From owner-ports-jp@jp.freebsd.org  Tue Mar 21 17:57:52 2000
Received: (from daemon@localhost)
	by castle.jp.freebsd.org (8.9.3+3.2W/8.7.3) id RAA98244;
	Tue, 21 Mar 2000 17:57:52 +0900 (JST)
	(envelope-from owner-ports-jp@jp.FreeBSD.org)
Received: from rins.st.ryukoku.ac.jp (rins.st.ryukoku.ac.jp [133.83.4.1])
	by castle.jp.freebsd.org (8.9.3+3.2W/8.7.3) with ESMTP id RAA98239
	for <ports-jp@jp.freebsd.org>; Tue, 21 Mar 2000 17:57:51 +0900 (JST)
	(envelope-from kjm@ideon.st.ryukoku.ac.jp)
Received: from ideon.st.ryukoku.ac.jp (ideon.st.ryukoku.ac.jp [133.83.36.5])
	by rins.st.ryukoku.ac.jp (8.9.3+3.2W/3.7W/RINS-1.9.6-NOSPAM) with ESMTP id RAA11708
	for <ports-jp@jp.freebsd.org>; Tue, 21 Mar 2000 17:57:50 +0900 (JST)
Received: from ideon.st.ryukoku.ac.jp (kjm@localhost [127.0.0.1])
	by ideon.st.ryukoku.ac.jp (8.9.3/3.7W/kjm-19990628) with ESMTP id RAA53395
	for <ports-jp@jp.freebsd.org>; Tue, 21 Mar 2000 17:57:50 +0900 (JST)
From: kjm@rins.ryukoku.ac.jp (KOJIMA Hajime /
    =?ISO-2022-JP?B?GyRCPi5FZ0glGyhC?=)
To: ports-jp@jp.freebsd.org
In-reply-to: Your message of "Tue, 21 Mar 2000 15:07:56 JST."
	<20000321150756.I27881@amalthea.phys.s.u-tokyo.ac.jp>
Mime-Version: 1.0
Content-Type: text/plain; charset=iso-2022-jp
Date: Tue, 21 Mar 2000 17:57:50 +0900
Message-ID: <53391.953629070@ideon.st.ryukoku.ac.jp>
Reply-To: ports-jp@jp.freebsd.org
Precedence: list
X-Distribute: distribute version 2.1 (Alpha) patchlevel 24e+000315
X-Sequence: ports-jp 9142
Subject: [ports-jp 9142] Re: delegate
Errors-To: owner-ports-jp@jp.freebsd.org
Sender: owner-ports-jp@jp.freebsd.org
X-Originator: kjm@ideon.st.ryukoku.ac.jp

<20000321150756.I27881@amalthea.phys.s.u-tokyo.ac.jp>$B$K$*$$$F(B
Kawaguti Ginga $B$5$s$,$*$C$7$c$k$K$O(B:
| > Security Advisory $B$NI.<T$,<!$N$h$&$J5-=R$r$7$F$$$k$N$b!"FCDj$NLd(B
| > $BBjE@$K$D$$$F$G$O$J$/!"$3$&$7$?%=!<%9%3!<%I$NJ70O5$$rSL$.$H$C$?$+(B
| > $B$i$G$O$J$$$+$H;W$($?$N$G$9$,!"$=$&$8$c$"$J$$$s$G$7$g$&$+!#(B
| 
| Security Advisory $B$,$b$H$K$7$F$$$k(B debian $B$+$I$C$+$N(B
| $BJs9p$,$=$&=q$+$l$F$$$k$N$G$"$C$F!"(BFreeBSD $B$N(B SA $B$J?M$O(B
| $B$=$l$r1-F]$_$K$7$F$$$k$@$1$8$c$J$$$+!"$H$$$&OC$@$C$?$h$&$J(B...
| ($B$3$N$X$s>.Eg$5$sB>$NJ}$,$:$C$H>\$7$$$H;W$&$N$G(B
|  $B;d$+$i$O$3$N$X$s$G4*J[$7$F$/$@$5$$(B; $B$G$-$l$P;XE&$7$F$/$@$5$$(B:-)
 
