BSDFreaks.nl

Zoals elke maand heeft netcraft weer een overzicht gemaakt van de gebruikte webservers. Je kunt [url=http://news.netcraft.com/archives/2003/04/13/april_2003_web_server_survey.html]hier[/url] zien dat het gebruik Apache iets toeneemnt.
Een aantal leuke feitjes:
[quote]
The number of sites running Windows Server 2003 has overtaken Solaris 9‚
in spite of the fact that Windows Server 2003 does not launch until later
on this month.[/quote]
[url]http://news.netcraft.com/archives/2003/04/13/windows_server_2003_overtakes_solaris_9.html[/url]

[quote]Recent Changes at Notable Sites

Some notable Netscape-Enterprise sites have switched to Apache based
servers‚ including the Vatican‚ Kellogg’s and NASA.[/quote]
[url]http://news.netcraft.com/archives/2003/04/13/recent_changes_at_notable_sites.html[/url]

[quote]Java Servlet Engines

Java Servlet Servers are absent from a top line glance at the Web Server
Survey. However‚ JSP is a fast growing technology and powers many
sophisticated web applications. Figures derived from the http headers in
this months Web Server Survey provide a crude but quick and simple view of
sites using web servers provided by Java Servlet Engine developers. Java
Servlet Engines are also often used with Apache‚ Microsoft and SunONE web
servers and these would be not be included by this view.[/quote]
[url]http://news.netcraft.com/archives/2003/04/10/java_servlet_engines.html[/url]

[quote]Netcraft SSL Survey

The Netcraft Secure Server Survey examines the use of encrypted
transactions on the Web through extensive automated exploration of the
Internet. It provides a monthly updated view on operating systems‚ web
servers‚ and certificate authorities‚ including a per country analysis. An
example pageset is available at
http://www.netcraft.com/surveys/analysis/https/2001/Jan/ [/quote]

[url]http://news.netcraft.com/archives/2003/04/09/netcraft_ssl_survey.html[/url]

Na enige tijd van uitstel‚ is ie er dan toch. De opvolger van de in october 2002 gereleasde 4.7. Nadat 4.8 op 31 maart al in de CVS-tree te vinden was‚ is nu ook eindelijk de binary-release.

4.8 is de laatste versie van de stable-branch en is bedoeld voor de mensen die nog niet over willen/durven/kunnen naar de 5-serie.

De belangrijkste updates bevatten o.a. support voor FireWire en er zijn wat vervelende kevertjes geplet in de basisprogramma’s.

Al met al de moeite waard om up te graden.
[url=http://www.freebsd.org/releases/4.8R/announce.html]Hier kun je de announcement lezen[/url]

Op de FreeBSD [url=http://www.freebsdforums.org/forums/showthread.php?threadid=7963]security mailinglist[/url] maakt Pawel Jakub Dawidek bekend dat zij de eerste versie van hun FreeBSD kernel security module hebben gereleased. Deze kernel module genaamd [url=http://cerber.sourceforge.net/]CerbNG[/url] maakt het mogelijk voor Administrators om specifieke controle over het systeem te krijgen.
[quote]
CerbNG is a kernel module for FreeBSD version 4.x (5.x version soon to come).
Our main purpose is providing the administrator with tools for enforcing fine
grained control for critical system applications/processes/environments‚ i.e.
privileged daemons (not only those running with uid 0)‚ and setuid programs.
But it is just a small part of CerbNG functionality.[/quote]

Er is weer een [url=http://www.freebsdforums.org/forums/showthread.php?threadid=7937]security advisory[/url] uitgegeven voor FreeBSD. Deze keer betreft het de XDR encoder/decoder die ontwikkeld is door Sun.
[quote]
The xdrmem XDR stream object does incorrect bounds-checking. It may be possible for an attacker to send maliciously formatted messages to a service which utilizes the xdrmem XDR stream object and cause a denial-of-service.[/quote]

Volledige Advisory:
[quote]
FreeBSD-SA-03:05.xdr Security Advisory
The FreeBSD Project

Topic: remote denial-of-service in XDR encoder/decoder

Category: core
Module: libc
Announced: 2003-03-20
Credits: Riley Hassell‚ eEye
Todd Miller
Affects: All releases of FreeBSD prior to 4.6-RELEASE-p11‚
4.7-RELEASE-p8‚ 4.8-RELEASE and 5.0-RELEASE-p5
Corrected: 2003-03-20 12:59:55 UTC (RELENG_4)
2003-03-20 13:05:04 UTC (RELENG_4_6)
2003-03-20 13:05:27 UTC (RELENG_4_7)
2003-03-20 13:04:46 UTC (RELENG_5_0)
FreeBSD only: NO

I. Background

XDR (eXternal Data Representation) is a standard developed by Sun
Microsystems for platform-independent encoding of data types. It is
widely used by the Sun RPC (Remote Procedure Call) protocol and other
protocols. FreeBSD’s standard C library includes routines for encoding
and decoding XDR‚ derived from a library originally distributed by
Sun Microsystems.

II. Problem Description

The xdrmem XDR stream object does incorrect bounds-checking. An
internal variable used for tracking bounds is a signed integer.
Bounds-checking is performed by subtracting the object length from
this signed integer‚ and then testing for a negative result. However‚
if the object length is sufficiently large‚ the internal variable will
wrap and the result will be positive.

