NetBSD 9.4 — xlockmore — multiple vulnerabilities (3 CVEs) — patch and remediation guide

📖 ~4 min read  •  Source: NetBSD advisory NetBSD-SA-2000-003

Related CVEs: CVE-2012-4524 CVE-2006-0061 CVE-2006-0062

Upstream summary: pkgsrc audit-packages flagged xlockmore<4.17 for vulnerability class 'local-root-file-view'. Reference: https://ftp.NetBSD.org/pub/NetBSD/security/advisories/NetBSD-SA2000-003.txt.asc

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

Exploitation of xlockmore is user-driven: the danger arrives when someone opens a hostile page, message or attachment, so exposure sits on each NetBSD 9.4 workstation rather than on any serving path. Desktop sessions run for weeks, and the package manager only replaces files on disk — a xlockmore process started before the update keeps the old code mapped until the user quits and relaunches it. Consequences are local: theft of saved credentials and session cookies, access to the user’s profile data under $HOME, and code execution as the logged-in account. xlockmore is a graphical application launched by a user from their desktop session, not a system service: there is no service to restart, and service(8) or /var/log/messages will report nothing for it.

Environment & Reproduction

Reproduction targets NetBSD 9.4. Confirm release, kernel, and installed package state:

uname -a
cat /etc/release
sysctl kern.version
sysctl kern.osrelease
pkg_info -e xlockmore && pkg_info xlockmore | head -20
pkgin list | wc -l

Exercise the workload that uses xlockmore while collecting:

tail -200 /var/log/messages
tail -200 /var/log/authlog
dmesg | tail -200
# pkgsrc transaction log (location varies; check both):
tail -200 /var/db/pkgin/pkg_install-err.log 2>/dev/null
tail -200 /var/log/pkgsrc.log 2>/dev/null

Root Cause Analysis

Root cause is tracked at NetBSD advisory NetBSD-SA-2000-003. NetBSD pkgsrc-security maintains the pkg-vulnerabilities feed consumed by pkg_admin audit; hosts running a pre-fix build of xlockmore remain exposed. Correlate audit output with system logs and kernel state to identify the change that introduced the failure mode:

sudo pkg_admin fetch-pkg-vulnerabilities   # refresh the audit feed first
sudo pkg_admin audit-pkg xlockmore             # per-package audit
sudo pkg_admin audit                       # full-system audit
tail -500 /var/log/messages
sysctl kern.lastpid kern.osreldate
# Verify the running base kernel matches the on-disk image:
cksum -a sha256 /netbsd

Quick Triage

Run these checks on NetBSD 9.4 to confirm the failure mode and the current state of xlockmore:

pkgin search ^xlockmore$                       # confirm pkgin can see it
pkgin show-deps xlockmore                      # forward dependencies
pkgin show-rev-deps xlockmore                  # reverse dependencies
sudo pkg_admin audit-pkg xlockmore             # audit just this package
tail -100 /var/log/messages
tail -100 /var/log/authlog
dmesg | tail -100
pkg query '%Fp' xlockmore | sed -n 's|.*/etc/rc\.d/||p'  # FreeBSD: the REAL service name(s) = basename of the rc.d script (bind918 -> named, postgresql16-server -> postgresql, apache24 -> apache24)
pkg query '%b' xlockmore  # FreeBSD: shared libraries PROVIDED by xlockmore. Non-empty here + no rc.d script = it is a library: patch it, then restart its consumers
# Firewall posture (npf is default in NetBSD 10; ipf still available):
npfctl show 2>/dev/null || ipfstat -hin 2>/dev/null

Step-by-Step Diagnosis

1. Refresh the pkgsrc audit feed and run a full system audit.

   sudo pkg_admin fetch-pkg-vulnerabilities
   sudo pkg_admin audit

2. Tail live logs while reproducing the issue.

   tail -F /var/log/messages
   tail -F /var/log/authlog
   dmesg | tail -200

3. Inspect firewall rules — NetBSD 10 defaults to npf, older deployments may still run ipf.

   npfctl rule "block-in" list 2>/dev/null
   npfctl show 2>/dev/null
   ipfstat -hin 2>/dev/null
   ipfstat -nio 2>/dev/null

4. Confirm enabled services in /etc/rc.conf and current daemon state.

   grep -E '=YES' /etc/rc.conf

5. Verify the on-disk integrity of the package files for xlockmore.

   pkg_admin check xlockmore
   pkg_info -L xlockmore | xargs -I{} cksum -a sha256 {} 2>/dev/null | head

6. Correlate findings with the NetBSD source CVS log and NetBSD advisory NetBSD-SA-2000-003 to pin the change that introduced the regression.

