version 1.529, 2005/03/30 17:18:51 |
version 1.530, 2005/03/30 18:07:08 |
|
|
<li><a name="telnet"></a> |
<li><a name="telnet"></a> |
<font color="#009000"><strong>014: SECURITY FIX: March 30, 2005</strong></font> <i>All architectures</i><br> |
<font color="#009000"><strong>014: SECURITY FIX: March 30, 2005</strong></font> <i>All architectures</i><br> |
Due to buffer overflows in |
Due to buffer overflows in |
<a href="http://www.openbsd.org/cgi-bin/man.cgi?query=telnet&apropos=0&sektion=1&manpath=OpenBSD+Current&arch=i386&format=html">telnet(1)</a> |
<a href="http://www.openbsd.org/cgi-bin/man.cgi?query=telnet&sektion=1">telnet(1)</a>, |
, a malicious server or man-in-the-middle attack could allow execution of |
a malicious server or man-in-the-middle attack could allow execution of |
arbitrary code with the privileges of the user invoking |
arbitrary code with the privileges of the user invoking |
<a href="http://www.openbsd.org/cgi-bin/man.cgi?query=telnet&apropos=0&sektion=1&manpath=OpenBSD+Current&arch=i386&format=html">telnet(1)</a> |
<a href="http://www.openbsd.org/cgi-bin/man.cgi?query=telnet&sektion=1">telnet(1)</a>. |
. |
(Noone should use telnet anymore. Please use |
|
<a href="http://www.openbsd.org/cgi-bin/man.cgi?query=ssh&sektion=1">ssh(1)</a>. |
<br> |
<br> |
<a href="ftp://ftp.openbsd.org/pub/OpenBSD/patches/3.6/common/014_telnet.patch"> |
<a href="ftp://ftp.openbsd.org/pub/OpenBSD/patches/3.6/common/014_telnet.patch"> |
A source code patch exists which remedies this problem</a>.<br> |
A source code patch exists which remedies this problem</a>.<br> |
|
|
<li><a name="sack"></a> |
<li><a name="sack"></a> |
<font color="#009000"><strong>013: RELIABILITY FIX: March 30, 2005</strong></font> <i>All architectures</i><br> |
<font color="#009000"><strong>013: RELIABILITY FIX: March 30, 2005</strong></font> <i>All architectures</i><br> |
Bugs in the |
Bugs in the |
<a href="http://www.openbsd.org/cgi-bin/man.cgi?query=tcp&apropos=0&sektion=4&manpath=OpenBSD+Current&arch=i386&format=html">tcp(4)</a> |
<a href="http://www.openbsd.org/cgi-bin/man.cgi?query=tcp&sektion=4">tcp(4)</a> |
stack can lead to memory exhaustion or processing of TCP segments with |
stack can lead to memory exhaustion or processing of TCP segments with |
invalid SACK options and cause a system crash. |
invalid SACK options and cause a system crash. |
<br> |
<br> |
|
|
<li><a name="copy"></a> |
<li><a name="copy"></a> |
<font color="#009000"><strong>012: SECURITY FIX: March 16, 2005</strong></font> <strong>amd64 only</strong><br> |
<font color="#009000"><strong>012: SECURITY FIX: March 16, 2005</strong></font> <strong>amd64 only</strong><br> |
More stringent checking should be done in the |
More stringent checking should be done in the |
<a href="http://www.openbsd.org/cgi-bin/man.cgi?query=copy&apropos=0&sektion=9&manpath=OpenBSD+Current&arch=i386&format=html">copy(9)</a> |
<a href="http://www.openbsd.org/cgi-bin/man.cgi?query=copy&sektion=9">copy(9)</a> |
functions to prevent their misuse. |
functions to prevent their misuse. |
<br> |
<br> |
<a href="ftp://ftp.openbsd.org/pub/OpenBSD/patches/3.6/amd64/012_copy.patch"> |
<a href="ftp://ftp.openbsd.org/pub/OpenBSD/patches/3.6/amd64/012_copy.patch"> |
|
|
<li><a name="locore"></a> |
<li><a name="locore"></a> |
<font color="#009000"><strong>011: SECURITY FIX: February 28, 2005</strong></font> <strong>i386 only</strong><br> |
<font color="#009000"><strong>011: SECURITY FIX: February 28, 2005</strong></font> <strong>i386 only</strong><br> |
More stringent checking should be done in the |
More stringent checking should be done in the |
