Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2020.1670
FreeBSD Security Advisories for libalias
13 May 2020
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: libalias
Publisher: FreeBSD
Operating System: FreeBSD
UNIX variants (UNIX, Linux, OSX)
Impact/Access: Read-only Data Access -- Existing Account
Access Confidential Data -- Existing Account
Reduced Security -- Existing Account
Resolution: Patch/Upgrade
CVE Names: CVE-2020-7455 CVE-2020-7454
Original Bulletin:
https://security.freebsd.org/advisories/FreeBSD-SA-20:12.libalias.asc
https://security.freebsd.org/advisories/FreeBSD-SA-20:13.libalias.asc
Comment: This bulletin contains two (2) FreeBSD security advisories.
This advisory references vulnerabilities in products which run on
platforms other than FreeBSD. It is recommended that administrators
running libalias check for an updated version of the software for
their operating system.
- --------------------------BEGIN INCLUDED TEXT--------------------
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
=============================================================================
FreeBSD-SA-20:12.libalias Security Advisory
The FreeBSD Project
Topic: Insufficient packet length validation in libalias
Category: core
Module: libalias
Announced: 2020-05-12
Credits: Lucas Leong (@_wmliang_) of Trend Micro Zero Day Initiative
Vishnu working with Trend Micro Zero Day Initiative
Affects: All supported versions of FreeBSD.
Corrected: 2020-05-12 16:49:04 UTC (stable/12, 12.1-STABLE)
2020-05-12 16:51:11 UTC (releng/12.1, 12.1-RELEASE-p5)
2020-05-12 16:49:04 UTC (stable/11, 11.4-STABLE)
2020-05-12 16:51:11 UTC (releng/11.4, 11.4-BETA1-p1)
2020-05-12 16:51:11 UTC (releng/11.3, 11.3-RELEASE-p9)
CVE Name: CVE-2020-7454
For general information regarding FreeBSD Security Advisories,
including descriptions of the fields above, security branches, and the
following sections, please visit <URL:https://security.FreeBSD.org/>.
I. Background
The ipfw(4) system facility allows IP packet filtering, redirecting, and
traffic accounting. The ipfw(4) packet filter also contains two different
methods of accomplishing network address translation (NAT): in-kernel and
userspace. Both implementations use the same functions provided by libalias.
The libalias(3) library is a collection of functions for aliasing and
dealiasing of IP packets, intended for masquerading and NAT. Additionally,
libalias(3) includes modules to support protocols that require additional
logic to support address translation.
Note: libalias(3) is not used by either the pf(4) or ipf(4) firewalls.
II. Problem Description
libalias(3) packet handlers do not properly validate the packet length before
accessing the protocol headers. As a result, if a libalias(3) module does
not properly validate the packet length before accessing the protocol header,
it is possible for an out of bound read or write condition to occur.
III. Impact
A malicious attacker could send specially constructed packets that exploit
the lack of validation allowing the attacker to read or write memory either
from the kernel (for the in-kernel NAT implementation) or from the process
space for natd (for the userspace implementation).
IV. Workaround
No workaround is available. Only systems using NAT and ipfw together are
affected. Systems using ipfw(4) without NAT, or systems leveraging pf(4) or
ipf(4) are not affected.
V. Solution
Upgrade your vulnerable system to a supported FreeBSD stable or
release / security branch (releng) dated after the correction date,
and reboot.
Perform one of the following:
1) To update your vulnerable system via a binary patch:
Systems running a RELEASE version of FreeBSD on the i386 or amd64
platforms can be updated via the freebsd-update(8) utility:
# freebsd-update fetch
# freebsd-update install
# shutdown -r +10min "Rebooting for a security update"
2) To update your vulnerable system via a source code patch:
The following patches have been verified to apply to the applicable
FreeBSD release branches.
a) Download the relevant patch from the location below, and verify the
detached PGP signature using your PGP utility.
# fetch https://security.FreeBSD.org/patches/SA-20:12/libalias.patch
# fetch https://security.FreeBSD.org/patches/SA-20:12/libalias.patch.asc
# gpg --verify libalias.patch.asc
b) Apply the patch. Execute the following commands as root:
# cd /usr/src
# patch < /path/to/patch
c) Recompile your kernel as described in
<URL:https://www.FreeBSD.org/handbook/kernelconfig.html> and reboot the
system.
VI. Correction details
The following list contains the correction revision numbers for each
affected branch.