Solution – Primary Fix

Refresh the pkgsrc package index and upgrade xlockmore (and its dependants) through NetBSD advisory NetBSD-SA-2000-003:

sudo pkgin update
sudo pkgin upgrade xlockmore            # single package
sudo pkgin full-upgrade             # whole-system pkgsrc upgrade
sudo pkg_admin fetch-pkg-vulnerabilities
sudo pkg_admin audit-pkg xlockmore      # confirm no remaining audit entry

For administrators who build from a local pkgsrc tree:

# Refresh the tree (CVS) or pull a fresh tarball:
cd /usr/pkgsrc && sudo cvs -q update -dP
cd /usr/pkgsrc/<category>/xlockmore && sudo make replace clean
# Or rebuild + binary package output:
cd /usr/pkgsrc/<category>/xlockmore && sudo make package-install

For base-system fixes, NetBSD does not ship binary syspatches like OpenBSD. Rebuild from source (CVS or release tarball) or move to a newer build:

# Option A: in-place upgrade via the sysupgrade pkgsrc tool:
sudo pkgin install sysupgrade
sudo sysupgrade auto https://nycdn.NetBSD.org/pub/NetBSD-daily/netbsd-10/latest/amd64/
# Option B: rebuild from the source tree:
cd /usr/src && sudo ./build.sh -O /var/obj -T /var/tools -U tools
cd /usr/src && sudo ./build.sh -O /var/obj -T /var/tools -U distribution
cd /usr/src && sudo ./build.sh -O /var/obj -T /var/tools -U install=/
# Option C: fetch a HEAD/release tarball and extract base.tgz over /:
cd /var/tmp && ftp https://nycdn.NetBSD.org/pub/NetBSD-daily/netbsd-10/latest/amd64/binary/sets/base.tgz
cd / && sudo tar xzpf /var/tmp/base.tgz

Reboot only if the upgrade replaced the kernel (/netbsd) or shared libraries used by long-running daemons.

Solution – Alternative Approaches

If the primary fix is not viable, choose from these alternatives:

• Pin the package on its current version while staging a coordinated rollout. pkgsrc has no first-class “lock” so document and reinstall from a saved binary:

  pkg_info -X xlockmore > /root/xlockmore.pin.txt
  # Save the current .tgz from /usr/pkgsrc/packages/All/xlockmore-<ver>.tgz
  # Refuse pkgin upgrades for this package by removing it from the upgrade plan:
  sudo pkgin -y avoid xlockmore 2>/dev/null || true

• Roll xlockmore back to a known-good binary package:

  # 1. List versions available from the configured pkgin repo:
  pkgin search ^xlockmore$
  # 2. Force-install a specific .tgz from a saved build:
  sudo pkg_add -f /usr/pkgsrc/packages/All/xlockmore-<older-version>.tgz
  # 3. Or point pkgin at the previous quarterly branch via /usr/pkg/etc/pkgin/repositories.conf

• Switch the pkgin repository between branches by editing /usr/pkg/etc/pkgin/repositories.conf:

  # /usr/pkg/etc/pkgin/repositories.conf
  https://cdn.NetBSD.org/pub/pkgsrc/packages/NetBSD/$arch/$osrelease/All
  # Then:
  sudo pkgin update
  sudo pkgin upgrade xlockmore

• Build from source against a different pkgsrc branch (quarterly vs. HEAD):

  cd /usr && sudo cvs -d :pserver:[email protected]:/cvsroot checkout -P pkgsrc
  cd /usr/pkgsrc/<category>/xlockmore && sudo make replace clean clean-depends

• Sandbox the affected service with stricter firewall rules until a fix is verified — npf.conf example:

  # /etc/npf.conf
  block in on $ext_if proto tcp to port xlockmore_port
  # Reload the ruleset:
  sudo npfctl reload
  sudo npfctl show

• Replace the service with a vendored static build for the interval between exposure detection and full rollout.

Verification & Acceptance Criteria

All of these should pass after the fix:

pkg_info xlockmore                           # shows the expected fixed version
sudo pkg_admin audit-pkg xlockmore           # no audit hit for this package
sudo pkg_admin audit                     # no audit hits anywhere
tail -50 /var/log/messages              # no new errors after upgrade
tail -50 /var/log/authlog               # no auth anomalies
# Verify base kernel integrity if the upgrade touched /netbsd:
cksum -a sha256 /netbsd

The conditions described in the advisory must no longer be reported for xlockmore across two consecutive runs.

