Index: head/share/security/advisories/FreeBSD-EN-17:06.hyperv.asc =================================================================== --- head/share/security/advisories/FreeBSD-EN-17:06.hyperv.asc (revision 50475) +++ head/share/security/advisories/FreeBSD-EN-17:06.hyperv.asc (revision 50476) @@ -1,133 +1,134 @@ -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= FreeBSD-EN-17:06.hyperv Errata Notice The FreeBSD Project Topic: Boot compatibility improvements with Azure VMs Category: core Module: hyperv/storvsc Announced: 2017-07-12 Credits: Microsoft OSTC Affects: FreeBSD 10.3 Corrected: 2016-10-19 08:45:19 UTC (stable/10, 10.3-STABLE) 2017-07-12 08:07:55 UTC (releng/10.3, 10.3-RELEASE-p20) For general information regarding FreeBSD Errata Notices and Security Advisories, including descriptions of the fields above, security branches, and the following sections, please visit . I. Background Hyper-V is a default hypervisor provided on Windows server by Microsoft. -ATA driver is the legacy storage driver for FreeBSD on Hyperv, now they -are replaced by synthetic driver which has better performance. +The ATA driver is the legacy storage driver for FreeBSD on Hyperv; now they +are replaced by a synthetic driver which has better performance. -There are issues when attaching multiple synthetic storage driver for +There are issues when attaching multiple synthetic storage drivers for FreeBSD 10.3 on some of Hyper-V hosts. -CD/DVD cannot be detected in some circumstances which cause provisioning +The CD/DVD cannot be detected in some circumstances which causes provisioning fail on Azure. II. Problem Description The disk INQUIRY response is not complete for FreeBSD 10.3 on some -Hyper-V hosts, which will cause the disks will be detached during boot. +Hyper-V hosts, which will cause the disks to be detached during boot. An interrupt is missing if we allow intr_shuffle_irqs on Hyper-V. III. Impact FreeBSD 10.3 can not be boot properly on a guest system on Hyper-V host. IV. Workaround -No workaround is available. +No workaround is available, however systems not running within Hyper-V or +Azure are unaffected. V. Solution Perform one of the following: 1) Upgrade your system to a supported FreeBSD stable or release / security branch (releng) dated after the correction date. A reboot is required. 2) To update your system via a binary patch: Systems running a RELEASE version of FreeBSD on the i386 or amd64 platforms can be updated via the freebsd-update(8) utility: # freebsd-update fetch # freebsd-update install A reboot is required. 3) To update your system via a source code patch: The following patches have been verified to apply to the applicable FreeBSD release branches. a) Download the relevant patch from the location below, and verify the detached PGP signature using your PGP utility. # fetch https://security.FreeBSD.org/patches/EN-17:06/hyperv.patch # fetch https://security.FreeBSD.org/patches/EN-17:06/hyperv.patch.asc # gpg --verify hyperv.patch.asc b) Apply the patch. Execute the following commands as root: # cd /usr/src # patch < /path/to/patch c) Recompile your kernel as described in and reboot the system. VI. Correction details The following list contains the correction revision numbers for each affected branch. Branch/path Revision - ------------------------------------------------------------------------- stable/10/ r307623 releng/10.3/ r320912 - ------------------------------------------------------------------------- To see which files were modified by a particular revision, run the following command, replacing NNNNNN with the revision number, on a machine with Subversion installed: # svn diff -cNNNNNN --summarize svn://svn.freebsd.org/base Or visit the following URL, replacing NNNNNN with the revision number: