LinuxSecurity.com
Share your story
The central voice for Linux and Open Source security news
Home News Topics Advisories HOWTOs Features Newsletters About Register

Welcome!
Sign up!
EnGarde Community
Login
Polls
What is the most important Linux security technology?
 
Advisories
Community
Linux Events
Linux User Groups
Link to Us
Security Center
Book Reviews
Security Dictionary
Security Tips
SELinux
White Papers
Featured Blogs
All About Linux
DanWalsh LiveJournal
Securitydistro
Latest Newsletters
Linux Security Week: October 27th, 2014
Linux Advisory Watch: October 24th, 2014
Subscribe
LinuxSecurity Newsletters
E-mail:
Choose Lists:
About our Newsletters
RSS Feeds
Get the LinuxSecurity news you want faster with RSS
Powered By

  
NetBSD: kernel Denial of service vulnerability Print E-mail
User Rating:      How can I rate this item?
Posted by LinuxSecurity.com Team   
NetBSD A malicious party can cause a remote kernel panic by using ICMPv6 "too big" messages.

NetBSD Security Advisory 2004-002
		 =================================

Topic:		Inconsistent IPv6 path MTU discovery handling

Version:	NetBSD-current:	source prior to February 5, 2004
		netBSD 1.6.2:	not affected (fixed)
		NetBSD 1.6.1:	affected
		NetBSD 1.6:	affected
		NetBSD-1.5.x:	not affected

Severity:	Remote kernel panic could be possible

Fixed:		NetBSD-current:		February 5, 2004
		NetBSD-1.6 branch:	February 9, 2004 (1.6.2 includes the fix)
		NetBSD-1.5 branch:	not affected


Abstract
========

A malicious party can cause a remote kernel panic by using ICMPv6 "too
big" messages.  

Technical Details
=================

Once a specially-crafted ICMPv6 "too big" message is sent to a victim
node, a routing table entry with a small path-MTU is installed.  

The victim system may later experience a kernel panic (due to a kernel
stack overflow) if a TCP session that uses the routing table entry is
later established.

For further details, see:

 	http://www.guninski.com/obsdmtu.html


Solutions and Workarounds
=========================

The default NetBSD kernels (GENERIC*) ship with IPv6 compiled in.  If
you are using a kernel without IPv6, your system is not affected.
Kernels with the "options INET6" line removed, or commented out, from
the kernel configuration file do not include IPv6.

Additionally, an attacker requires IPv6 connectivity to the host to
send the packets that exploit this vulnerability.  Note, however, that
systems without external IPv6 routed connectivity may still be exposed
via LAN or similar connections, where neighbouring systems can send
IPv6 packets to the node.  This potentially includes shared external
segments and wireless networks.

The following instructions describe how to upgrade your kernel by
updating your source tree and rebuilding and installing a new version
of the kernel.  After replacing the kernel, a reboot is necessary.

* NetBSD-current:

	Systems running NetBSD-current dated from before 2004-02-04
	should be upgraded to NetBSD-current dated 2004-02-05 or later.

	The following directories need to be updated from the
	netbsd-current CVS branch (aka HEAD):
		sys/netinet
		sys/netinet6

	To update from CVS, re-build, and re-install kernel:

		# cd src
		# cvs update -d -P sys/netinet sys/netinet6
		# cd sys/arch/ARCH/conf
		# config KERNELCONF
		# cd ../../compile/KERNELCONF
		# make clean depend; make
		# mv /netbsd /netbsd.old
		# cp netbsd /

	Then perform a reboot.
		# reboot


* NetBSD 1.6, 1.6.1:

	The binary distributions of NetBSD 1.6 and 1.6.1 are vulnerable.


        * Binary patch:

	Binary patches are being provided, in the form of replacement
	kernels built with the patches from the GENERIC kernel
	configuration.  If you use a custom kernel configuration,
	these may not be suitable for you.

	NOTE: The same kernel includes fixes for NetBSD-SA2004-002 and
	NetBSD-SA2004-004. If you already updated for 2004-004, you do
	not need to perform these steps again.

        To apply the binary patch, perform the following steps,
        replacing ARCH with the NetBSD architecture you are running
        (i.e. i386):

         ftp://ftp.netbsd.org/pub/NetBSD/security/patches/SA2004-002-kernel/netbsd-1-6/ARCH-kernel.tgz
        cd / && cp /path/to/ARCH-kernel.gz /
	gzip -d ARCH-kernel.gz

        The tar file will extract a new copy of:
                ARCH-kernel

	Back up your old kernel:
	mv netbsd netbsd.old

        Then either rename:
	mv ARCH-kernel netbsd

	or link, as per local site policy:
	ln ARCH-kernel netbsd

	Then, reboot.


        * Updating from sources:


	Systems running NetBSD 1.6 sources dated from before
	2004-02-08 should be upgraded from NetBSD 1.6 sources dated
	2004-02-09 or later.

	NetBSD 1.6.2 includes the fix.

	The following directories need to be updated from the
	netbsd-1-6 CVS branch:
		sys/netinet
		sys/netinet6

	To update from CVS, re-build, and re-install kernel:

		# cd src
		# cvs update -d -P -r netbsd-1-6 sys/netinet sys/netinet6
		# cd sys/arch/ARCH/conf
		# config KERNELCONF
		# cd ../../compile/KERNELCONF
		# make clean depend; make
		# mv /netbsd /netbsd.old
		# cp netbsd /

	Then perform a reboot.
		# reboot


Thanks To
=========

Georgi Guninski
Markus Friedl
Daniel Hartmeier
IIJ seil team


Revision History
================

	2004-02-18	Initial release


More Information
================

Advisories may be updated as new information becomes available.
The most recent version of this advisory (PGP signed) can be found at 
   ftp://ftp.NetBSD.org/pub/NetBSD/security/advisories/NetBSD-SA2004-002.txt.asc

Information about NetBSD and NetBSD security can be found at 
http://www.NetBSD.org/ and  http://www.NetBSD.org/Security/.


Copyright 2004, The NetBSD Foundation, Inc.  All Rights Reserved.
Redistribution permitted only in full, unmodified form.

$NetBSD: NetBSD-SA2004-002.txt.asc,v 1.1 2004/02/18 14:13:24 david Exp $

 
< Prev   Next >
    
Partner

 

Latest Features
Peter Smith Releases Linux Network Security Online
Securing a Linux Web Server
Password guessing with Medusa 2.0
Password guessing as an attack vector
Squid and Digest Authentication
Squid and Basic Authentication
Demystifying the Chinese Hacking Industry: Earning 6 Million a Night
Free Online security course (LearnSIA) - A Call for Help
What You Need to Know About Linux Rootkits
Review: A Practical Guide to Fedora and Red Hat Enterprise Linux - Fifth Edition
Yesterday's Edition
Pirate Bay founder guilty in historic hacker case
Parallels CTO: Linux container security is not the problem
Advisory says to assume all Drupal 7 websites are compromised
Partner Sponsor

Community | HOWTOs | Blogs | Features | Book Reviews | Networking
 Security Projects |  Latest News |  Newsletters |  SELinux |  Privacy |  Home
 Hardening |   About Us |   Advertise |   Legal Notice |   RSS |   Guardian Digital
(c)Copyright 2014 Guardian Digital, Inc. All rights reserved.