Re: name:wrek vulnerabilities ?

Shawn Webb <[email protected]> Wed, 14 Apr 2021 12:20:58 -0400

Newsgroups	gmane.os.freebsd.security.general
Message-ID	<20210414162058.mrhv7cnyxrad5n7e@mutt-hbsd>

On Wed, Apr 14, 2021 at 11:44:06AM -0400, mike tancsa wrote:
> I heard about this on the ISC stormcast podcast this AM, but I cant
> quite make heads or tails of if/when what was patched with respect to
> FreeBSD.
> 
> https://www.forescout.com/company/blog/forescout-and-jsof-disclose-new-dns-vulnerabilities-impacting-millions-of-enterprise-and-consumer-devices/
> 
> They have a dhclient one I think is
> https://www.freebsd.org/security/advisories/FreeBSD-SA-20:26.dhclient.asc,
> but the report somewhat ambiguously writes there is a new one ?
> 
> "Table 3 – New vulnerabilities in NAME:WRECK. Rows are colored according
> to the CVSS score: yellow for medium or high and red for critical." Yet
> the CVE ref is the above SA 20:26?! So this is new or this is just a
> paper talking about a bug patched last August ?

The paper's referencing a bug that's already fixed in all supported
versions of FreeBSD. A lot of hand waving just for "nothing to see
here, move along" if your systems are up-to-date.

The commit that fixed the vulnerability is
8f594d4355a16f963e246be0b88b9fba8ad77049, made on 31 Aug 2020. That's
over a half a year ago.

Thanks,

-- 
Shawn Webb
Cofounder / Security Engineer
HardenedBSD

https://git.hardenedbsd.org/hardenedbsd/pubkeys/-/raw/master/Shawn_Webb/03A4CBEBB82EA5A67D9F3853FF2E67A277F8E1FA.pub.asc

signature.asc (application/pgp-signature, 833 B)