your entire ports collection and rebuild the asmon and/or ascpu
ports.

2) Reinstall a new package obtained from:

ftp://ftp.freebsd.org/pub/FreeBSD/ports/packages/sysutils/asmon-0.60.tgz
ftp://ftp.freebsd.org/pub/FreeBSD/ports/packages/sysutils/ascpu-1.8.tgz

after the correction date. At the time of advisory release, the asmon
package was not available - you may need to use one of the other methods
to update the software.

3) download a new port skeleton for the asmon and/or ascpu ports from:

http://www.freebsd.org/ports/

and use it to rebuild one or both ports.

4) Use the portcheckout utility to automate option (3) above. The
portcheckout port is available in /usr/ports/devel/portcheckout or the
package can be obtained from:

ftp://ftp.freebsd.org/pub/FreeBSD/ports/packages/devel/portcheckout-2.0.tgz

$B<!$N$$$:$l$+$K$h$C$F2r7h2DG=$G$9(B.

1) Ports $B%3%l%/%7%g%sA4BN$r%"%C%W%0%l!<%I$7(B, asmon $B$H(B ascpu $B$r(B
   $B:F%3%s%Q%$%k$7$F$/$@$5$$(B.

2) $B<!$K<($9>l=j(B

ftp://ftp.freebsd.org/pub/FreeBSD/ports/packages/sysutils/asmon-0.60.tgz
ftp://ftp.freebsd.org/pub/FreeBSD/ports/packages/sysutils/ascpu-1.8.tgz

   $B$+$i(B, $B=$@5F|0J9_$K:n@.$5$l$??7$7$$%Q%C%1!<%8$r%@%&%s%m!<%I$7(B, 
   $B%$%s%9%H!<%k$7D>$7$F$/$@$5$$(B.  $B$3$N%;%-%e%j%F%#4+9p$,=P$5$l$?;~E@$G$O(B,
   asmon $B$N%Q%C%1!<%8$O$^$@MxMQ$G$-$k$h$&$K$J$C$F$$$^$;$s$N$G(B,
   asmon $B$r99?7$9$k>l9g$K$O(B, $BB>$N$$$:$l$+$N<jCJ$r$H$kI,MW$,$"$j$^$9(B.

3) $B<!$K<($9>l=j(B

http://www.freebsd.org/ports/

   $B$+$i(B, asmon $B$H(B ascpu $B$N?7$7$$(B Ports $B$r<hF@$7(B, $B$=$l$rMQ$$$F(B
   $B:F%3%s%Q%$%k$7$F$/$@$5$$(B.

4) portcheckout $B%f!<%F%#%j%F%#$r;H$&$H(B, $B>e5-(B (3) $B$r<+F0E*$K(B
   $B9T$J$&$3$H$,$G$-$^$9(B.  portcheckout $B$O(B,
   /usr/ports/devel/portcheckout $B$d(B, $B0J2<$N>l=j$+$iF~<j2DG=$G$9(B. 

ftp://ftp.freebsd.org/pub/FreeBSD/ports/packages/devel/portcheckout-2.0.tgz

----Next_Part(Sun_Feb_27_04:20:04_2000_809)--
Content-Type: Text/Plain; charset=iso-2022-jp
Content-Transfer-Encoding: 7bit
Content-Disposition: attachment; filename="sa0004.txt"


 $B$3$N%a!<%k$O(B, announce-jp $B$KN.$l$?(B

  Subject: ANNOUNCE: FreeBSD Security Advisory: FreeBSD-SA-00:04.delegate
  From: FreeBSD Security Officer <security-officer@freebsd.org>
  Date: Sat, 19 Feb 2000 22:45:45 -0800 (PST)
  Message-Id: <200002200645.WAA10607@freefall.freebsd.org>
  X-Sequence: announce-jp 389

 $B$rF|K\8lLu$7$?$b$N$G$9(B. 

 $B86J8$O(B PGP $B=pL>$5$l$F$$$^$9$,(B, $B$3$NF|K\8lLu$O(B PGP $B=pL>$5$l$F$$$^$;$s(B. 
 $B%Q%C%AEy$NFbMF$,2~cb$5$l$F$$$J$$$3$H$r3NG'$9$k$?$a$K(B PGP $B$N%A%'%C%/$r(B
 $B9T$J$&$K$O(B, $B86J8$r;2>H$7$F$/$@$5$$(B. 