Branch/path Revision
- - -------------------------------------------------------------------------
stable/12/ r360971
releng/12.1/ r360972
stable/11/ r360971
releng/11.4/ r360972
releng/11.3/ r360972
- - -------------------------------------------------------------------------
To see which files were modified by a particular revision, run the
following command, replacing NNNNNN with the revision number, on a
machine with Subversion installed:
# svn diff -cNNNNNN --summarize svn://svn.freebsd.org/base
Or visit the following URL, replacing NNNNNN with the revision number:
<URL:https://svnweb.freebsd.org/base?view=revision&revision=NNNNNN>
VII. References
<URL:https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-7454>
The latest revision of this advisory is available at
<URL:https://security.FreeBSD.org/advisories/FreeBSD-SA-20:12.libalias.asc>
- -----BEGIN PGP SIGNATURE-----
iQKTBAEBCgB9FiEE/A6HiuWv54gCjWNV05eS9J6n5cIFAl663tdfFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldEZD
MEU4NzhBRTVBRkU3ODgwMjhENjM1NUQzOTc5MkY0OUVBN0U1QzIACgkQ05eS9J6n
5cK1Iw/7BpU400GeYsWt6xd+tUuBqGGB6a28+4G/e2GkqMF83vwAaf9+M4siM4Md
t0RUDLhcC3irLtGehLcXmVdWZUakmacGa3pGza3E8qdCSQC6+VdO4ghzk5fRlVf0
jmcvCi7zml0YhmATkfMBscPeOJmvENUpouVIwzn4CXMwCKMofjKXdW8+tiT6ppsD
RVVeUrGdslVo40KZ8wqxx4y2IMKZ7qW/UZnqWQFAAD3d3iQBJXORpy1xn0AZStY2
ddnhkKdBOyKs5JLoJfSwP8vyTi4iMXPFILP1spuTAqxEFBRTZ3rTE81jimznhp5N
/OXI92khj6deiTc1kun+ef3n89e1w6KO4Dt1LUNL08N4mpEwLwvBGLS/5v/3KVpm
Q6XknASLY4RaWdj1D5zbPY6F+JFUv22la5mdia4Gn1zxjsyZNMGgM6nx8OCZn4qg
JTr7RT4f+EubkEwYD1sw60iTYsqM3o1gFUzkFdEAotWU4tl3nxRkUwusikX7Uu7e
2QY46Sg/6NxW+oelx1qDGjMlP2CIlEsEqj4ND3eJzJT6nef1xmmTUUu+kQF4TBtX
J7XqmuTzST2ySPhBUEIOKbjmzdbe+zpbraADhq5BS3zKKmcVSqmqJxkXPxzCwIwb
uMcg2spQ5fzP/BquOGdQSx0rD3dQ5lTNX6QZyDaKHZR78ZAEiVE=
=I9Vz
- -----END PGP SIGNATURE-----
- -----------------------------------------------------------------------------
- ----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
=============================================================================
FreeBSD-SA-20:13.libalias Security Advisory
The FreeBSD Project
Topic: Memory disclosure vulnerability in libalias
Category: core
Module: libalias
Announced: 2020-05-12
Credits: Vishnu Dev TJ working with Trend Micro Zero Day Initiative
Affects: All supported versions of FreeBSD
Corrected: 2020-05-12 16:52:08 UTC (stable/12, 12.1-STABLE)
2020-05-12 16:54:39 UTC (releng/12.1, 12.1-RELEASE-p5)
2020-05-12 16:52:08 UTC (stable/11, 11.4-STABLE)
2020-05-12 16:54:39 UTC (releng/11.4, 11.4-BETA1-p1)
2020-05-12 16:54:39 UTC (releng/11.3, 11.3-RELEASE-p9)
CVE Name: CVE-2020-7455
For general information regarding FreeBSD Security Advisories,
including descriptions of the fields above, security branches, and the
following sections, please visit <URL:https://security.FreeBSD.org/>.
I. Background
The ipfw(4) system facility allows IP packet filtering, redirecting, and
traffic accounting. The ipfw(4) packet filter also contains two different
methods of accomplishing network address translation (NAT): in-kernel and
userspace. Both implementations use the same functions provided by libalias.
The libalias(3) library is a collection of functions for aliasing and
dealiasing of IP packets, intended for masquerading and NAT. Additionally,
libalias(3) includes modules to support protocols that require additional
logic to support address translation.
Note: libalias(3) is not used by either the pf(4) or ipf(4) firewalls.
II. Problem Description
The FTP packet handler in libalias incorrectly calculates some packet
lengths. This may result in disclosing small amounts of memory from the
kernel (for the in-kernel NAT implementation) or from the process space for
natd (for the userspace implementation).
III. Impact
A malicious attacker could send specially constructed packets that exploit the
erroneous calculation allowing the attacker to disclose small amount of memory
either from the kernel (for the in-kernel NAT implementation) or from the
process space for natd (for the userspace implementation).
IV. Workaround
No workaround is available. Only systems using NAT and ipfw together are
affected. Systems using ipfw without NAT, or systems leveraging pf(4) or
ipf(4) are not affected.
V. Solution
Upgrade your vulnerable system to a supported FreeBSD stable or
release / security branch (releng) dated after the correction date,
and reboot.
Perform one of the following:
1) To update your vulnerable system via a binary patch:
Systems running a RELEASE version of FreeBSD on the i386 or amd64
platforms can be updated via the freebsd-update(8) utility:
# freebsd-update fetch
# freebsd-update install
# shutdown -r +10min "Rebooting for a security update"
2) To update your vulnerable system via a source code patch:
The following patches have been verified to apply to the applicable
FreeBSD release branches.
a) Download the relevant patch from the location below, and verify the
detached PGP signature using your PGP utility.
