4 ms·

BSD libc contains a buffer overflow vulnerability

74 points by kumaranvpl 10y ago

neom 10y ago
Unrelated: In responsible disclosure, is it standard to notify the biggest vendor first? I noticed apple was notified on Oct 10th, quite some time prior to the other vendors.
- jlgaddis 10y ago
  Perhaps it was discovered by an individual on OS X, reported (by the individual) to Apple, reported (by either the individual or Apple) to CERT, then CERT looked at it, found the other affected operating systems, and reported it to them? There's a number of ways this particular "ordering" could have occurred.
  - richardwhiuk 10y ago
    It's possible it was reported to Apple because they have a vulnerability bounty program, so they individual who reported it could get a reward. That might create an incentive to report it to larger targets who may run larger bounty programs.
jimktrains2 10y ago
It'll be interesting to know if OpenBSD is affected. They don't seem to have responded yet.
- elchief 10y ago
  tedu wrote a post about it: http://www.tedunangst.com/flak/post/who-even-calls-link-ntoa http://www.tedunangst.com/flak/post/who-even-calls-link-ntoa
- qwename 10y ago
  This came up in the openbsd-misc mailing list yesterday[1]. Someone also mentioned the link that elchief posted. [1] https://marc.info/?l=openbsd-misc&m=148105687011923&w=2 https://marc.info/?l=openbsd-misc&m=148105687011923&w=2
em3rgent0rdr 10y ago
Top-Right corner shows this is Sponsored by the Department of Homeland Security...nice to hear that agency is doing something good for regular people's security. from http://www.dhs.gov/office-cybersecurity-and-communications http://www.dhs.gov/office-cybersecurity-and-communications "The Office of Cybersecurity and Communications (CS&C), within the National Protection and Programs Directorate, is responsible for enhancing the security, resilience, and reliability of the Nation’s cyber and communications infrastructure."
- CamperBob2 10y ago
  "The Office of Cybersecurity and Communications (CS&C), within the National Protection and Programs Directorate, is responsible for enhancing the security, resilience, and reliability of the Nation’s cyber and communications infrastructure." That used to be part of the NSA's charter, more or less, before they decided that playing offense was more fun.
topspin 10y ago
The flaw appears in the oldest version of the source on GitHub, circa 1994; "BSD 4.4 Lite Lib Sources." Who knows how far back it really goes. It's really basic; get the kernel to cough up a bad sockaddr and bcopy will scribble on your memory. That may seem far fetched but then you remember LKM and maybe not. Incidentally OpenBSD dropped LKM support in 2014 [1], presumably for hardening purposes. [1] https://news.ycombinator.com/item?id=8554003 https://news.ycombinator.com/item?id=8554003
- kps 10y ago
  4.3 Reno, apparently added as part of OSI networking, which explains why no one has ever heard of it. (Pretty sure 4.3BSD didn't have loadable kernel modules; you built your kernel from source, uphill both ways in the snow.)
  - kjs3 10y ago
    You may not have heard of it, but many of us have (and ran it back in the day). The key things most people care about in Reno are NFS and POSIX, which did end up being more important than OSI.
- ben_bai 10y ago
  4.3BSD-Reno, basically unchanged since 1990 until yesterday. http://minnie.tuhs.org/cgi-bin/utree.pl?file=4.3BSD-Reno/src/lib/libc/net/linkaddr.c http://minnie.tuhs.org/cgi-bin/utree.pl?file=4.3BSD-Reno/src... Personally I'm more worried about the function returning obuf, a pointer to a stack variable in link_ntoa.
  - tedunangst 10y ago
    That's not on the stack.
    - ben_bai 10y ago
      Oh indeed. Static it is...

74 points by kumaranvpl 10y ago

neom 10y ago

Unrelated: In responsible disclosure, is it standard to notify the biggest vendor first? I noticed apple was notified on Oct 10th, quite some time prior to the other vendors.

jlgaddis 10y ago
Perhaps it was discovered by an individual on OS X, reported (by the individual) to Apple, reported (by either the individual or Apple) to CERT, then CERT looked at it, found the other affected operating systems, and reported it to them? There's a number of ways this particular "ordering" could have occurred.
- richardwhiuk 10y ago
  It's possible it was reported to Apple because they have a vulnerability bounty program, so they individual who reported it could get a reward. That might create an incentive to report it to larger targets who may run larger bounty programs.

jimktrains2 10y ago

It'll be interesting to know if OpenBSD is affected. They don't seem to have responded yet.

elchief 10y ago
tedu wrote a post about it: http://www.tedunangst.com/flak/post/who-even-calls-link-ntoa http://www.tedunangst.com/flak/post/who-even-calls-link-ntoa
qwename 10y ago
This came up in the openbsd-misc mailing list yesterday[1]. Someone also mentioned the link that elchief posted. [1] https://marc.info/?l=openbsd-misc&m=148105687011923&w=2 https://marc.info/?l=openbsd-misc&m=148105687011923&w=2

em3rgent0rdr 10y ago

Top-Right corner shows this is Sponsored by the Department of Homeland Security...nice to hear that agency is doing something good for regular people's security. from http://www.dhs.gov/office-cybersecurity-and-communications http://www.dhs.gov/office-cybersecurity-and-communications "The Office of Cybersecurity and Communications (CS&C), within the National Protection and Programs Directorate, is responsible for enhancing the security, resilience, and reliability of the Nation’s cyber and communications infrastructure."

CamperBob2 10y ago
"The Office of Cybersecurity and Communications (CS&C), within the National Protection and Programs Directorate, is responsible for enhancing the security, resilience, and reliability of the Nation’s cyber and communications infrastructure." That used to be part of the NSA's charter, more or less, before they decided that playing offense was more fun.

topspin 10y ago

The flaw appears in the oldest version of the source on GitHub, circa 1994; "BSD 4.4 Lite Lib Sources." Who knows how far back it really goes. It's really basic; get the kernel to cough up a bad sockaddr and bcopy will scribble on your memory. That may seem far fetched but then you remember LKM and maybe not. Incidentally OpenBSD dropped LKM support in 2014 [1], presumably for hardening purposes. [1] https://news.ycombinator.com/item?id=8554003 https://news.ycombinator.com/item?id=8554003

kps 10y ago
4.3 Reno, apparently added as part of OSI networking, which explains why no one has ever heard of it. (Pretty sure 4.3BSD didn't have loadable kernel modules; you built your kernel from source, uphill both ways in the snow.)
- kjs3 10y ago
  You may not have heard of it, but many of us have (and ran it back in the day). The key things most people care about in Reno are NFS and POSIX, which did end up being more important than OSI.
ben_bai 10y ago
4.3BSD-Reno, basically unchanged since 1990 until yesterday. http://minnie.tuhs.org/cgi-bin/utree.pl?file=4.3BSD-Reno/src/lib/libc/net/linkaddr.c http://minnie.tuhs.org/cgi-bin/utree.pl?file=4.3BSD-Reno/src... Personally I'm more worried about the function returning obuf, a pointer to a stack variable in link_ntoa.
- tedunangst 10y ago
  That's not on the stack.
  - ben_bai 10y ago
    Oh indeed. Static it is...