From owner-doc-jp@jp.freebsd.org  Wed May 10 14:05:20 2000
Received: (from daemon@localhost)
	by castle.jp.freebsd.org (8.9.3+3.2W/8.7.3) id OAA25760;
	Wed, 10 May 2000 14:05:20 +0900 (JST)
	(envelope-from owner-doc-jp@jp.FreeBSD.org)
Received: from TYO202.gate.nec.co.jp (TYO202.gate.nec.co.jp [202.247.6.41])
	by castle.jp.freebsd.org (8.9.3+3.2W/8.7.3) with ESMTP id OAA25755
	for <doc-jp@jp.freebsd.org>; Wed, 10 May 2000 14:05:19 +0900 (JST)
	(envelope-from y-koga@jp.FreeBSD.org)
Received: from mailsv4.nec.co.jp (mailsv4-le1 [192.168.1.93])
	by TYO202.gate.nec.co.jp (8.9.3/3.7W00051012) with ESMTP id OAA04339
	for <doc-jp@jp.freebsd.org>; Wed, 10 May 2000 14:05:19 +0900 (JST)
Received: from mmssv.mms.mt.nec.co.jp (mmssv.mms.mt.nec.co.jp [133.201.63.216]) by mailsv4.nec.co.jp (8.9.3/3.7W-MAILSV4-NEC) with ESMTP
	id OAA20156 for <doc-jp@jp.freebsd.org>; Wed, 10 May 2000 14:05:18 +0900 (JST)
Received: from koga.do.mms.mt.nec.co.jp (koga.do.mms.mt.nec.co.jp [10.16.5.16]) by mmssv.mms.mt.nec.co.jp (8.8.4+2.7Wbeta4/3.4W3MMS96052011) with ESMTP id OAA11982 for <doc-jp@jp.freebsd.org>; Wed, 10 May 2000 14:00:49 +0900 (JST)
Received: from localhost (localhost [127.0.0.1])
	by koga.do.mms.mt.nec.co.jp (8.10.1/3.7W-kai) with ESMTP id e4A55HY08640;
	Wed, 10 May 2000 14:05:17 +0900 (JST)
Message-Id: <200005100505.e4A55HY08640@koga.do.mms.mt.nec.co.jp>
To: doc-jp@jp.freebsd.org
In-Reply-To: <3918B510118.6CD8YUHARA@po.cnet-sb.ne.jp>
References: <3918B510118.6CD8YUHARA@po.cnet-sb.ne.jp>
X-Mailer: Mew version 1.94.2 on Emacs 19.34 / Mule 2.3 (SUETSUMUHANA)
Mime-Version: 1.0
Content-Type: Text/Plain; charset=iso-2022-jp
Content-Transfer-Encoding: 7bit
Date: Wed, 10 May 2000 14:05:15 +0900 (JST)
From: Koga Youichirou <y-koga@jp.freebsd.org>
X-Dispatcher: imput version 20000228(IM140)
Lines: 76
Reply-To: doc-jp@jp.freebsd.org
Precedence: list
X-Distribute: distribute version 2.1 (Alpha) patchlevel 24e+000315
X-Sequence: doc-jp 7357
Subject: [doc-jp 7357] Re: ANNOUNCE: FreeBSD Security Advisory:
 FreeBSD-SA-00:18.gnapster
Errors-To: owner-doc-jp@jp.freebsd.org
Sender: owner-doc-jp@jp.freebsd.org
X-Originator: y-koga@jp.freebsd.org

shinichi yuhara <yuhara@po.cnet-sb.ne.jp>:
> $B<h$j$"$($:(B,$B<+J,$N?H6a$J$3$H$@$C$?$N$G2a5n$NK]Lu$r;2>H$7$J$,(B
> $B$i4JC1$KLu$7$F$_$^$7$?(B.