# fetch https://security.FreeBSD.org/patches/SA-20:13/libalias.patch
# fetch https://security.FreeBSD.org/patches/SA-20:13/libalias.patch.asc
# gpg --verify libalias.patch.asc
b) Apply the patch. Execute the following commands as root:
# cd /usr/src
# patch < /path/to/patch
c) Recompile your kernel as described in
<URL:https://www.FreeBSD.org/handbook/kernelconfig.html> and reboot the
system.
VI. Correction details
The following list contains the correction revision numbers for each
affected branch.
Branch/path Revision
- - -------------------------------------------------------------------------
stable/12/ r360973
releng/12.1/ r360974
stable/11/ r360973
releng/11.4/ r360974
releng/11.3/ r360974
- - -------------------------------------------------------------------------
To see which files were modified by a particular revision, run the
following command, replacing NNNNNN with the revision number, on a
machine with Subversion installed:
# svn diff -cNNNNNN --summarize svn://svn.freebsd.org/base
Or visit the following URL, replacing NNNNNN with the revision number:
<URL:https://svnweb.freebsd.org/base?view=revision&revision=NNNNNN>
VII. References
<URL:https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-7455>
The latest revision of this advisory is available at
<URL:https://security.FreeBSD.org/advisories/FreeBSD-SA-20:13.libalias.asc>
- -----BEGIN PGP SIGNATURE-----
iQKTBAEBCgB9FiEE/A6HiuWv54gCjWNV05eS9J6n5cIFAl663tdfFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldEZD
MEU4NzhBRTVBRkU3ODgwMjhENjM1NUQzOTc5MkY0OUVBN0U1QzIACgkQ05eS9J6n
5cK3hhAAlkHMjDluGni1AaDicw5jZuyrdGLEMfgH2OdxcrTQvrBN6ZEkfLsiFvLV
KWgUS+rx3GJApz4rZ6DFwsb+DG+kMCwYGevbT5zH5IUwe1HklyMLmjw48z47DVhx
8tpjCKNb4ttqBzb6RMURoJgo+2NAUQOZLnFGLSGOkquqeW9AhA97ZIGv7TyOPC1p
rJD/ic1IxTUXniNu4soexsRqVoMqv1nA1DLrN4TTooFVCQTHaBUBxSTFlaAsBXyb
7L5GIEydZ2429spQACnFGW4RDveOGB/6Jbt2yHEuu+ASOrwl9sRSu79PYijcz28v
yXjI0zG4A+78qmeCMbGHIySrLjc8XaWgr13Kp4S+40MWQhoGHJ2ZZVdLX010WTvm
nbGs9NQ60sytxdJn1QRTleiBIKjJiVqNEADfS4DhXa/0HouN3L8dVR/+jPfLMFmT
/7GZjhdbn4u0a1ZlgUZ62oHoo8NLop49KY4LHtHd7VpJZ8OfK0qkCN0DL4Ep+Wrg
oZWJL5HGhFOEA4TDYuypJ58yIPsTDVa9MuLMx/SBF30jVZcS1LtbiMXXuZs6clig
oOk4ZE0hpSRdA69xgX459kcTjU6XVJRnTPWyepG3sNljktwk8jyfwKHXOUpJONos
0jWu0ngj60djS8qCrxdkMn3t26fk0IhbA4leBEM+wAKmWsARt/M=
=woOx
- -----END PGP SIGNATURE-----
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
https://www.auscert.org.au/bulletins/
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBXrt6dmaOgq3Tt24GAQikLg//YkMDqAqUnI2S10Beb0VSeuEs4SVVwXaC
YJiS13Ht+0KsinmP/MxaFAO2sTGhW+BHlna3MT1EKn59VkUXl4cJP9bX9ELvoSsA
i9WJ6wsySIC5r2WYLXXYXF3/l2XsscoyILP8Cbmxb9/bOgi0KqBC7+8JCmTFk2BX
9OFcLxK4PvZjnLzbk8vRnlCuEKb/X9j8xIWc/lYtLjCFFD6fjZrzYKdWOo8N4FZh
x1xAy+ZMJm4amCDgGJ8uZzYQ6EBSUVcVo8UGCsxdY4h1t9U6agRvIZICmE44vUSN
YLgbahDF8jI1K2D1d6NS1c4PKXW/C9wr+NChW0bl/Uos8NhsaXArzAKzGn3OGyn9
R3BWHpKx9qXNmNFhmnAd8miOGyt4zjYhh0PCZMknPvfxeuin6VgBjco7HD7X80FG
BtbBaaAOqnL55MlvtSaMR1v0T5p6n1i0ji5zG5uOWwTk0ogkja7axiYyjAJoNH4e
xsW/AejswN7+S6hxiXtvhguGORfvN2PvP0Dh0bp8x54bob+u79j+GejSFzojA+bI
09OGPJT1aj8ve9mjiSnSj8vO4kPeyi9ZXMzuXjJyADLw3IEYbG1HGDeoRGIDqYSZ
jkW0/UluvYIYw7Hv678RuU1x2R44zIwcPb9vxgSa4eO9MVOt1pAK71qEAK+pDf0p
FOVyN3HgwJQ=
=VB6a
-----END PGP SIGNATURE-----