VII. References The latest revision of this advisory is available at -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.1.21 (FreeBSD) -iQIzBAEBCgAdFiEEHPf/b631yp++G4yy7Wfs1l3PaucFAlll2psACgkQ7Wfs1l3P -audtKRAA2OiRehFvElfsMARX+nBZazgKUGXfFRmWO8v8MCpI9jQtB9T8HItDWVHh -ZPbgM/AV3osUAmzdZOFwTpHbVbPQ8nO14n5inhC9u0J0wA0c5apfp54F2EXdgm6+ -+ckf+2lkisBI1YVewH8aPRNSIhueRJPEX79g7Z/EqxHJhq1wfGaJ6zDT8royE1F8 -q8uyawClGL1vS7ofW4IPVYQOgebf+s7vSF845JWQcqXeqpPU6Qt1kGP+wkTSx7HE -3tuRowym5EmzweP+U5DqE34Ryli7/jsDr0rgmVkVh5JEQfHznSadAAWsHj9bMimc -4Y2TSYdOhrPKV6Id/el5XWTSetUVPHMmQh6TTIWg10Ygr6CK0folZWnR5t2ym4np -HfzEdaUXJXZyj/5qy1mcFzR8JRifj9lmlRzBqZOOOwMakhSSYD7daouLK76SvH0K -gf4AgG0X6FUETD8N+rM+1RpvSfbeA9zktcPmxE/WCTtc8lIcQc/9CZY7zNOoi+du -LKU1MhWBQTk8zP5AHzAmHL+O+C6sF7uYVaUL6Ui3hqq2AjhnK+sxVX1QNT4kwgJ4 -h3sBliNUQ6kz1e2yTROj2v66OkFKYaSugLwyg15Qa6pfE7R448lCwZOe65rYYTyZ -u4yd5mACaO9mkYmQulxIO/Eit19kGvapBXF4CEHBt+WvqG8Cbdk= -=a6m2 +iQIzBAEBCgAdFiEEHPf/b631yp++G4yy7Wfs1l3PaucFAllmPAEACgkQ7Wfs1l3P +aucYWA/+MnvacneOAPWlxl5EoZClil8fFLfXvnWocUOxrdKEFdCDR4Kro/a4BvUz +gyj6H5sKvM1j3laRZGsUDrK8iQyBwtYSmanCZvRHNau7OHNqy2gbbJaeDN6APy/j +Jyp+GrIQa+o3+m15VuC8gZzbobNkdGwp7IS4gBDRC/u804Rij+DG0RMiUF0uZhxX +n2JPTmsAKUls1o2H+02gLseDaNGMHkFGv9vGp4s9L6RZHLLcSrw9gYwLZYCb0tFE +OyJzpZSSzvXjMprjAD+Ay2CIR2WHSqaxfs2jK4pqwbZnE9mIsW6wm+4FaH+ZLbzO +KeMgP9f6T4WByQQEw66fSYufepC4qVDZnmeRwNph6nvv3bgqlpueceq5M+pZMM7k +UvEH7I2nNfpAvtM5uzFOqyNNMuMwkLcLm10o/3AXumLKAL2Co5xsiViotryhB/mb +XP3l9zvt6uwIlYwOJ0r2i0bbtGrtUZml74iBJU5Wu4ItztWOeCRJCosk+dbc2YZW +uYOGwopo5n0SzypWG3CdZpSlhrvKwJrlEFLK6pHXYzC4gL8Wlqw8b/OMeu/yCvH8 +MLRsitGiRK5sSSAitLjDqfRbxULq0o5F2K/OKRZw3LHL2m0Z+HNI0B68RTfhXp5U +w3QQk20/7A2Au5Tgv9ihmCE7C7TdOYyNaN6n974kZUfaH6ggsmY= +=ycJf -----END PGP SIGNATURE----- Index: head/share/security/advisories/FreeBSD-SA-17:05.heimdal.asc =================================================================== --- head/share/security/advisories/FreeBSD-SA-17:05.heimdal.asc (revision 50475) +++ head/share/security/advisories/FreeBSD-SA-17:05.heimdal.asc (revision 50476) @@ -1,146 +1,145 @@ -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= FreeBSD-SA-17:05.heimdal Security Advisory The FreeBSD Project Topic: heimdal KDC-REP service name validation vulnerability Category: contrib Module: heimdal Announced: 2017-07-12 Affects: All supported versions of FreeBSD. Corrected: 2017-07-12 07:26:07 UTC (stable/11, 11.1-PRERELEASE) 2017-07-12 08:07:16 UTC (releng/11.1, 11.1-RC2-p1) 2017-07-12 08:07:16 UTC (releng/11.1, 11.1-RC1-p1) 2017-07-12 07:26:07 UTC (stable/11, 11.1-BETA3-p1) 2017-07-12 08:07:36 UTC (releng/11.0, 11.0-RELEASE-p11) 2017-07-12 07:26:07 UTC (stable/10, 10.3-STABLE) 2017-07-12 08:07:36 UTC (releng/10.3, 10.3-RELEASE-p20) CVE Name: CVE-2017-11103 For general information regarding FreeBSD Security Advisories, including descriptions of the fields above, security branches, and the following sections, please visit . I. Background Heimdal implements the Kerberos 5 network authentication protocols. -The Kerberos protocol uses "ticket" to authenticate a client to a +The Kerberos protocol uses "tickets" to authenticate a client to a service. A Key Distribution Center (KDC) is trusted by all principals registered in that administrative "realm" to store a secret key in confidence, of which, the proof of knowledge is used to verify the authenticity of a principal. - II. Problem Description -There is a programming error in Heimdal implementation that used an +There is a programming error in the Heimdal implementation that used an unauthenticated, plain-text version of the KDC-REP service name found in a ticket. III. Impact -An attacker who has control to the network between a client and the +An attacker who has control of the network between a client and the service it talks to will be able to impersonate the service, allowing a successful man-in-the-middle (MITM) attack that circumvents the mutual authentication. IV. Workaround No workaround is available, but only Kerberos enabled clients are affected. V. Solution Perform one of the following: 1) Upgrade your vulnerable system to a supported FreeBSD stable or release / security branch (releng) dated after the correction date. A reboot is recommended. 