  FreeBSD security officer $B$J?M(B ($BC#(B?) $B$O!"(Bdelegate ports Makefile log
  $B$rFI$`8B$j(B

* $BEv=i;XE&$5$l$?LdBj$O$9$G$K(B fix $B$5$l$F$$$k(B
* $B3^86$5$s$HF1MM$N4QE@$GLdBj$,;D$C$F$$$k(B

  $B$H$$$&G'<1$r$5$l$F$$$k$HM}2r$7$F$$$^$9!#(B
  
<http://www.jp.freebsd.org/cgi/cvsweb.cgi/ports/net/delegate/Makefile>
  
  $B$=$N0lJ}!"(Bdelegate $B:n<T$N:4F#$5$s$O(B 

* $B=i4|2=%U%'!<%:$G(B buffer overflow $B$9$k$N$rKI$0$N$O4IM}<T$N@UG$$@!#$^(B
  $B$?=EMW$JItJ,$O(B delegate 6 $B$GD>$9(B

<http://www.delegate.org/delegate/ml/archive/087/20>

* $BEvLL$N(B security $BBP:v$O!"L$CN$N(B buffer overflow bug $BBP:v$b4^$a(B
  delegate 6 $B$KF~$l$?(B

<http://www.delegate.org/delegate/Manual.htm#defense>
<http://www.delegate.org/delegate/ml/archive/088/18>
<http://www.delegate.org/delegate/updates/>

  $B$H<gD%$5$l$F$$$k$HM}2r$7$F$$$^$9!#$3$N$"$?$j$O<g5A$N0c$$$b$"$k$h$&$K(B
  $B;W$($k$N$G$I$&$3$&8@$*$&$H$O;W$$$^$;$s$,!"(B
 
| > $B$H$O$$$(!"(BSecurity Advisory $B=q$$$F@$3&Cf$K%"%J%&%s%9$9$k$+$i$K$O!"(B
| > $B!VIT0B$@$+$i!W$8$c$J$/$F$A$c$s$H8!>Z$7$J$$$H$$$1$J$$$H$O;W$$$^$9(B
| > $B$1$I!#(B
| 
| $B$"$H!"$3$N$h$&$J$b$N$rL@8@$9$k$N$J$i:n<TB&$K$OJs9p$7$FM_$7$$!"(B
| $B$H$$$&$3$H$b$"$k$_$?$$$G$9(B(FreeBSD $B%7%9%F%`E*$K$O(B
| port maintainer $B$K$OO"Mm$,9T$/$N$G$7$g$&$+(B?)$B!#(B

  FreeBSD SA $B$H$$$&(B official $B$JJ8=q$G(B
 
---- from FreeBSD-SA-00:04.delegate:
> Unfortunately no simple fix is available - the problems with the
> delegate software are too endemic to be fixed by a simple patch. It is
> hoped the software authors will take security to heart and correct the
> security problems in a future version, although user caution is
> advised given the current state of the code.
 
  $B$H$$$&8@$$J}$r$9$k$N$G$"$l$P!"$;$a$F$=$N(B software author $B$K0l8@$"$C(B
  $B$F$b$$$$$s$8$c$J$$$+$H;W$$$^$9!#(B

  BUGTRAQ $B$G$N(B buffer overflow $B;XE&$K$D$$$F$O!"(BBUGTRAQ $B%b%G%l!<%?$+$i(B
  $B:4F#$5$s$KO"Mm$,F~$C$F$*$j!"$=$l$K4p$E$$$F(B delegate $B$O$9$P$d$/BP=h$5(B
  $B$l$^$7$?!#$H$3$m$,!"$=$l$+$i(B 3 $B$+7n0J>e7P2a$7$F$+$i!"$7$+$b(B author
  $B$X$NO"Mm(B/$BLd$$9g$o$;$b$J$/$3$&$$$&J8=q$,=P$F$$$k$o$1$G$9!#(B
 
  delegate ports $B$N(B Makefile log $B$K$OB8:_$9$k!V:G?7$N%=!<%9$G$OEv=i;X(B
  $BE&$5$l$F$$$k(B buffer overflow $B$O(B fix $B$5$l$F$$$k$h$&$@$,!D!D!W$H$$$&It(B
  $BJ,$,(B SA $B$+$i$OH4$1Mn$A$F!V(BUnfortunately no simple fix is available$B!W(B
  $B$@$1$K$J$C$F$$$k$3$H$b:.Mp$KGo<V$r$+$1$F$$$k$H;W$$$^$9!#(B
 
