NetBSD 10.0 — firefox-bin-flash — multiple vulnerabilities (5 CVEs) — patch and remediation guide

📖 ~4 min read  •  Source: pkgsrc audit-packages entry

Related CVEs: CVE-2007-3456 CVE-2010-2884 CVE-2010-3654 CVE-2011-0611 CVE-2007-2022

Upstream summary: pkgsrc audit-packages flagged firefox-bin-flash<9.0.47 for vulnerability class 'arbitrary-code-execution'. Reference: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3456

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

Exploitation of firefox-bin-flash is user-driven: the danger arrives when someone opens a hostile page, message or attachment, so exposure sits on each NetBSD 10.0 workstation rather than on any serving path. Desktop sessions run for weeks, and the package manager only replaces files on disk — a firefox-bin-flash process started before the update keeps the old code mapped until the user quits and relaunches it. Consequences are local: theft of saved credentials and session cookies, access to the user’s profile data under $HOME, and code execution as the logged-in account. firefox-bin-flash is a graphical application launched by a user from their desktop session, not a system service: there is no service to restart, and service(8) or /var/log/messages will report nothing for it.

Environment & Reproduction

Reproduction targets NetBSD 10.0. Confirm release, kernel, and installed package state:

uname -a
cat /etc/release
sysctl kern.version
sysctl kern.osrelease
pkg_info -e firefox-bin-flash && pkg_info firefox-bin-flash | head -20
pkgin list | wc -l

Exercise the workload that uses firefox-bin-flash while collecting:

tail -200 /var/log/messages
tail -200 /var/log/authlog
dmesg | tail -200
# pkgsrc transaction log (location varies; check both):
tail -200 /var/db/pkgin/pkg_install-err.log 2>/dev/null
tail -200 /var/log/pkgsrc.log 2>/dev/null

Root Cause Analysis

Root cause is tracked at pkgsrc audit-packages entry. NetBSD pkgsrc-security maintains the pkg-vulnerabilities feed consumed by pkg_admin audit; hosts running a pre-fix build of firefox-bin-flash remain exposed. Correlate audit output with system logs and kernel state to identify the change that introduced the failure mode:

sudo pkg_admin fetch-pkg-vulnerabilities   # refresh the audit feed first
sudo pkg_admin audit-pkg firefox-bin-flash             # per-package audit
sudo pkg_admin audit                       # full-system audit
tail -500 /var/log/messages
sysctl kern.lastpid kern.osreldate
# Verify the running base kernel matches the on-disk image:
cksum -a sha256 /netbsd

Quick Triage

Run these checks on NetBSD 10.0 to confirm the failure mode and the current state of firefox-bin-flash:

pkgin search ^firefox-bin-flash$                       # confirm pkgin can see it
pkgin show-deps firefox-bin-flash                      # forward dependencies
pkgin show-rev-deps firefox-bin-flash                  # reverse dependencies
sudo pkg_admin audit-pkg firefox-bin-flash             # audit just this package
tail -100 /var/log/messages
tail -100 /var/log/authlog
dmesg | tail -100
pkg query '%Fp' firefox-bin-flash | sed -n 's|.*/etc/rc\.d/||p'  # FreeBSD: the REAL service name(s) = basename of the rc.d script (bind918 -> named, postgresql16-server -> postgresql, apache24 -> apache24)
pkg query '%b' firefox-bin-flash  # FreeBSD: shared libraries PROVIDED by firefox-bin-flash. Non-empty here + no rc.d script = it is a library: patch it, then restart its consumers
# Firewall posture (npf is default in NetBSD 10; ipf still available):
npfctl show 2>/dev/null || ipfstat -hin 2>/dev/null

Step-by-Step Diagnosis

1. Refresh the pkgsrc audit feed and run a full system audit.

   sudo pkg_admin fetch-pkg-vulnerabilities
   sudo pkg_admin audit

2. Tail live logs while reproducing the issue.

   tail -F /var/log/messages
   tail -F /var/log/authlog
   dmesg | tail -200

3. Inspect firewall rules — NetBSD 10 defaults to npf, older deployments may still run ipf.

   npfctl rule "block-in" list 2>/dev/null
   npfctl show 2>/dev/null
   ipfstat -hin 2>/dev/null
   ipfstat -nio 2>/dev/null

4. Confirm enabled services in /etc/rc.conf and current daemon state.

   grep -E '=YES' /etc/rc.conf
   service -e 2>/dev/null | grep -i firefox

5. Verify the on-disk integrity of the package files for firefox-bin-flash.

   pkg_admin check firefox-bin-flash
   pkg_info -L firefox-bin-flash | xargs -I{} cksum -a sha256 {} 2>/dev/null | head

6. Correlate findings with the NetBSD source CVS log and pkgsrc audit-packages entry to pin the change that introduced the regression.

