Re: ¹ö±× ÆÐÄ¡ ¾î¶»°Ô ÇÏÁÒ?

["ÀÌÀçÈ£" <jbkb@xxxxxxxxxx>]

À¯> 
À¯> ¾î¶² ¹ö±×¿¡ ´ëÇÑ ÆÐÄ¡°¡ À̰ǵ¥..¾î¶»°Ô ÆÐÄ¡ÇÏ´Â °ÅÁÒ?

man patch Çغ¸¼¼¿ä..

À¯> 
À¯> One of the following.
À¯>
    1) Upgrade  your  vulnerable   FreeBSD  system  to    4.1-RELEASE,
À¯>
       4.1-STABLE  or  5.0-CURRENT  after  the  respective  correction
À¯>
       dates.   FreeBSD  3.5-STABLE  has  not  yet  been  fixed due to
À¯>
       logistical difficulties  (and the  patch below  does not  apply
À¯>
       cleanly).   Consider  upgrading  to  4.1-RELEASE  if  this is a
À¯>
       concern -  this advisory  will be  reissued once  the patch has
À¯>
       been applied to the 3.x branch.
À¯>
    2) Apply the patch below and recompile your kernel.
À¯>
       Either save this advisory to a file, or download the patch.
À¯>
        ftp://ftp.freebsd.org/pub/FreeBSD/CERT/patches/SA-00:41/elf.patch
À¯>
       # cd /usr/src/sys/kern
À¯>
       # patch -p < /path/to/patch_or_advisory
À¯>
       [ Recompile your kernel and reboot the system ]
À¯>
    --- imgact_elf.c 2000/04/30 18:51:39 1.75
À¯>
    +++ imgact_elf.c 2000/07/23 22:19:49 1.78
À¯>
    @@ -190,6 +190,21 @@
À¯>
    object = vp->v_object;
À¯>
    error = 0;
À¯>
   
À¯>
    + /*
À¯>
    + * It's necessary to fail if the filsz + offset taken from the
À¯>
    + * header is greater than the actual file pager object's size.
À¯>
    + * If we were to allow this, then the vm_map_find() below would
À¯>
    + * walk right off the end of the file object and into the ether.
À¯>
    + *
À¯>
    + * While I'm here, might as well check for something else that
À¯>
    + * is invalid: filsz cannot be greater than memsz.
À¯>
    + */
À¯>
    + if ((off_t)filsz + offset > object->un_pager.vnp.vnp_size ||
À¯>
    +     filsz > memsz) {
À¯>
    + uprintf("elf_load_section: truncated ELF file\n");
À¯>
    + return (ENOEXEC);
À¯>
    + }
À¯>
    +
À¯>
    map_addr = trunc_page((vm_offset_t)vmaddr);
À¯>
    file_addr = trunc_page(offset);
À¯>
   
À¯>
    @@ -341,6 +356,12 @@
À¯>
    }
À¯>
   
À¯>
    error = exec_map_first_page(imgp);
À¯>
    + /*
À¯>
    + * Also make certain that the interpreter stays the same, so set
À¯>
    + * its VTEXT flag, too.
À¯>
    + */
À¯>
    + if (error == 0)
À¯>
    + nd.ni_vp->v_flag |= VTEXT;
À¯>
    VOP_UNLOCK(nd.ni_vp, 0, p);
À¯>
    if (error)
À¯>
                     goto fail;
À¯>
    @@ -449,6 +470,17 @@
À¯>
    /*
À¯>
     * From this point on, we may have resources that need to be freed.
À¯>
     */
À¯>
    +
À¯>
    + /*
À¯>
    + * Yeah, I'm paranoid.  There is every reason in the world to get
À¯>
    + * VTEXT now since from here on out, there are places we can have
À¯>
    + * a context switch.  Better safe than sorry; I really don't want
À¯>
    + * the file to change while it's being loaded.
À¯>
    + */
    + simple_lock(&imgp->vp->v_interlock);
    + imgp->vp->v_flag |= VTEXT;
    + simple_unlock(&imgp->vp->v_interlock);
    +
    if ((error = exec_extract_strings(imgp)) != 0)
    goto fail;
   
    @@ -610,9 +642,6 @@
    imgp->auxargs = elf_auxargs;
    imgp->interpreted = 0;
   
    - /* don't allow modifying the file while we run it */
    - imgp->vp->v_flag |= VTEXT;
    -
     fail:
    return error;
     }


-- 
ÀÌÀçÈ£