---- from FreeBSD-SA-00:04.delegate:
> Depending on your local setup and your security threat model, using a
> firewall/packet filter such as ipfw(8) or ipf(8) to prevent remote
> users from connecting to the delegate port(s) may be enough to meet
> your security needs. Note that this will not prevent legitimate proxy
> users from attacking the delegate server, although this may not be an
> issue if they have a shell account on the machine anyway.

  $B$H$$$&$N$b(B delegate $B$G$O(B RELIABLE= $B%Q%i%a!<%?$G$G$-$k$o$1$G$9$7!#(B
  $B$;$a$F(B author $B$K0l8@$"$l$P!"(BSA $B$O$b$&$9$3$70c$C$?FbMF$GH/9T$5$l$?$N(B
  $B$G$O$H;W$$$^$9!#(B

| In Tue, Mar 21, 2000 at 01:49:40PM +0900,
| KOJIMA Hajime / $B>.EgH%(B <kjm@rins.ryukoku.ac.jp> wrote:
| > | (0777 => 0775 $B$NN`$OJ,$+$k$1$I!"5U$K%*%j%8%J%k$N(B delegate $B$,(B
| > |  $B$"$($F(B 0777 $B$K@_Dj$7$F$$$kM}M3$rCN$i$J$$(B($B$H$$$&$+!"(B
| > |   $B$-$C$+$1$N?4Ev$?$j$O$J$$$G$b$J$$$h$&$J5$$O$9$k$N$@$1$I(B...)
| > 
| >   delegate 5.x $B$N>l9g!"!V$"$k>u67!W$K$*$1$kF0:n$K$*$$$F(B 777 $B$K$J$C$F$$(B
| >   $B$kI,MW$,$"$k$h$&$G$9!#(B
| > 
| > ; $B$=$N!V$"$k>u67!W$r$-$A$s$HM}2r$G$-$F$$$J$$$N$@$1$I(B X-<
| 
| $B$?$V$s!";d$,(B solaris 2.5 $B$G(B root $B$G5/F0(B($B$G$=$N$H$-$K(B /tmp $B$K7!$k(B)$B$7$?$"$H(B
| nobody(?)$B$K$J$C$F(B TMPDIR $B$+$J$K$+$,FI$_=q$-$G$-$J$$!A(B
| $B$H$$$&$h$&$JLdBj$,$"$C$F$D$+$($J$$(B...$B$HA{$$$G(B
| $B:4F#$5$s$KAjCL$K$N$C$FD:$$$?$h$&$J5$$,$9$k$N$G(B
| $B$=$&$$$&OC$+$b$7$l$^$;$s!#(B

  $B$J$k$[$I$G$9!#(B

| ($B7k6ILLE]$J$N$G(B solaris $B<N$F<N$F$7$F(B(2.6 $B$OLdBj$J$$$i$7$$$N$G$9$,(B)
|  FreeBSD $B$G;H$C$F$$$k$N$G$d$C$Q$jNI$/J,$+$j$^$;$s(B...)
 
