Re:BSD libc contains a buffer overflow vulnerability
by topspin on Wednesday December 07, 2016 @04:33PM
(#13126422)
The flaw appears in the oldest version of the source on GitHub, circa 1994; "BSD 4.4 Lite Lib Sources." Who knows how far back it really goes.
It's really basic; get the kernel to cough up a bad sockaddr and bcopy will scribble on your memory. That may seem far fetched but then you remember LKM and maybe not. Incidentally OpenBSD dropped LKM support in 2014 [1], presumably for hardening purposes.
Re:BSD libc contains a buffer overflow vulnerability
by neom on Wednesday December 07, 2016 @02:39PM
(#13125506)
Unrelated: In responsible disclosure, is it standard to notify the biggest vendor first? I noticed apple was notified on Oct 10th, quite some time prior to the other vendors.
Re:BSD libc contains a buffer overflow vulnerability
by jlgaddis on Wednesday December 07, 2016 @02:44PM
(#13125555)
Perhaps it was discovered by an individual on OS X, reported (by the individual) to Apple, reported (by either the individual or Apple) to CERT, then CERT looked at it, found the other affected operating systems, and reported it to them?
There's a number of ways this particular "ordering" could have occurred.
Re:BSD libc contains a buffer overflow vulnerability
by richardwhiuk on Wednesday December 07, 2016 @03:17PM
(#13125824)
It's possible it was reported to Apple because they have a vulnerability bounty program, so they individual who reported it could get a reward. That might create an incentive to report it to larger targets who may run larger bounty programs.
Re:BSD libc contains a buffer overflow vulnerability
by em3rgent0rdr on Wednesday December 07, 2016 @04:04PM
(#13126205)
Top-Right corner shows this is Sponsored by the Department of Homeland Security...nice to hear that agency is doing something good for regular people's security.
from http://www.dhs.gov/office-cybersecurity-and-communications "The Office of Cybersecurity and Communications (CS&C), within the National Protection and Programs Directorate, is responsible for enhancing the security, resilience, and reliability of the Nation’s cyber and communications infrastructure."
Re:BSD libc contains a buffer overflow vulnerability
by CamperBob2 on Wednesday December 07, 2016 @04:05PM
(#13126210)
"The Office of Cybersecurity and Communications (CS&C), within the National Protection and Programs Directorate, is responsible for enhancing the security, resilience, and reliability of the Nation’s cyber and communications infrastructure."
That used to be part of the NSA's charter, more or less, before they decided that playing offense was more fun.
It's really basic; get the kernel to cough up a bad sockaddr and bcopy will scribble on your memory. That may seem far fetched but then you remember LKM and maybe not. Incidentally OpenBSD dropped LKM support in 2014 [1], presumably for hardening purposes.
[1] https://news.ycombinator.com/item?id=8554003
http://minnie.tuhs.org/cgi-bin/utree.pl?file=4.3BSD-Reno/src...
Personally I'm more worried about the function returning obuf, a pointer to a stack variable in link_ntoa.
(Pretty sure 4.3BSD didn't have loadable kernel modules; you built your kernel from source, uphill both ways in the snow.)
There's a number of ways this particular "ordering" could have occurred.
[1] https://marc.info/?l=openbsd-misc&m=148105687011923&w=2
from http://www.dhs.gov/office-cybersecurity-and-communications "The Office of Cybersecurity and Communications (CS&C), within the National Protection and Programs Directorate, is responsible for enhancing the security, resilience, and reliability of the Nation’s cyber and communications infrastructure."
That used to be part of the NSA's charter, more or less, before they decided that playing offense was more fun.