<a href="http://www.openbsd.org/cgi-bin/man.cgi?query=copy&apropos=0&sektion=9&manpath=OpenBSD+Current&arch=i386&format=html">copy(9)</a> |
<a href="http://www.openbsd.org/cgi-bin/man.cgi?query=copy&sektion=9">copy(9)</a> |
functions to prevent their misuse. |
functions to prevent their misuse. |
<br> |
<br> |
<a href="ftp://ftp.openbsd.org/pub/OpenBSD/patches/3.6/i386/011_locore.patch"> |
<a href="ftp://ftp.openbsd.org/pub/OpenBSD/patches/3.6/i386/011_locore.patch"> |
|
|
<li><a name="rtt"></a> |
<li><a name="rtt"></a> |
<font color="#009000"><strong>010: RELIABILITY FIX: January 11, 2005</strong></font> <i>All architectures</i><br> |
<font color="#009000"><strong>010: RELIABILITY FIX: January 11, 2005</strong></font> <i>All architectures</i><br> |
A bug in the |
A bug in the |
<a href="http://www.openbsd.org/cgi-bin/man.cgi?query=tcp&apropos=0&sektion=4&manpath=OpenBSD+Current&arch=i386&format=html">tcp(4)</a> |
<a href="http://www.openbsd.org/cgi-bin/man.cgi?query=tcp&sektion=4">tcp(4)</a> |
stack allows an invalid argument to be used in calculating the TCP |
stack allows an invalid argument to be used in calculating the TCP |
retransmit timeout. By sending packets with specific values in the TCP |
retransmit timeout. By sending packets with specific values in the TCP |
timestamp option, an attacker can cause a system panic. |
timestamp option, an attacker can cause a system panic. |
|
|
<li><a name="getcwd"></a> |
<li><a name="getcwd"></a> |
<font color="#009000"><strong>008: RELIABILITY FIX: January 6, 2005</strong></font> <i>All architectures</i><br> |
<font color="#009000"><strong>008: RELIABILITY FIX: January 6, 2005</strong></font> <i>All architectures</i><br> |
The |
The |
<a href="http://www.openbsd.org/cgi-bin/man.cgi?query=getcwd&apropos=0&sektion=3&manpath=OpenBSD+Current&arch=i386&format=html">getcwd(3)</a> |
<a href="http://www.openbsd.org/cgi-bin/man.cgi?query=getcwd&sektion=3">getcwd(3)</a> |
library function contains a memory management error, which causes failure |
library function contains a memory management error, which causes failure |
to retrieve the current working directory if the path is very long. |
to retrieve the current working directory if the path is very long. |
<br> |
<br> |
|
|
<li><a name="pfkey"></a> |
<li><a name="pfkey"></a> |
<font color="#009000"><strong>007: SECURITY FIX: December 14, 2004</strong></font> <i>All architectures</i><br> |
<font color="#009000"><strong>007: SECURITY FIX: December 14, 2004</strong></font> <i>All architectures</i><br> |
On systems running |
On systems running |
<a href="http://www.openbsd.org/cgi-bin/man.cgi?query=isakmpd&apropos=0&sektion=8&manpath=OpenBSD+Current&arch=i386&format=html">isakmpd(8)</a> |
<a href="http://www.openbsd.org/cgi-bin/man.cgi?query=isakmpd&sektion=8">isakmpd(8)</a> |
it is possible for a local user to cause kernel memory corruption |
it is possible for a local user to cause kernel memory corruption |
and system panic by setting |
and system panic by setting |
<a href="http://www.openbsd.org/cgi-bin/man.cgi?query=ipsec&apropos=0&sektion=4&manpath=OpenBSD+Current&&format=html">ipsec(4)</a> |
<a href="http://www.openbsd.org/cgi-bin/man.cgi?query=ipsec&sektion=4&manpath=OpenBSD+Current&&format=html">ipsec(4)</a> |
credentials on a socket. |
credentials on a socket. |
<br> |
<br> |
<a href="ftp://ftp.openbsd.org/pub/OpenBSD/patches/3.6/common/007_pfkey.patch"> |
<a href="ftp://ftp.openbsd.org/pub/OpenBSD/patches/3.6/common/007_pfkey.patch"> |
|
|
<li><a name="xl"></a> |
<li><a name="xl"></a> |
<font color="#009000"><strong>006: RELIABILITY FIX: November 21, 2004</strong></font> <i>All architectures</i><br> |
<font color="#009000"><strong>006: RELIABILITY FIX: November 21, 2004</strong></font> <i>All architectures</i><br> |