 $BF|K\8lLu$O(B FreeBSD $BF|K\8l%I%-%e%a%s%F!<%7%g%s%W%m%8%'%/%H(B(doc-jp)$B$,(B
 $B;29M$N$?$a$KDs6!$9$k$b$N$G(B, $BK]Lu<T$*$h$S(B doc-jp $B$O(B $B$=$NFbMF$K$D$$$F(B
 $B$$$+$J$kJ]>Z$b$$$?$7$^$;$s(B. $BF|K\8lLu$K$D$$$F$N$*Ld$$9g$o$;$O(B,
 doc-jp@jp.freebsd.org $B$^$G$*4j$$$7$^$9(B.

--($B$3$3$+$i(B)

=============================================================================
FreeBSD-SA-00:04                                           Security Advisory
                                                                FreeBSD, Inc.

$B%H%T%C%/(B:       Delegate port contains numerous buffer overflows

$BJ,N`(B:           ports
$B%b%8%e!<%k(B:     delegate
$B9pCNF|;~(B:       2000-02-19
$B1F6AHO0O(B:       $B=$@5F|0JA0$N$9$Y$F$N(B Ports $B%3%l%/%7%g%s(B
$B=$@5F|;~(B:       2000-02-02
FreeBSD $B8GM-@-(B: NO

I.   $BGX7J(B - Background

An optional third-party port distributed with FreeBSD contains numerous
remotely-exploitable buffer overflows which allow an attacker to execute
arbitrary commands on the local system, typically as the 'nobody' user.

FreeBSD $BG[I[J*$K4^$^$l$F$$$k(B, $B$3$N%5!<%I%Q!<%F%#@=(B port $B$K$O(B,
$B%j%b!<%H$+$i(B exploit $B2DG=$J(B, $B?tB?$/$N%P%C%U%!%*!<%P%U%m!<(B(buffer
overflow)$BLdBj$rJz$($F$$$^$9(B.  $B$=$N$?$a967b<T$O(B,
$B$3$l$rMxMQ$7$F%m!<%+%k%7%9%F%`$K$"$kG$0U$N%3%^%s%I$r<B9T$9$k$3$H$,$G$-$^$9(B.
$B$3$N%3%^%s%I$N<B9T$ODL>o(B, `nobody' $B$N%f!<%68"8B$G9T$J$o$l$^$9(B.

 ($BLuCm(B: exploit $B$H$O(B, $B%;%-%e%j%F%#$N<eE@$r0-MQ$9$k$3$H$r;X$9MQ8l$G$9(B)

II.  $BLdBj$N>\:Y(B - Problem Description

Delegate is a versatile application-level proxy. Unfortunately it is
written in a very insecure style, with potentially dozens of different
exploitable buffer overflows (including several demonstrated ones), each of
which could allow an attacker to execute arbitrary code on the delegate
server. This code will run as the user ID of the 'delegated' process,
typically 'nobody' in the recommended configuration, but this still
represents a security risk as the attacker may be able to mount a local
attack to further upgrade his or her access privileges.

delegate $B$O(B, $B%"%W%j%1!<%7%g%s%l%Y%k$NHFMQ%W%m%-%7%=%U%H%&%'%"$G$9(B.
$B;DG0$J$3$H$K(B, $B%;%-%e%j%F%#$r9MN8$7$J$$%9%?%$%k$G=q$+$l$F$$$k$?$a(B,
exploit $B2DG=$J?tB?$/$N%P%C%U%!%*!<%P%U%m!<LdBj$rJz$($F$$$^$9(B.
$B967b<T$O$3$l$i$N%P%C%U%!%*!<%P%U%m!<$rMxMQ$7(B,
delegate $B%5!<%P$K$"$kG$0U$N%3!<%I$r<B9T$9$k$3$H$,$G$-$^$9(B.
$B%3!<%I$O(B, $B8F$S=P$5$l$k%W%m%;%9$N%f!<%6(B ID $B$G<B9T$5$l$^$9$,(B,
$B0lHL$K?d>)$5$l$F$$$k@_Dj$G$O(B, $B%f!<%6(B ID $B$O(B `nobody' $B$K$J$j$^$9(B.
$B$3$l$O(B, $B967b<T$,%3%^%s%I$N<B9T$r;H$C$F%m!<%+%k$G967b$r9T$J$$(B,
$B$5$i$K9b$$8"8B$rF@$k2DG=@-$,$"$k$H$$$&%;%-%e%j%F%#>e$N4m81@-$r(B
$BUT$s$G$$$^$9(B.

Note that the delegate utility is not installed by default, nor is it "part
of FreeBSD" as such: it is part of the FreeBSD ports collection, which
contains over 3100 third-party applications in a ready-to-install format.

