• NetBSD Security Advisory 2018-001: Several vulnerabilities in context handling - this affects amd64, i386 and sparc64
• NetBSD Security Advisory 2018-002: Local DoS in virecover

• Video: https://www.youtube.com/watch?v=rRg2vuwF1hY
• Talk: https://events.ccc.de/congress/2017/Fahrplan/events/8968.html

As a hint, NetBSD still has a number of Security Advisories to publish, it seems. Anyone wants to help out the security team? :-)

[Tags: 34c3, Security]

• In-kernel audio mixing: So far, NetBSD's audio device can only be opened once. If more than one application wants to play sound, the first one wins. This is suboptimal if you want to (say) play some MP3s but also get some occasional noise from your webbrowser.

  Now, Nathanial Sloss has made a stab at this, providing several implementation choices. Challenges in the task are that sounds with different quality (sampling rate, mono/stereo etc.) need to be brought to one common quality before mixing and passing on to the actual audio hardware. Further fun is added by the delay this process adds. See the discussion on tech-kern for all the gory details!

• Freescale i.MX7 support: Ryo Shimizu has committed support for the Freescale i.MX7 processor and the Atmark Techno Armadillo-IoT G3 board. according to his posting to port-arm (dmesg included), UART, Ethernet, USB, SDHC, RTC, GPIO, WDOG and MULTIPROCESSOR work. Interesting thing of the platform is that is has two Cortex-A7 cores and one Cortex-M4 core, the latter without MMU. Ideas on how to use the latter are welcome! :)

• PIE binaries with PaX, ASLR+MPROTECT are now the default for i386. ASLR and MPROTECT can be turned off either globally or per-binary if any problems should arise. Be sure to document those exceptions in your risk management! :-)

  More information: PaX, PIE, ASLR, MPROTECT.

• Platform improvements for i386 and amd64. For amd64, Maxime Villard writes:

   - I cleaned up the asm code and fixed several comments, which makes the
     boot process much easier to understand.
   - I fixed the alignment for the text segment, so that it can be covered by
     more large pages [1] - thereby reducing TLB contention.
   - I fixed a bug in the way the secondary CPUs are launched [2], which
     caused them to crash if they tried to access an X-less page.
   - I took rodata out of the text+rodata chunk, and put it in the data+bss+
     PRELOADED_MODULES+BOOTSTRAP_TABLES chunk [3]. rodata was no longer large
     page optimized, and had RWX permissions.
   - I retook rodata out of the rodata+data+bss+PRELOADED_MODULES+
     BOOTSTRAP_TABLES chunk, and made the kernel map it independently without
     the W permision [4].
   - I made the kernel map rodata without the X permission, by using the NOX
     bit on its pages [5] (now that the secondary CPUs could handle that
     properly).
   - I took the data+bss chunk out of the data+bss+PRELOADED_MODULES+
     BOOTSTRAP_TABLES chunk, and made the kernel map it independently without
     X permission [6].
   - I made the kernel remap rodata and data+bss with large pages and proper
     permissions [7] - which reduces once again TLB contention.
  

  See Maxime's posting to tech-kern for all the footnotes. Likewise, Maxime also tackled i386, and besides the changes from amd64, here is the list of changes from his email:

   - on non-PAE i386, NOX does not exist. Therefore the mappings all have an
     additional X permission. To benefit from X-less mappings, your CPU must
     support PAE, and your kernel must be GENERIC_PAE.
   - the segments are not large-page-aligned, which means that probably some
     parts of the segments are still mapped with normal pages. It is still more
     optimized than it used to be, but not as much as amd64 is.
  

• NetBSD Security Advisory 2016-004: Multiple vulnerabilities in the NetBSD 32bit and Digital Unix compatibility layers
• NetBSD Security Advisory 2016-005: bozohttpd CGI handlers potential remote code execution

• 2016-001: Multiple vulnerabilities in ntp daemon
• 2016-002: BDF file parsing issues in libXfont
• 2016-003: Privilege escalation in calendar(1)

The advisories also contain an abstract of the problem as well as in-depth technicals with solutions and workarounds. Go and have a look!