Solution – Primary Fix

Refresh the pkgsrc package index and upgrade firefox-bin-flash (and its dependants) through pkgsrc audit-packages entry:

sudo pkgin update
sudo pkgin upgrade firefox-bin-flash            # single package
sudo pkgin full-upgrade             # whole-system pkgsrc upgrade
sudo pkg_admin fetch-pkg-vulnerabilities
sudo pkg_admin audit-pkg firefox-bin-flash      # confirm no remaining audit entry

For administrators who build from a local pkgsrc tree:

# Refresh the tree (CVS) or pull a fresh tarball:
cd /usr/pkgsrc && sudo cvs -q update -dP
cd /usr/pkgsrc/<category>/firefox-bin-flash && sudo make replace clean
# Or rebuild + binary package output:
cd /usr/pkgsrc/<category>/firefox-bin-flash && sudo make package-install

For base-system fixes, NetBSD does not ship binary syspatches like OpenBSD. Rebuild from source (CVS or release tarball) or move to a newer build:

# Option A: in-place upgrade via the sysupgrade pkgsrc tool:
sudo pkgin install sysupgrade
sudo sysupgrade auto https://nycdn.NetBSD.org/pub/NetBSD-daily/netbsd-10/latest/amd64/
# Option B: rebuild from the source tree:
cd /usr/src && sudo ./build.sh -O /var/obj -T /var/tools -U tools
cd /usr/src && sudo ./build.sh -O /var/obj -T /var/tools -U distribution
cd /usr/src && sudo ./build.sh -O /var/obj -T /var/tools -U install=/
# Option C: fetch a HEAD/release tarball and extract base.tgz over /:
cd /var/tmp && ftp https://nycdn.NetBSD.org/pub/NetBSD-daily/netbsd-10/latest/amd64/binary/sets/base.tgz
cd / && sudo tar xzpf /var/tmp/base.tgz

Reboot only if the upgrade replaced the kernel (/netbsd) or shared libraries used by long-running daemons.

Solution – Alternative Approaches

If the primary fix is not viable, choose from these alternatives:

• Pin the package on its current version while staging a coordinated rollout. pkgsrc has no first-class “lock” so document and reinstall from a saved binary:

  pkg_info -X firefox-bin-flash > /root/firefox-bin-flash.pin.txt
  # Save the current .tgz from /usr/pkgsrc/packages/All/firefox-bin-flash-<ver>.tgz
  # Refuse pkgin upgrades for this package by removing it from the upgrade plan:
  sudo pkgin -y avoid firefox-bin-flash 2>/dev/null || true

• Roll firefox-bin-flash back to a known-good binary package:

  # 1. List versions available from the configured pkgin repo:
  pkgin search ^firefox-bin-flash$
  # 2. Force-install a specific .tgz from a saved build:
  sudo pkg_add -f /usr/pkgsrc/packages/All/firefox-bin-flash-<older-version>.tgz
  # 3. Or point pkgin at the previous quarterly branch via /usr/pkg/etc/pkgin/repositories.conf

• Switch the pkgin repository between branches by editing /usr/pkg/etc/pkgin/repositories.conf:

  # /usr/pkg/etc/pkgin/repositories.conf
  https://cdn.NetBSD.org/pub/pkgsrc/packages/NetBSD/$arch/$osrelease/All
  # Then:
  sudo pkgin update
  sudo pkgin upgrade firefox-bin-flash

• Build from source against a different pkgsrc branch (quarterly vs. HEAD):

  cd /usr && sudo cvs -d :pserver:[email protected]:/cvsroot checkout -P pkgsrc
  cd /usr/pkgsrc/<category>/firefox-bin-flash && sudo make replace clean clean-depends

• Sandbox the affected service with stricter firewall rules until a fix is verified — npf.conf example:

  # /etc/npf.conf
  block in on $ext_if proto tcp to port firefox-bin-flash_port
  # Reload the ruleset:
  sudo npfctl reload
  sudo npfctl show

• Replace the service with a vendored static build for the interval between exposure detection and full rollout.

Verification & Acceptance Criteria

All of these should pass after the fix:

pkg_info firefox-bin-flash                           # shows the expected fixed version
sudo pkg_admin audit-pkg firefox-bin-flash           # no audit hit for this package
sudo pkg_admin audit                     # no audit hits anywhere
tail -50 /var/log/messages              # no new errors after upgrade
tail -50 /var/log/authlog               # no auth anomalies
# Verify base kernel integrity if the upgrade touched /netbsd:
cksum -a sha256 /netbsd

The conditions described in the advisory must no longer be reported for firefox-bin-flash across two consecutive runs.

