-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

=============================================================================
FreeBSD-SA-10:08.bzip2                                      Security Advisory
                                                          The FreeBSD Project

Topic:          Integer overflow in bzip2 decompression

Category:       contrib
Module:         bzip2
Announced:      2010-09-20
Credits:        Mikolaj Izdebski
Affects:        All supported versions of FreeBSD.
Corrected:      2010-09-20 14:58:08 UTC (RELENG_8, 8.1-STABLE)
                2010-09-20 14:58:08 UTC (RELENG_8_1, 8.1-RELEASE-p1)
                2010-09-20 14:58:08 UTC (RELENG_8_0, 8.0-RELEASE-p5)
                2010-09-20 14:58:08 UTC (RELENG_7, 7.3-STABLE)
                2010-09-20 14:58:08 UTC (RELENG_7_3, 7.3-RELEASE-p3)
                2010-09-20 14:58:08 UTC (RELENG_7_1, 7.1-RELEASE-p14)
                2010-09-20 14:58:08 UTC (RELENG_6, 6.4-STABLE)
                2010-09-20 14:58:08 UTC (RELENG_6_4, 6.4-RELEASE-p11)
CVE Name:       CVE-2010-0405

For general information regarding FreeBSD Security Advisories,
including descriptions of the fields above, security branches, and the
following sections, please visit <URL:http://security.FreeBSD.org/>.

I.   Background

The bzip2/bunzip2 utilities and the libbz2 library compress and decompress
files using an algorithm based on the Burrows-Wheeler transform.  They are
generally slower than Lempel-Ziv compressors such as gzip, but usually
provide a greater compression ratio.

II.  Problem Description

When decompressing data, the run-length encoded values are not adequately
sanity-checked, allowing for an integer overflow.

III. Impact

An attacker who can cause maliciously chosen inputs to be decompressed can
cause the decompressor to crash.  It is suspected that such an attacker
can cause arbitrary code to be executed, but this is not known for certain.

Note that some utilities, including the tar archiver and the bspatch
binary patching utility (used in portsnap and freebsd-update) decompress
bzip2-compressed data internally; system administrators should assume that
their systems will at some point decompress bzip2-compressed data even if
they never explicitly invoke the bunzip2 utility.

IV.  Workaround

No workaround is available.

V.   Solution

Perform one of the following:

1) Upgrade your vulnerable system to 6-STABLE, 7-STABLE or 8-STABLE,
or to the RELENG_8_1, RELENG_8_0, RELENG_7_3, RELENG_7_1, or
RELENG_6_4 security branch dated after the correction date.

2) To update your vulnerable system via a source code patch:

The following patches have been verified to apply to FreeBSD 6.4, 7.1,
7.3, 8.0 and 8.1 systems.

a) Download the relevant patch from the location below, and verify the
detached PGP signature using your PGP utility.

# fetch http://security.FreeBSD.org/patches/SA-10:08/bzip2.patch
# fetch http://security.FreeBSD.org/patches/SA-10:08/bzip2.patch.asc

b) Execute the following commands as root:

# cd /usr/src
# patch < /path/to/patch
# cd /usr/src/lib/libbz2
# make obj && make depend && make && make install

NOTE: On the amd64 platform, the above procedure will not update the
lib32 (i386 compatibility) libraries.  On amd64 systems where the i386
compatibility libraries are used, the operating system should instead
be recompiled as described in
<URL:http://www.FreeBSD.org/handbook/makeworld.html>

3) To update your vulnerable system via a binary patch:

Systems running 6.4-RELEASE, 7.1-RELEASE, 7.3-RELEASE, 8.0-RELEASE or
8.1-RELEASE on the i386 or amd64 platforms can be updated via the
freebsd-update(8) utility:

# freebsd-update fetch
# freebsd-update install

VI.  Correction details

The following list contains the revision numbers of each file that was
corrected in FreeBSD.

CVS:

Branch                                                           Revision
  Path
- -------------------------------------------------------------------------
RELENG_6
  src/contrib/bzip2/decompress.c                              1.1.1.3.2.3
RELENG_6_4
  src/UPDATING                                            1.416.2.40.2.15
  src/sys/conf/newvers.sh                                  1.69.2.18.2.17
  src/contrib/bzip2/decompress.c                          1.1.1.3.2.2.2.1
RELENG_7
  src/contrib/bzip2/decompress.c                              1.1.1.4.2.2
RELENG_7_3
  src/UPDATING                                             1.507.2.34.2.5
  src/sys/conf/newvers.sh                                   1.72.2.16.2.7
  src/contrib/bzip2/decompress.c                          1.1.1.4.2.1.6.1
RELENG_7_1
  src/UPDATING                                            1.507.2.13.2.17
  src/sys/conf/newvers.sh                                   1.72.2.9.2.18
  src/contrib/bzip2/decompress.c                          1.1.1.4.2.1.2.1
RELENG_8
  src/contrib/bzip2/decompress.c                              1.1.1.5.2.1
RELENG_8_1
  src/UPDATING                                             1.632.2.14.2.4
  src/sys/conf/newvers.sh                                   1.83.2.10.2.5
  src/contrib/bzip2/decompress.c                              1.1.1.5.6.1
RELENG_8_0
  src/UPDATING                                              1.632.2.7.2.8
  src/sys/conf/newvers.sh                                    1.83.2.6.2.8
  src/contrib/bzip2/decompress.c                              1.1.1.5.4.1
- -------------------------------------------------------------------------

Subversion:

Branch/path                                                      Revision
- -------------------------------------------------------------------------
stable/6/                                                         r212901
releng/6.4/                                                       r212901
stable/7/                                                         r212901
releng/7.3/                                                       r212901
releng/7.1/                                                       r212901
stable/8/                                                         r212901
releng/8.0/                                                       r212901
releng/8.1/                                                       r212901
- -------------------------------------------------------------------------

VII. References

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0405

The latest revision of this advisory is available at
http://security.FreeBSD.org/advisories/FreeBSD-SA-10:08.bzip2.asc
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (FreeBSD)

iEYEARECAAYFAkyXd3QACgkQFdaIBMps37JekgCfcYbIYtG1ZXKsfrFC8RKNl8uV
PhsAniSinLogV/Nfj67AcPnoKoyhrXY2
=Qop+
-----END PGP SIGNATURE-----