III. Impact

For some operations on the xdrmem XDR stream object‚ the
bounds-checking is followed by a memory copy. If the bounds-checking
error is exploited‚ then the memory copy will operate on a huge region
of memory‚ resulting in a segmentation violation. Thus‚ it may be
possible for an attacker to send maliciously formatted messages to a
service which utilizes the xdrmem XDR stream object and cause a
denial-of-service.

IV. Workaround

None known.

V. Solution

Do one of the following:

1) Upgrade your vulnerable system to the FreeBSD 4-STABLE branch; or
to the RELENG_4_7 (4.7-RELEASE-p8)‚ RELENG_4_6 (4.6-RELEASE-p11)‚ or
RELENG_5_0 (5.0-RELEASE-p5) security branch dated after the correction
date.

2) To patch your present system:

The following patch has been verified to apply to FreeBSD 4.6‚ and 4.7
systems.

a) Download the relevant patch from the location below‚ and verify the
detached PGP signature using your PGP utility.

# fetch ftp://ftp.FreeBSD.org/pub/FreeBSD/C…:05/xdr-4.patch
# fetch ftp://ftp.FreeBSD.org/pub/FreeBSD/C…xdr-4.patch.asc

The following patch has been verified to apply to FreeBSD 5.0 systems.

a) Download the relevant patch from the location below‚ and verify the
detached PGP signature using your PGP utility.

# fetch ftp://ftp.FreeBSD.org/pub/FreeBSD/C…:05/xdr-5.patch
# fetch ftp://ftp.FreeBSD.org/pub/FreeBSD/C…xdr-5.patch.asc

b) Execute the following commands as root:

# cd /usr/src
# patch < /path/to/patch c) Recompile the operating system as described in .

Note that any statically linked applications that are not part of
the base system (i.e. from the Ports Collection or other 3rd-party
sources) must be recompiled.

All affected applications must be restarted for them to use the
corrected library. Though not required‚ rebooting may be the easiest
way to accomplish this.

VI. Correction details

The following list contains the revision numbers of each file that was
corrected in FreeBSD.

Branch Revision
Path
– ————————————————————————-
RELENG_4
src/include/rpc/xdr.h 1.14.2.1
src/lib/libc/xdr/xdr_mem.c 1.8.2.1
RELENG_4_6
src/UPDATING 1.73.2.68.2.38
src/include/rpc/xdr.h 1.14.10.1
src/lib/libc/xdr/xdr_mem.c 1.8.10.1
src/sys/conf/newvers.sh 1.44.2.23.2.28
RELENG_4_7
src/UPDATING 1.73.2.74.2.10
src/include/rpc/xdr.h 1.14.12.1
src/lib/libc/xdr/xdr_mem.c 1.8.12.1
src/sys/conf/newvers.sh 1.44.2.26.2.10
RELENG_5_0
src/UPDATING 1.229.2.10
src/include/rpc/xdr.h 1.21.2.1
src/lib/libc/xdr/xdr_mem.c 1.11.2.1
src/sys/conf/newvers.sh 1.48.2.6
– ————————————————————————-

VII. References

—–BEGIN PGP SIGNATURE—–
Version: GnuPG v1.2.0 (FreeBSD)
Comment: FreeBSD: The Power To Serve[/quote]

Deze week is de [url=http://mail-index.netbsd.org/netbsd-announce/2003/03/19/0001.html]10de verjaardag[/url] van het NetBSD project.

Verder zijn er nog wat leuke ontwikkelingen betreffende [url=http://mail-index.netbsd.org/tech-x11/2003/03/19/0000.html]DRI ondersteuning[/url] in NetBSD:
[quote]
Erik Reid has been working on getting DRI support for NetBSD to work. Under NetBSD/i386 1.6P‚ a Matrox G450 has been reported to work‚ Radeon and Riva128 should be functional as well.[/quote]

De eerste cvs commit bestond uit:
[file]
RCS file: /cvsroot/src/Makefile‚v
Working file: Makefile
—————————-
revision 1.1
date: 1993/03/21 09:45:37; author: cgd; state: Exp;
branches: 1.1.1;
Initial revision
[/file]

Het FreeBSD releng team heeft de tweede release candidate uitgebracht. Nadat de de release van 4.8 is uitgesteld tot 24 maart.

[quote]
The FTP installation directory, mini-ISO, and full ISO with packages
are available now from ftp.freebsd.org and most mirrors. Sysinstall
won’t properly install GNOME+Enlightenment, but all other desktop
environments should install properly. GNOME+E should be installable
with pkg_add. The Alpha build is in progress (thanks David!). The
testing guide is available here :

http://www.freebsd.org/releases/4.8R/qa.html

Please email re@ if you have an open issue that should be reflected
on this page. As always, thanks for your help making this FreeBSD
release a success.
– Murray / Release Engineering Team
[/quote]

Onlamp heeft een artikel gepubliceerd over hoe je eenvoudig kan controleren of je geen rootkits of trojans op je systeem hebt staan.
[quote]
Trojans‚ rootkits‚ and DDoS agents are a sad reality. It’s a little disheartening to think that software exists which‚ given a chance‚ can install unwanted files on your system‚ overwrite or destroy your own files‚ send your data or user input elsewhere‚ or use your computer to attack another system.
[/quote]

[url=http://www.onlamp.com/pub/a/bsd/2003/03/06/FreeBSD_Basics.html?page=last&x-showcontent=text#thread]Het hele artikel[/url]