Rollback Plan

Capture state before any change:

pkg_info -X > /root/pkg-pre.txt
cp -a /etc/rc.conf /etc/rc.conf.pre-patch
# Snapshot the root filesystem if you are on ZFS:
sudo zfs snapshot rpool/ROOT/netbsd@pre-firefox-bin-flash-patch 2>/dev/null || true

To revert if the upgrade is bad:

# Reinstall the previously saved binary package:
sudo pkg_add -f /usr/pkgsrc/packages/All/firefox-bin-flash-<previous-version>.tgz
# Or roll back via pkgin if a previous version is still in the repo:
sudo pkgin install firefox-bin-flash-<previous-version>
# Restore rc.conf if it was edited:
sudo cp /etc/rc.conf.pre-patch /etc/rc.conf
# Rollback ZFS snapshot (only if you took one above):
sudo zfs rollback rpool/ROOT/netbsd@pre-firefox-bin-flash-patch 2>/dev/null || true

For a base-system / kernel regression, boot the previous kernel from the loader prompt (press 5 at the boot menu, then boot netbsd.old).

Prevention & Hardening

Reduce the chance of this recurring on NetBSD 10.0 hosts running firefox-bin-flash:

• Schedule a daily pkgsrc audit via cron:

  # /etc/daily.local
  pkg_admin fetch-pkg-vulnerabilities
  pkg_admin audit | mail -E -s 'pkgsrc audit' root

• Subscribe to netbsd-announce and pkgsrc-security at mail-index.NetBSD.org and watch the NetBSD Security Advisories index.

• Mirror pkgsrc binary packages locally so production hosts pull from a vetted feed:

  # Bulk-build a private pkgsrc repo (one-time):
  cd /usr/pkgsrc/pkgtools/pbulk && sudo make install clean
  sudo pbulk-build -c /usr/pbulk/etc/pbulk.conf
  # Then publish /usr/pbulk/packages/ behind nginx or rsync.

• Keep sysupgrade installed and dry-run it before scheduled windows:

  sudo pkgin install sysupgrade
  sudo sysupgrade -n auto https://nycdn.NetBSD.org/pub/NetBSD-daily/netbsd-10/latest/amd64/

• Harden the firewall with npf default-deny and reload after edits:

  # /etc/npf.conf
  $ext_if = "wm0"
  group default {
    block all
    pass in final on $ext_if proto tcp to port { ssh }
    pass out final all
  }

  sudo npfctl reload
  sudo npfctl start

• Monitor file integrity with the NetBSD-shipped veriexec subsystem or with mtree:

  # mtree baseline of critical config dirs:
  sudo mtree -c -K sha256digest -p /etc       > /var/db/etc.mtree
  sudo mtree -c -K sha256digest -p /usr/pkg/etc > /var/db/usr-pkg-etc.mtree
  # Verify later:
  sudo mtree -p /etc < /var/db/etc.mtree
  # veriexec (kernel-enforced):
  sudo veriexecgen -o /etc/signatures
  sudo veriexecctl load /etc/signatures

• Verify NetBSD signed sets when applying base-system updates — the project publishes detached signatures alongside base.tgz on nycdn.NetBSD.org:

  # Fetch set + signature, then verify before extracting:
  ftp https://nycdn.NetBSD.org/pub/NetBSD-daily/netbsd-10/latest/amd64/binary/sets/base.tgz
  ftp https://nycdn.NetBSD.org/pub/NetBSD-daily/netbsd-10/latest/amd64/binary/sets/SHA512
  grep base.tgz SHA512 | cksum -a sha512 -c -

Related Errors & Cross-Refs

Issues that commonly surface alongside a firefox-bin-flash update: mismatched kern.osrelease after a partial userland upgrade, stale shared-library references after a pkgsrc replace, drifted npf rules, and out-of-date pkg-vulnerabilities feeds. Useful triage:

uname -a
sysctl kern.osrelease kern.osreldate
sudo pkg_admin audit
sudo npfctl show

View all netbsd-10-0 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

Primary reference: pkgsrc audit-packages entry. Useful manual pages on NetBSD 10.0:

man pkgin
man pkg_admin
man pkg_info
man rc.conf
man rc.d
man service
man npfctl
man npf.conf
man ipf
man sysupgrade
man veriexec

Other resources: the NetBSD Guide, the NetBSD Security Advisories index, the pkgsrc Guide, and the per-package DESCR + MESSAGE files under /usr/pkgsrc/<category>/firefox-bin-flash/ for notes implicated in firefox-bin-flash.

View all NetBSD 10.0 tutorials on the Tutorials Hub →