[Tags: calendar, ntp, Security]

From DiscoverBSD: ``I take SA and A, and publish them on BSDSec.net website. Aim for website is to be very simple, intuitive and mobile-whatever frendly. Tags are available for better search (in case you want only FreeBSD). I also publish on Twitter. Discussion is available via Reddit.

All process is done by my application, so I do not need to do anything.

How it works?

App is open-source, built with Ruby on Rails. I will write details in my next post, as well with how-to on contributing and so. I have few ideas and anyone is welcome to join me and make this app better! ''

Check out BSDSec!

[Tags: Security]

• NetBSD Security Advisory 2014-001: Stack buffer overflow in libXfont:

  ``A stack buffer overflow in parsing of BDF font files in libXfont was found that can easily be used to crash X programs using libXfont, and likely could be exploited to run code with the privileges of the X program (most nostably, the X server, commonly running as root).

  This vulnerability has been assigned CVE-2013-6462.''

• NetBSD Security Advisory 2014-002: ntpd used as DDoS amplifier:

  ``An administrative query function is getting used by attackers to use ntp servers as traffic amplifiers. The new version no longer offers this query option.''

To save you from searching, here is the list of relevant changes from the release notes:

Complete source and binaries for NetBSD 6.0.1 are available for download at many sites around the world. A list of download sites providing FTP, AnonCVS, SUP, and other services may be found at http://www.NetBSD.org/mirrors/.

P.S.: Don't miss out on the end of NetBSD 2012 fundraise!

[Tags: Release, Security]

``To start with, the man pages for ipf(5) and ipnat(5) have been rewritten from scratch to make them easier to understand and thus easier to use the various features in IPFilter. In addition there is now an ipmon(5) that supports delivery of log messages to different destinations - including generating SNMP traps messages.

There are a few new actions that can be used with ipnat.conf. The one that will be of most interest to people is "rewrite" which supports translation of both the source and destination address with a single rule. Use of an rdr/map combination is no longer required. There are also some others that are more experimental. One of those is a "divert" action that takes a packet and puts an IP + UDP header on the front, allowing "raw packets" to be delivered to any socket. Similarly, replies from that socket have the relevant header data removed.

There are a few extras for ipf.conf, most notably it now allows for defining limits on how many different hosts/networks can have a state entry in the state table for each rule. IPFilter 5.1.1 also supports specifying a filter rule group for the filtering of ICMP packets that match an entry in the state table. Additionally, there is a new rule - "decapsulate". This has been designed to allow filtering on "inner headers" of packets that have been encapsulated in clear text. It will, for example, allow filtering on IPv4 headers inside of IPv6 packets (or vice versa.)

It is no longer required to have a separate ipf6.conf file. Both IPv4 and IPv6 packets can be used in the same file. For those that have separate files today, they should not interfere with each other unless you have "block in all" for IPv4 and "pass in all" for IPv6 or similar. In that case, the "block in all" will affect IPv6 traffic. This is a reflection of the internal design where there is now only a single list of filter rules, not one for each protocol. Check the man page for ipf.conf for more details.''

[Tags: ipfilter, Security]

Apparently FreeBSD's telnetd currently has such a problem, and I think it's fair that Colin Percival as the FreeBSD Security Officer did release the advisory, even if it's in a sub-optimal timeframe.

For those NetBSD uses wondering if there's a similar problem in NetBSD's telnetd: Apparenly an unchecked argument can cause memory corruption by a memcpy length parameter overflow in sub-option processing (for terminal type, size etc.). This was fixed in NetBSD thanks to a hints from Colin. There's no NetBSD Security Advisory yet, but people still using telnetd in production networks may consider rebuilding libtelnet and telnetd.

So, to those of you who have moved to SSH: Happy Holidays!
To the rest: Happy Updating! :-)

[Tags: Security]