Rollback Plan

Capture state before any change:

pkg_info -X > /root/pkg-pre.txt
cp -a /etc/rc.conf /etc/rc.conf.pre-patch
# Snapshot the root filesystem if you are on ZFS:
sudo zfs snapshot rpool/ROOT/netbsd@pre-xlockmore-patch 2>/dev/null || true

To revert if the upgrade is bad:

# Reinstall the previously saved binary package:
sudo pkg_add -f /usr/pkgsrc/packages/All/xlockmore-<previous-version>.tgz
# Or roll back via pkgin if a previous version is still in the repo:
sudo pkgin install xlockmore-<previous-version>
# Restore rc.conf if it was edited:
sudo cp /etc/rc.conf.pre-patch /etc/rc.conf
# Rollback ZFS snapshot (only if you took one above):
sudo zfs rollback rpool/ROOT/netbsd@pre-xlockmore-patch 2>/dev/null || true

For a base-system / kernel regression, boot the previous kernel from the loader prompt (press 5 at the boot menu, then boot netbsd.old).

Prevention & Hardening

Reduce the chance of this recurring on NetBSD 9.4 hosts running xlockmore:

• Schedule a daily pkgsrc audit via cron:

  # /etc/daily.local
  pkg_admin fetch-pkg-vulnerabilities
  pkg_admin audit | mail -E -s 'pkgsrc audit' root

• Subscribe to netbsd-announce and pkgsrc-security at mail-index.NetBSD.org and watch the NetBSD Security Advisories index.

• Mirror pkgsrc binary packages locally so production hosts pull from a vetted feed:

  # Bulk-build a private pkgsrc repo (one-time):
  cd /usr/pkgsrc/pkgtools/pbulk && sudo make install clean
  sudo pbulk-build -c /usr/pbulk/etc/pbulk.conf
  # Then publish /usr/pbulk/packages/ behind nginx or rsync.

• Keep sysupgrade installed and dry-run it before scheduled windows:

  sudo pkgin install sysupgrade
  sudo sysupgrade -n auto https://nycdn.NetBSD.org/pub/NetBSD-daily/netbsd-10/latest/amd64/

• Harden the firewall with npf default-deny and reload after edits:

  # /etc/npf.conf
  $ext_if = "wm0"
  group default {
    block all
    pass in final on $ext_if proto tcp to port { ssh }
    pass out final all
  }

  sudo npfctl reload
  sudo npfctl start

• Monitor file integrity with the NetBSD-shipped veriexec subsystem or with mtree:

  # mtree baseline of critical config dirs:
  sudo mtree -c -K sha256digest -p /etc       > /var/db/etc.mtree
  sudo mtree -c -K sha256digest -p /usr/pkg/etc > /var/db/usr-pkg-etc.mtree
  # Verify later:
  sudo mtree -p /etc < /var/db/etc.mtree
  # veriexec (kernel-enforced):
  sudo veriexecgen -o /etc/signatures
  sudo veriexecctl load /etc/signatures

• Verify NetBSD signed sets when applying base-system updates — the project publishes detached signatures alongside base.tgz on nycdn.NetBSD.org:

  # Fetch set + signature, then verify before extracting:
  ftp https://nycdn.NetBSD.org/pub/NetBSD-daily/netbsd-10/latest/amd64/binary/sets/base.tgz
  ftp https://nycdn.NetBSD.org/pub/NetBSD-daily/netbsd-10/latest/amd64/binary/sets/SHA512
  grep base.tgz SHA512 | cksum -a sha512 -c -

Related Errors & Cross-Refs

Issues that commonly surface alongside a xlockmore update: mismatched kern.osrelease after a partial userland upgrade, stale shared-library references after a pkgsrc replace, drifted npf rules, and out-of-date pkg-vulnerabilities feeds. Useful triage:

uname -a
sysctl kern.osrelease kern.osreldate
sudo pkg_admin audit
sudo npfctl show

View all netbsd-9-4 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

Primary reference: NetBSD advisory NetBSD-SA-2000-003. Useful manual pages on NetBSD 9.4:

man pkgin
man pkg_admin
man pkg_info
man rc.conf
man rc.d
man service
man npfctl
man npf.conf
man ipf
man sysupgrade
man veriexec

Other resources: the NetBSD Guide, the NetBSD Security Advisories index, the pkgsrc Guide, and the per-package DESCR + MESSAGE files under /usr/pkgsrc/<category>/xlockmore/ for notes implicated in xlockmore.

View all NetBSD 9.4 tutorials on the Tutorials Hub →