  Solaris 2.5x $B$C$F$J$s$+JQ$G$9$h$M!D!D!#(B
 
| >   delegate 6.x $B$K$*$$$F$O(B umask $B$r$A$c$s$H8+$^$9$7(B UMASK= $B$G;XDj$b$G$-(B
| >   $B$^$9$N$G!"(Bpatch-ab $B$OITMW$+$H!#(Bfiles/delegated.sh $B$G(B
| 
| $B$s(B? $B$"!"%5%s%W%k$rJ|$j9~$`$h$&$K$J$C$F$$$k$N$G$9$M!#(B
| $B3NG'$7$F$$$^$;$s$G$7$?!#$9$_$^$;$s!#(B
| $B$3$l$O$;$a$F(B delegated.sh.sample $B$K$7$F$*$/$Y$-$G$7$g$&$M!#(B

  $B$"$C!"(B/usr/local/etc/rc.d/ $B$KF~$k$b$N$C$F!"3HD%;R$,(B .sh $B$G$J$1$l$PF0(B
  $B$+$J$$$N$G$9$M!#$O$8$a$F5$$,$D$-$^$7$?(B ($BCY$9$.(B > $B26(B)$B!#(B

| (delegate $B$[$I$N(B"$BHFMQ$J$s$G$b$"$j(Bproxy" $B$,(B
| $B%Q%C%1!<%8$r%$%s%9%H!<%k$7$?$@$1$G7h$a$&$A$J@_Dj$G(B
| $B$"$,$k$H$$$&$N$,$9$G$K8D?ME*$K$O5$;}0-$$(B)
 
  $B%$%s%9%H!<%k8e!V%a!<%k%"%I%l%9(B xxx $B$r@_Dj$7$F$M!W$N$h$&$J%a%C%;!<%8(B
  $B$,$"$l$P$$$$$N$+$7$i!#(B
 
| >   delegated.sh $B<+BN$r$d$a$A$c$C$F$b$$$$$h$&$J5$$,$7$^$9!#%$%s%9%H!<%k(B
| >   $B$7$?$@$1$G>e$,$C$A$c$&$3$H<+BN$,4m81$H$$$&9M$(J}$b$"$j$^$9$+$i!#(B
| > 
| >   $BA4It%3%a%s%H$K$J$C$F$k(B delegated.sh $B$r%$%s%9%H!<%k$9$k$N$,?F@Z$J$N$+(B
| >   $B$7$i!D!D!#(B
| 
| $B>.Eg$5$s!"$D$$$G$K%5%s%W%k$b=q$$$FD:$1$^$;$s$+(B...
| $B$d$C$Q$j;d$G$OLr<TITB-$J$3$H?S$@$7!"$H;W$&$N$G!#(B
| 
| # $B$=$b$=$b;d$O(B http$B$G$O(B delegate $B;H$C$F$J$$$N$G$9(B
| # $B<+J,$G$O(BFreeBSD install $BMQ$N(B "ftp proxy" $B$@$7!"(Bdaemon $B$G;H$C$F$$$J$$$7(B...

  $B;d$N>l9g(B socks <--> ftp/telnet/... proxy $BJQ494o$H$7$F;H$C$F$$$k$N$G!"(B
  $B!V$U$D$&!W$N@_Dj$,$$$^$$$A$h$/$o$+$i$J$$$s$G$9$h$M!D!D!#(B

  $B<j85$N$d$D$O$3$s$J46$8$G;H$C$F$^$9(B:

#! /bin/sh
SOCKSSERVER=hoge
SOCKSPORT=1080

umask 027
delegated -P8021 \
        SERVER=ftp \
        MANAGER=delegate@`hostname` \
        SOCKS=${SOCKSSERVER}:${SOCKSPORT} \
        CONNECT='c,d:*:192.168.[0-255].[1-254]' \
        CONNECT='c,s:*:*' \
        EXPIRE=1d  \
        RELIABLE='192.168.[0-255].[1-254],localhost' \
        RESOLV=file,dns \
        DGROOT=/var/spool/delegate \
        OWNER=delegate/delegate 

  $B$"$C!"(B-Tx $B$,$J$$!D!D(B

----
// $BLZ2<@'M:!VM}2J7O$N:nJ85;=Q!WCf8x?7=q(B 624 $B$rFI$b$&(B!!

$B>.Eg(B $BH%(B - KOJIMA Hajime
[Office] kjm@rins.ryukoku.ac.jp, http://www.st.ryukoku.ac.jp/~kjm/
         Phone: 077-543-7414  Fax: 077-543-0706
