[FreeBSD-Announce] FreeBSD Core statement on recent freebsd-update and related vulnerabilities
core-secretary at freebsd.org
core-secretary at freebsd.org
Wed Aug 10 11:58:23 UTC 2016
Dear FreeBSD Community:
The FreeBSD Core team and FreeBSD Security team would like to update the
community on the reports of security vulnerabilities in freebsd-update,
portsnap, libarchive, and bspatch.
We understand the severity of this issue, and are actively working to resolve
the issues and improve the security of FreeBSD.
A recent post to the freebsd-security@ list raised a number of questions
and we would like to address those.
1. Since there are known vulnerabilities in freebsd-update and
portsnap, why has there been no notification to the community
As a general rule, the FreeBSD Security Officer does not announce
vulnerabilities for which there is no released patch. We are
reviewing this policy for cases where a proof-of-concept or working
exploit is already public.
2. Why was there no mention of the fact that running freebsd-update
to install the fix for the bspatch advisory [SA-16:25] may actually
expose users to the vulnerability?
To be exposed, a user would need to be under an active
Man-In-The-Middle attack when fetching patches. The Security
Advisory did not contain information on the theoretical implications
of the vulnerability. A more explicit paragraph in the 'Impact'
statement may have been warranted. As always, instructions on how to
compile the patched bspatch manually rather than using
freebsd-update were provided as part of the advisory.
3. The patch included in SA-16:25 is incomplete, and may still
permit heap corruption. The patch included in the document dump
is more complete. Why only a partial fix?
After discussion with the author of bspatch (Colin Percival, a
former FreeBSD Security Officer himself), The FreeBSD Security Team
found that the proposed patch added restrictions that may break
(legitimate) functionality in bspatch, possibly preventing some
valid patch files from being accepted. While a full fix is being
developed, the shorter patch which resolves the main vulnerability
was immediately released. This resolves the most critical issue in
the report. This smaller patch is safe, in that it does not risk
breaking bspatch while still resolving the attack vector of the
provided exploit code. The larger patch is still under development
and will be released once all of the issues have been
addressed. Automated fuzz testing is underway to search for any
additional memory corruption bugs.
Great care must be taken when updating the binary upgrade utility, as it
becomes much more difficult to fix after the fact, as the updater is then
broken. There are delicate interactions between the components that must be
thoroughly tested before the patch is released.
As of yet, patches for the libarchive vulnerabilities have not been released
upstream to be pulled into FreeBSD. In the meantime, HardenedBSD has created
patches for some of the libarchive vulnerabilities, the first is being
considered for inclusion in FreeBSD, at least until a complete fix is
committed upstream, however the second is considered too brute-force and
will not be committed as-is. Once the patches are in FreeBSD and updated
binaries are available, a Security Advisory will be issued.
The Security team is working on redesigning freebsd-update and portsnap to do
signature verification on all downloaded files before they are processed by
libarchive/tar, bspatch, or any other utilities. However, this change requires
modifying the metadata format used in the utilities, and care must be taken to
preserve compatibility with the existing clients, so the existing clients can
be used to install the future updates. Users will of course have the option to
build/apply the patches themselves if they do not feel comfortable using
freebsd-update to do so.
The security team is working diligently to resolve the issues and provide
timely, correct fixes for all known issues. Please subscribe to the
freebsd-security-notifications@ mailing-list to receive notifications of any
future Security Advisories.
-------------- next part --------------
A non-text attachment was scrubbed...
Size: 949 bytes
Desc: not available
More information about the freebsd-announce