BSD exec() Race Condition Vulnerability

BSD exec() Race Condition Vulnerability

Solution:
NetBSD has released patches. It is believed that other BSD operating systems may be vulnerable, however this has not been confirmed. There are no patches for these systems yet. This record will be updated if and when they become available.

It is believed that version 1.3 is vulnerable, however it is not confirmed. Users of those kernel versions are advised to upgrade to the latest version.

NetBSD 1.4.x and 1.5.x users can patch their kernel via CVS or apply the patches listed below:

FreeBSD has released patches.

A patch is available for OpenBSD 3.0 (older versions may still be vulnerable, systems must be upgraded to 3.0 before the patch can be applied).

OpenBSD OpenBSD 3.0

OpenBSD 012_ptrace.patch
ftp://ftp.openbsd.org/pub/OpenBSD/patches/3.0/common/012_ptrace.patch

NetBSD NetBSD 1.4

NetBSD SA2002-001-ptrace-1.4.patch
To apply this patch (as root, in the kernel src directory):# patch < /path/to/SA2002-001-ptrace-1.4.patchA new kernel must then be built/installed and the system must be rebooted.http://www.netbsd.org/Documentation/kernel/#how_to_build_a_kernel
ftp://ftp.netbsd.org/pub/NetBSD/security/patches/SA2002-001-ptrace-1.4 .patch

NetBSD NetBSD 1.4.1

NetBSD SA2002-001-ptrace-1.4.patch
To apply this patch (as root, in the kernel src directory):# patch < /path/to/SA2002-001-ptrace-1.4.patchA new kernel must then be built/installed and the system must be rebooted.http://www.netbsd.org/Documentation/kernel/#how_to_build_a_kernel
ftp://ftp.netbsd.org/pub/NetBSD/security/patches/SA2002-001-ptrace-1.4 .patch

NetBSD NetBSD 1.4.2

NetBSD SA2002-001-ptrace-1.4.patch
To apply this patch (as root, in the kernel src directory):# patch < /path/to/SA2002-001-ptrace-1.4.patchA new kernel must then be built/installed and the system must be rebooted.http://www.netbsd.org/Documentation/kernel/#how_to_build_a_kernel
ftp://ftp.netbsd.org/pub/NetBSD/security/patches/SA2002-001-ptrace-1.4 .patch

NetBSD NetBSD 1.4.3

NetBSD SA2002-001-ptrace-1.4.patch
To apply this patch (as root, in the kernel src directory):# patch < /path/to/SA2002-001-ptrace-1.4.patchA new kernel must then be built/installed and the system must be rebooted.http://www.netbsd.org/Documentation/kernel/#how_to_build_a_kernel
ftp://ftp.netbsd.org/pub/NetBSD/security/patches/SA2002-001-ptrace-1.4 .patch

NetBSD NetBSD 1.5

NetBSD SA2002-001-ptrace-1.5.patch
To apply this patch (as root, in the kernel src directory):# patch < /path/to/SA2002-001-ptrace-1.5.patchA new kernel must then be built/installed and the system must be rebooted.http://www.netbsd.org/Documentation/kernel/#how_to_build_a_kernel
ftp://ftp.netbsd.org/pub/NetBSD/security/patches/SA2002-001-ptrace-1.5 .patch

NetBSD NetBSD 1.5.1

NetBSD SA2002-001-ptrace-1.5.patch
To apply this patch (as root, in the kernel src directory):# patch < /path/to/SA2002-001-ptrace-1.5.patchA new kernel must then be built/installed and the system must be rebooted.http://www.netbsd.org/Documentation/kernel/#how_to_build_a_kernel
ftp://ftp.netbsd.org/pub/NetBSD/security/patches/SA2002-001-ptrace-1.5 .patch

NetBSD NetBSD 1.5.2

NetBSD SA2002-001-ptrace-1.5.patch
To apply this patch (as root, in the kernel src directory):# patch < /path/to/SA2002-001-ptrace-1.5.patchA new kernel must then be built/installed and the system must be rebooted.http://www.netbsd.org/Documentation/kernel/#how_to_build_a_kernel
ftp://ftp.netbsd.org/pub/NetBSD/security/patches/SA2002-001-ptrace-1.5 .patch

FreeBSD FreeBSD 4.3 -RELEASE

FreeBSD exec-43R.patch
FreeBSD 4.3-RELEASE only.
ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-02:08/exec-43R.patch

FreeBSD FreeBSD 4.3 -RELENG

FreeBSD exec.patch
For FreeBSD 4.4-STABLE, or RELENG_4_3 and RELENG_4_4 security branches.
ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-02:08/exec.patch

FreeBSD FreeBSD 4.4

FreeBSD exec.patch
For FreeBSD 4.4-STABLE, or RELENG_4_3 and RELENG_4_4 security branches.
ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-02:08/exec.patch

FreeBSD FreeBSD 4.4 -STABLE

FreeBSD exec.patch
For FreeBSD 4.4-STABLE, or RELENG_4_3 and RELENG_4_4 security branches.
ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-02:08/exec.patch

FreeBSD FreeBSD 4.4 -RELENG

FreeBSD exec.patch
For FreeBSD 4.4-STABLE, or RELENG_4_3 and RELENG_4_4 security branches.
ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-02:08/exec.patch