$B$Q$A$Q$A$Q$A!y(B

> =============================================================================
> FreeBSD-SA-00:18                                           Security Advisory
>                                                                 FreeBSD, Inc.
$B!D(B $B$5$/$C$HN,(B $B!D(B
> $B2~D{<T(B:          $B@):n85$K$h$k=$@5(B
> $B@):n85$N>uBV(B:    $B=$@5$5$l$?%P!<%8%g%s$,4{$K%j%j!<%9(B

$B@=:n$G$9$h$M!#$G$b!"(Bvender $B$K$O@=:n<T$N0UL#$O$J$$$N$G!"!V%Y%s%@!W$N(B
$B$^$^$NJ}$,$$$$$H;W$&!#(B

$B!V=$@5$5$l$?%P!<%8%g%s$,4{$K%j%j!<%9$5$l$F$$$k!W(B

> $B1F6AHO0O(B:        $B=$@5F|0JA0$N(BPorts collection.

s/\.$//

> II.  $BLdBj$N>\:Y(B - Problem Description
> 
> The gnapster port (version 1.3.8 and earlier) contains a vulnerability
> which allows remote gnapster users to view any file on the local
> system which is accessible to the user running gnapster.
> gnapster$B$N(B1.3.8$B0JA0$N%W%m%0%i%`$G$O(Bgnapster$B#w5/F0$7$F$$$k%f!<(B
> $B%6$N%m!<%+%k$KCV$$$F$"$kA4$F$N%U%!%$%k$r%M%C%H%o!<%/1[$7$N(B
> gnapster$B%f!<%6$,FI$a$F$7$^$&$H8@$&4m81@-$,$"$j$^$9(B. 

The gnapster port $B$C$F(B FreeBSD $B$N(B ports $B%3%l%/%7%g%s$N0l$D$r;X$7$F$$$k(B
$B$s$@$H;W$$$^$9$,!"!V%W%m%0%i%`!W$H$9$k$H!"$=$N$3$H$,8+$($^$;$s!#(B

vulnerability $B$O!V<eE@!W!V7g4Y!W$+!"0ULu$7$F!VLdBj!W$G$7$g$&!#(B

remote $B$O!V%j%b!<%H$N!W$G$$$$$H;W$$$^$9!#$G$J$$$H!"(Blocal $B$NLu=P$G:$$j(B
$B$^$9!#(B

accessible $B$,Lu$5$l$F$$$^$;$s!#(B

$B!V#w5/F0!W"*!V$r5/F0!W$+$J(B :)

$B!V8@$&!W"*!V$$$&!W(B

> Gnapster does
> not run with elevated privileges, so it is only the user's regular
> filesystem access permissions which are involved.
> gnapster$B$OFC8"$rM?$($i$l$F<B9T$5$l$F$$$k$o$1$G$O$J$$$N$G(B,$B$=(B
> $B$NHO0O$O$O<B9T%f!<%6$,%"%/%;%9$r5vMF$5$l$F$$$k$@$1$G$G$9(B.

s/$B$O$O(B/$B$O(B/
regular filesystem $B$,>C$($F$$$^$9!#(B

> III. $B1F6AHO0O(B - Impact
> 
> Remote users can view files accessible to the user running the
> gnapster client.
> $B%j%b!<%H%f!<%6$,(Bgnapster$B%/%i%$%(%s%H$r5/F0$7$F$$$k%f!<%6$N%U%!(B
> $B%$%k$r8+$k$3$H$,=PMh$^$9(B.

$B!V%/%i%$%(%s%H!W"*!V%/%i%$%"%s%H!W(B
$B!V=PMh$^$9!W"*!V$G$-$^$9!W(B

$B$3$l$O86J8$,0-$$$s$@$1$I!"$3$N$^$^$@$H2?$@$+$h$/J,$+$i$J$$$G$9$h$M!#(B
Napster $B$N;EAH$_$,J,$+$i$J$$$N$G30$7$F$$$k$+$b$7$l$^$;$s$,!"B?J,!"(B
gnapster $B$N%/%i%$%"%s%H$r;H$C$F$$$k$H!"(Bgnapster $B$r<B9T$7$F$$$k%[%9%H>e(B
$B$N%U%!%$%k$,%j%b!<%H$+$i;2>H2DG=$K$J$C$F$7$^$&$N$,LdBj$J$s$G$9$h$M!#(B

> 3) download a new port skeleton for the gnapster port from:
> 3) $B0J2<$N>l=j$+$i(B mtr $B$N(B $B?7$7$$(B port $B%9%1%k%H%s$r%@%&%s%m!<%I$7(B, 
>    $B$=$l$rMxMQ$7$F(B mtr $B$N(B port $B$r:F%3%s%Q%$%k$9$k(B.  

mtr $B$8$c$J$$$G$9(B ;)
----
$B$3$,$h$&$$$A$m$&(B