2) To update your vulnerable system via a binary patch: Systems running a RELEASE version of FreeBSD on the i386 or amd64 platforms can be updated via the freebsd-update(8) utility: # freebsd-update fetch # freebsd-update install A reboot is recommended. 3) To update your vulnerable system via a source code patch: The following patches have been verified to apply to the applicable FreeBSD release branches. a) Download the relevant patch from the location below, and verify the detached PGP signature using your PGP utility. # fetch https://security.FreeBSD.org/patches/SA-17:05/heimdal.patch # fetch https://security.FreeBSD.org/patches/SA-17:05/heimdal.patch.asc # gpg --verify heimdal.patch.asc b) Apply the patch. Execute the following commands as root: # cd /usr/src # patch < /path/to/patch c) Recompile the operating system using buildworld and installworld as described in . Restart all daemons that use the library, or reboot the system. VI. Correction details The following list contains the correction revision numbers for each affected branch. Branch/path Revision - ------------------------------------------------------------------------- stable/10/ r320907 releng/10.3/ r320912 stable/11/ r320907 releng/11.0/ r320911 releng/11.1/ r320910 - ------------------------------------------------------------------------- To see which files were modified by a particular revision, run the following command, replacing NNNNNN with the revision number, on a machine with Subversion installed: # svn diff -cNNNNNN --summarize svn://svn.freebsd.org/base Or visit the following URL, replacing NNNNNN with the revision number: VII. References The latest revision of this advisory is available at -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.1.21 (FreeBSD) -iQIzBAEBCgAdFiEEHPf/b631yp++G4yy7Wfs1l3PaucFAlll2poACgkQ7Wfs1l3P -auf+8BAA13v5XSuifFibb4T+UY6tnCJgeRoCKYzwYIgx6glcDZyDUAuK0OtT5Skc -2EK24SUe2371sKYkLJ0pULKU5suRqWmzVKvSXGpexcYj8h+B9VCHuQc6tM87v3nA -/Nct5Svwxf+oBcI2MkVrn80NXsi5AfkBMzbgzXKGp3yGdMgbSpUx1uixN8QNtYSb -9nuZZPlXRa7GJDqLuVZwkZQVq1EXnSWwSNH/Oq8DuW7VrTWGJHflS0i/azxTvT+2 -6zZCtCRkYd/875Bn7COxN5F597xwT76XDz5cQzOBH9hk0p+0hxfjAVSf7m5tbl1A -g3qBvXmAhavLvtJfwVFtkwZeAzkLiU1FlcNdoFTFmBwzUYvob41K+JPud1sEUFmu -4w5PXWPq3CbjvwzabOwFRlaA9XMBv8JSgATET3rk6ECjQ6I9+ptYkAXtpiCFXtxq -09kw5dbsqwJ3RQsw/ZtNdbQhhoEG3rNTOCLkLYM3VPwPaCaDAFXN2OGRf6lE21HX -QZQ57OypjTfd7OaSeM6kVeF/xYxh3AoxPsPdqTxphBOF+Ih0zCwcSVdXumuSqufq -daNo+qLV7/IqvY9p0YmHtLKGhwss8jVQBTObNW8JESxmWrDAwtUke0fxnqK9LKMT -vWbvNsgUaLFNEisMkY25VZCzgUiIDJu5JyhTMQtlqQOSNYB686k= -=enb2 +iQIzBAEBCgAdFiEEHPf/b631yp++G4yy7Wfs1l3PaucFAllmPAAACgkQ7Wfs1l3P +aueW0g//Xty2i00igBtc4QINfGQZKzzcZOUs4tjoK2zmrzJQFaCsZodMO/R+P+U8 +ZGwi3r+sgW9uedUYz7jiWhVaOFOVItEJIshp7hN+ejWB+FWVZn8t+ZUJd3mTLoay +H1H159lwQ+TBOUNm/J+DA8b6qpRxjkk7eYylRVuqw8XxYZALKenMmo02HpwfjSBj +DbIcB0aHVex6nXySIik3bxQYO0IZPHG0KPy65Lm/RM0l/bPhU9lBrHvvXJvDpX8z +4vVJOWDywhyatLdV97X6fiDLB2bvDzZgyM1xgvPOFBRsR0VfUUhf35+FZ33Y5H+B +sf/nduluKOeGP45IJQ63GD034JZvcDD4fWZRZeqNbAeMbp4GhicglGfwSO1A/kfi +cjC8QMpDyPNB9uO6/so4FscCbkUbWZH1FbXzJb7Te1hKKykaR+A/YWNFaU1+rJIC +ZegR5R2bAAN3aA8gEvQgb5GdRAZsuAZ49A9FZBLhBpwqRNtmUC49b+RpCMn38+ck +gQqBQeHdSnl/RqNHTwN4jHUzCnc9Dcfhm8hgoBcAInGX4HG4BGvQMYST4isqZ8va +XQOkvd2OHCteVsJoUaqmGzjmCQHhFLxZ4SIp2OIQpFaZ6xOUG44EJnW79ExqShoo +6TVvnMmvjjRnIzUP56YwSUvcned7oIECrSGfS5/fNJaGhQuVy3c= +=KC+I -----END PGP SIGNATURE-----