$BCm0U$7$FM_$7$$$N$G$9$,(B, delegate $B%f!<%F%#%j%F%#$O%G%U%)%k%H$G$O(B
$B%$%s%9%H!<%k$5$l$^$;$s$7(B, FreeBSD $B$NItJ,$r9=@.$9$k$b$N$G$b$"$j$^$;$s(B.
$B$=$l$O(B FreeBSD Ports $B%3%l%/%7%g%s$N0l$D$G$9(B.
FreeBSD Ports $B%3%l%/%7%g%s$K$O(B, 3100 $B$rD6$($k%5!<%I%Q!<%F%#@=$N(B
$B%"%W%j%1!<%7%g%s$,$9$0$K%$%s%9%H!<%k$G$-$k7A$G<}$a$i$l$F$$$^$9(B.

FreeBSD makes no claim about the security of these third-party
applications, although an effort is underway to provide a security audit of
the most security-critical ports.

FreeBSD $B$G$O(B, $B$3$N$h$&$J%5!<%I%Q!<%F%#@=%"%W%j%1!<%7%g%s$N%;%-%e%j%F%#(B
$BLdBj$KBP$7$F(B, $BFC$K<gD%$9$k$3$H$O$"$j$^$;$s(B($BLuCm(B: ports $B$KF~$C$F$$$k$+$i(B
$B$H$$$C$F(B, FreeBSD $B$N3+H/<T$?$A$,$=$N%"%W%j%1!<%7%g%s$,0BA4$G$"$k$HI>2A(B
$B$7$?$o$1$G$O$"$j$^$;$s(B).

$B$?$@$7(B, $B%;%-%e%j%F%#LdBj$KBP$7$FBg$-$J1F6A$r;}$D$h$&$J(B ports $B$KBP$9$k(B
$B%;%-%e%j%F%#4F::$rDs6!$9$Y$/(B, $B8=:_EXNOCf$G$9(B. 

III. $B1F6AHO0O(B - Impact

If you have not chosen to install the delegate port/package, then your
system is not vulnerable. If you have, then local or remote users who can
connect to the delegate port(s), or malicious servers which a user accesses
using the delegate proxy, can potentially execute arbitrary code on your
system in any number of ways.

delegate $B$N(B Port/Package $B$r%$%s%9%H!<%k$7$F$$$J$$$J$i(B,
$B%7%9%F%`$K%;%-%e%j%F%#>e$NLdBj$O$"$j$^$;$s(B. 
$B$b$7(B, $B$=$l$i$r%$%s%9%H!<%k$7$F$$$k$J$i(B, delegate $B%]!<%H$K@\B3$G$-$k(B
$B%m!<%+%k$b$7$/$O%j%b!<%H$N%f!<%6(B, $B$"$k$$$O(B delegate $B%W%m%-%7$r7PM3$7$F(B
$B0-0U$N$"$k%5!<%P$K%"%/%;%9$9$k$3$H$K$h$C$F(B, $B$=$N%7%9%F%`>e$GG$0U$N%3!<%I$,(B
$B<B9T$5$l$k2DG=@-$,$"$j$^$9(B.

IV.  $BBP1~:v(B - Workaround

Remove the delegate port/package, if you have installed it.

delegate $B$N(B Port/Package $B$,%$%s%9%H!<%k$5$l$F$$$k>l9g$K$O(B,
$B$=$l$r:o=|$7$F2<$5$$(B.

V.   $B=$@5=hCV(B - Solution

Unfortunately no simple fix is available - the problems with the delegate
software are too endemic to be fixed by a simple patch. It is hoped the
software authors will take security to heart and correct the security
problems in a future version, although user caution is advised given the
current state of the code.

$B$"$$$K$/(B, $B4JC1$K2r7h$9$k<jCJ$O$"$j$^$;$s(B.  $B$3$l$O(B, delegate $B$,(B
$BC1=c$J=$@5%Q%C%A$G$O2r7h$G$-$J$$$/$i$$$KJ#;($J9=B$$r;}$C$F$$$k$N$,860x$G$9(B.
$B8=:_$N%3!<%I$K$b;HMQ>e$NCm0U$H$7$F=q$+$l$F$$$k$N$G$9$,(B,
delegate $B$N:n<T$,%;%-%e%j%F%#$r9MN8$7(B, $B$3$l$i$NLdBj$r(B
$B?7$?$J%P!<%8%g%s$G=$@5$9$k$3$H$,K>$^$l$^$9(B.

Depending on your local setup and your security threat model, using a
firewall/packet filter such as ipfw(8) or ipf(8) to prevent remote users
from connecting to the delegate port(s) may be enough to meet your security
needs. Note that this will not prevent legitimate proxy users from
attacking the delegate server, although this may not be an issue if they
have a shell account on the machine anyway.

