Security Advisory

FreeBSD 今天发布了 2009 年第 6 号安全公告 FreeBSD-SA-09:06.ktimer。这个安全公告适用于 7.0-RELEASE 以上到修正日期之前的所有 FreeBSD 版本。

由于这个安全公告修正的是一个零时差 (0-day，也就是发现者直接对问题进行了全面披露，而不是等待供应商修正之后再发布漏洞细节) 披露的漏洞，因此，适当地评估其风险并采取措施就非常重要。安全公告中提到，这是一个"Local privilege escalation"（本地特权提升问题），这种问题属于一类非常常见的（特别是 Linux 内核）、严重的安全漏洞，具体来说，通过一定的方法，登录在系统上的用户可以提升其权限，并实施进一步的攻击。

关于这类漏洞的一个常见的误解是，“本地"漏洞通常是没什么大碍的。然而，那种无关大碍的一类"本地"漏洞，指的是只能在本地控制台触发的问题。例如，如果手中有一张包含了某些工具的Windows PE光盘，用它启动系统便可以得到本地的管理员权限—-这是一个安全问题，但是并不严重，因为事实上如果别人能够接触本地系统，那么他就可以做任何事情。

而 FreeBSD-SA-09:06 指出的问题则不是这类问题。在其上下文中，“本地"是指能够登入系统的任何用户，以及能够以本地用户身份运行的服务进程。对于 Web 服务器而言，这是一个非常严重的安全威胁—-例如，如果在设计时因为疏忽而没有考虑上传文件是否有可能由于某种条件被执行，那么，之前这可能只是一个简单的 DoS 问题（例如，用户可以上传一个不停 fork() 的程序，将 www 用户的进程配额耗尽而导致新的服务请求无法被及时响应），而有了这个漏洞，这些问题便成了远程特权提升问题，其危害也就非常严重了。

受影响的版本：FreeBSD 6.0-RELEASE, FreeBSD 5.4-STABLE, FreeBSD 6.0-STABLE, FreeBSD 7.0-CURRENT
问题描述：已经确认，在内核中存在一处程序设计缺陷，这一缺陷会导致内核中的某个不确定位置的内存被返回给用户态应用程序。

Today, Colin has committed three security fixes that addresses three medium-risk security issues in FreeBSD kernel. That results in p11, p12 and p13 of FreeBSD 5.3-RELEASE, and has been committed to RELENG_5_4 as well so we will get that in the final release build.

Ken Smith has announced the tagging (with a mini heads-up in developers@), and then committed the naming (5.4-RELEASE) to the RELENG_5_4 tree. After that, RELENG_5_4 was tagged as RELENG_5_4_0_RELEASE, which is the last step of the release engineering that is related to the src/tree.

Please note that, this is not the final step of the final release. FreeBSD is very careful about the quality (not only as opposed to the kernel with colorful history of its security record, which is released under GPL and often release from time to time, haha, you know which is that) of a release, therefore, tagging does not mean that “we made it”, that is just a stage. Please be patient to wait for the PGP signed 5.4-RELEASE announcement BEFORE you download isos, even they were found on any sites.

This is the 6th security advisory of FreeBSD for the year 2004. The problem is with FreeBSD’s IPv6 implementation, which in turn does not affect our systems at all, because all servers I maintain has disabled IPv6 completely, since there’s no IPv6 devices available at Beijing University of Technology’s public network.