发布日期：2000-06-23
更新日期：2000-06-23

受影响系统：

- FreeBSD 3.4
- FreeBSD 4.0
- FreeBSD 5.0
        

不受影响系统：

- 2000-06-08 (3.4-STABLE)
- 2000-06-08 (4.0-STABLE)
- 2000-06-02 (5.0-CURRENT)

描述：

---

FreeBSD IP堆栈对IP选项的处理中存在几个安全漏洞，由于缺乏对参数的边界检查，
以及其他的一些代码错误，当内核接受到一些特别的IP包时，将导致产生对内存区
域的非法访问以至内核崩溃,FreeBSD可能会重新启动。


<* 来源： NetBSD Security Advisory 2000-002
         Jun-ichiro itojun Hagino <itojun@kame.net>
         FreeBSD Security Advisory -- FreeBSD-SA-00:23    
*>






建议：

---

1) 升级你的FreeBSDU系统到正确日期以后的3.4-STABLE, 4.0-STABLE 或者5.0-CURRENT版本
   (正确日期见"不受影响的系统"一栏)

2） 打如下的补丁程序，重新编译内核

ftp://ftp.freebsd.org/pub/FreeBSD/CERT/patches/SA-00:23/ip_options.diff
ftp://ftp.freebsd.org/pub/FreeBSD/CERT/patches/SA-00:23/ip_options.diff.asc

# cd /usr/src/sys/netinet
# patch -p < /path/to/patch_or_advisory


也可以直接使用如下补丁：

    Index: ip_icmp.c
    ===================================================================
    RCS file: /ncvs/src/sys/netinet/ip_icmp.c,v
    retrieving revision 1.39
    diff -u -r1.39 ip_icmp.c
    --- ip_icmp.c    2000/01/28 06:13:09    1.39
    +++ ip_icmp.c    2000/06/08 15:26:39
    @@ -662,8 +662,11 @@
                     if (opt == IPOPT_NOP)
                         len = 1;
                     else {
    +                    if (cnt < IPOPT_OLEN + sizeof(*cp))
    +                        break;
                         len = cp[IPOPT_OLEN];
    -                    if (len <= 0 || len > cnt)
    +                    if (len < IPOPT_OLEN + sizeof(*cp) ||
    +                        len > cnt)
                             break;
                     }
                     /*
    Index: ip_input.c
    ===================================================================
    RCS file: /ncvs/src/sys/netinet/ip_input.c,v
    retrieving revision 1.130
    diff -u -r1.130 ip_input.c
    --- ip_input.c    2000/02/23 20:11:57    1.130
    +++ ip_input.c    2000/06/08 15:25:46
    @@ -1067,8 +1067,12 @@
             if (opt == IPOPT_NOP)
                 optlen = 1;
             else {
    +            if (cnt < IPOPT_OLEN + sizeof(*cp)) {
    +                code = &cp[IPOPT_OLEN] - (u_char *)ip;
    +                goto bad;
    +            }
                 optlen = cp[IPOPT_OLEN];
    -            if (optlen <= 0 || optlen > cnt) {
    +            if (optlen < IPOPT_OLEN + sizeof(*cp) || optlen > cnt) {
                     code = &cp[IPOPT_OLEN] - (u_char *)ip;
                     goto bad;
                 }
    @@ -1174,6 +1178,10 @@
                 break;

             case IPOPT_RR:
    +            if (optlen < IPOPT_OFFSET + sizeof(*cp)) {
    +                code = &cp[IPOPT_OFFSET] - (u_char *)ip;
    +                goto bad;
    +            }
                 if ((off = cp[IPOPT_OFFSET]) < IPOPT_MINOFF) {
                     code = &cp[IPOPT_OFFSET] - (u_char *)ip;
                     goto bad;
    Index: ip_output.c
    ===================================================================
    RCS file: /ncvs/src/sys/netinet/ip_output.c,v
    retrieving revision 1.99
    diff -u -r1.99 ip_output.c
    --- ip_output.c    2000/03/09 14:57:15    1.99
    +++ ip_output.c    2000/06/08 15:27:08
    @@ -1302,8 +1302,10 @@
             if (opt == IPOPT_NOP)
                 optlen = 1;
             else {
    +            if (cnt < IPOPT_OLEN + sizeof(*cp))
    +                goto bad;
                 optlen = cp[IPOPT_OLEN];
    -            if (optlen <= IPOPT_OLEN || optlen > cnt)
    +            if (optlen < IPOPT_OLEN + sizeof(*cp) || optlen > cnt)
                     goto bad;
             }
             switch (opt) {



浏览次数：9004
严重程度：0（网友投票）