$B%m!<%+%k%7%9%F%`$N@_Dj$H$"$J$?$NMxMQ$7$F$$$k%M%C%H%o!<%/$G$N(B
$B%;%-%e%j%F%#BP:v$N%b%G%k$K$b$h$j$^$9$,(B,
ipfw(8) ipf(8) $B$H$$$C$?(B, $B%j%b!<%H%f!<%6$K$h$k(B delegate $B%]!<%H$X$N(B
$B%"%/%;%9$r@)8B$9$k%U%!%$%"%&%)!<%k$d%Q%1%C%H%U%#%k%?$NMxMQ$O(B,
$B$*$=$i$/%;%-%e%j%F%#LdBj$N2r7h$K==J,M-8z$J>l9g$b$"$k$H;W$o$l$^$9(B.
$B$?$@$7$3$NJ}K!$G$O(B, $B@55,$N%W%m%-%7MxMQ<T$K$h$k(B delegate $B%5!<%P$X$N967b$r(B
$BKI$0$3$H$,$G$-$J$$$3$H$KCm0U$7$F2<$5$$(B.
$B%W%m%-%7MxMQ<T$,$=$N%^%7%s$N%7%'%k%"%+%&%s%H$r(B
$B;}$C$F$$$k$J$i(B, $B$=$l$,LdBj$K$J$k$3$H$O$J$$$G$7$g$&(B.

Note also that this does not prevent "passive" exploits in which a user is
convinced through other means into visiting a malicious server using the
proxy, which may be able to compromise it by sending back invalid
data. Several flaws of this type have been discovered during a brief
survey of the code.

$B$^$?(B, $B$3$NBP:v$O(B "$B<uF0E*(B(passive)" $B$J(B exploit,
$B$D$^$j%f!<%6$,(B, $B%W%m%-%7$r7PM3$7$FMxMQ$9$k$HL58z$J%G!<%?$rAw$jJV$9$h$&$J(B,
$B0-0U$r;}$C$?%5!<%P$r;H$&$H$$$&<jCJ$rMQ$$$?967b$rKI$0$3$H$O$G$-$^$;$s(B.
$B4JC1$J%3!<%I$ND4::$K$h$j(B, $B$3$N<o$N<eE@$,$$$/$D$+8+$D$+$C$F$$$^$9(B.

If you are running FreeBSD 4.0, a possible solution might be to confine the
delegate process inside a "jail" (see the jail(8) manpage). A properly
configured jail will isolate the contents in their own separate "virtual
machine", which can be suitably secured so that an attacker who gains
control of a process running inside the jail cannot escape and gain access
to the rest of the machine. Note that this is different from a traditional
chroot(8), since it does not just attempt to isolate processes inside
portions of the filesystem. This solution is not possible under standard
FreeBSD 3.x or earlier.

FreeBSD 4.0 $B$N>l9g$K$O(B, delegate $B$K$h$C$F8F$S=P$5$l$k%W%m%;%9$r(B
"jail($B]#(B)"(jail(8) $B$N%^%K%e%"%k%Z!<%8;2>H(B) $B$NFbIt$K@)8B$9$k$3$H$,(B,
$B2r7hK!$N0l$D$H$7$F9M$($i$l$^$9(B. jail $B$,E,@Z$K@_Dj$5$l$F$$$l$P(B,
$B$=$NFbIt$N%W%m%;%9$O$=$l$>$l(B "$B2>A[%^%7%s(B(virtual machine)" $B$H$7$F3VN%$5$l$^$9(B.
$B$=$N$?$a(B, $B967b<T$,(B jail $BFbIt$G<B9T$5$l$k0l$D$N%W%m%;%9$N@)8f$rC%$C$?$H$7$F$b(B,
jail $B$N30It$d(B, $B%^%7%s$N;D$j$NItJ,$X%"%/%;%9$9$k$3$H$O$G$-$^$;$s(B.
$B=>Mh$N(B chroot(8) $B$H$O0[$J$k$N$O(B, $B3VN%$5$l$k$N$,%U%!%$%k%7%9%F%`$@$1$K(B
$B$H$I$^$i$J$$$H$$$&E@$G$9(B.  $B$?$@$7$3$NJ}K!$O(B, $BG[I[$5$l$F$$$k(B
$BI8=`$N(B FreeBSD 3.X $B$*$h$S(B, $B$=$l0JA0$N%7%9%F%`$G$OMxMQ$G$-$^$;$s(B.

----Next_Part(Sun_Feb_27_04:20:04_2000_809)----