Fix for transmit side breakage on macppc and mbuf leaks with |
Fix for transmit side breakage on macppc and mbuf leaks with |
<a href="http://www.openbsd.org/cgi-bin/man.cgi?query=xl&apropos=0&sektion=4&manpath=OpenBSD+Current&arch=i386&format=html">xl(4)</a>. |
<a href="http://www.openbsd.org/cgi-bin/man.cgi?query=xl&sektion=4">xl(4)</a>. |
<br> |
<br> |
<a href="ftp://ftp.openbsd.org/pub/OpenBSD/patches/3.6/common/006_xl.patch"> |
<a href="ftp://ftp.openbsd.org/pub/OpenBSD/patches/3.6/common/006_xl.patch"> |
A source code patch exists which remedies this problem</a>.<br> |
A source code patch exists which remedies this problem</a>.<br> |
|
|
<li><a name="isakmpd"></a> |
<li><a name="isakmpd"></a> |
<font color="#009000"><strong>005: RELIABILITY FIX: November 21, 2004</strong></font> <i>All architectures</i><br> |
<font color="#009000"><strong>005: RELIABILITY FIX: November 21, 2004</strong></font> <i>All architectures</i><br> |
Wrong calculation of NAT-D payloads may cause interoperability problems between |
Wrong calculation of NAT-D payloads may cause interoperability problems between |
<a href="http://www.openbsd.org/cgi-bin/man.cgi?query=isakmpd&apropos=0&sektion=8&manpath=OpenBSD+Current&arch=i386&format=html">isakmpd(8)</a> |
<a href="http://www.openbsd.org/cgi-bin/man.cgi?query=isakmpd&sektion=8">isakmpd(8)</a> |
and other ISAKMP/IKE implementations. |
and other ISAKMP/IKE implementations. |
<br> |
<br> |
<a href="ftp://ftp.openbsd.org/pub/OpenBSD/patches/3.6/common/005_isakmpd.patch"> |
<a href="ftp://ftp.openbsd.org/pub/OpenBSD/patches/3.6/common/005_isakmpd.patch"> |
|
|
<li><a name="lynx"></a> |
<li><a name="lynx"></a> |
<font color="#009000"><strong>004: RELIABILITY FIX: November 10, 2004</strong></font> <i>All architectures</i><br> |
<font color="#009000"><strong>004: RELIABILITY FIX: November 10, 2004</strong></font> <i>All architectures</i><br> |
Due to a bug in |
Due to a bug in |
<a href="http://www.openbsd.org/cgi-bin/man.cgi?query=lynx&apropos=0&sektion=1&manpath=OpenBSD+Current&arch=i386&format=html">lynx(1)</a> |
<a href="http://www.openbsd.org/cgi-bin/man.cgi?query=lynx&sektion=1">lynx(1)</a> |
it is possible for pages such as |
it is possible for pages such as |
<a href="http://lcamtuf.coredump.cx/mangleme/gallery/lynx_die1.html">this</a> |
<a href="http://lcamtuf.coredump.cx/mangleme/gallery/lynx_die1.html">this</a> |
to cause |
to cause |
<a href="http://www.openbsd.org/cgi-bin/man.cgi?query=lynx&apropos=0&sektion=1&manpath=OpenBSD+Current&arch=i386&format=html">lynx(1)</a> |
<a href="http://www.openbsd.org/cgi-bin/man.cgi?query=lynx&sektion=1">lynx(1)</a> |
to exhaust memory and then crash when parsing such pages. |
to exhaust memory and then crash when parsing such pages. |
<br> |
<br> |
<a href="ftp://ftp.openbsd.org/pub/OpenBSD/patches/3.6/common/004_lynx.patch"> |
<a href="ftp://ftp.openbsd.org/pub/OpenBSD/patches/3.6/common/004_lynx.patch"> |
|
|
|
|
<li><a name="pppd"></a> |
<li><a name="pppd"></a> |
<font color="#009000"><strong>003: RELIABILITY FIX: November 10, 2004</strong></font> <i>All architectures</i><br> |
<font color="#009000"><strong>003: RELIABILITY FIX: November 10, 2004</strong></font> <i>All architectures</i><br> |
<a href="http://www.openbsd.org/cgi-bin/man.cgi?query=pppd&apropos=0&sektion=8&manpath=OpenBSD+Current&arch=i386&format=html">pppd(8)</a> |
<a href="http://www.openbsd.org/cgi-bin/man.cgi?query=pppd&sektion=8">pppd(8)</a> |
contains a bug that allows an attacker to crash his own connection, but it cannot |
contains a bug that allows an attacker to crash his own connection, but it cannot |
be used to deny service to other users. |
be used to deny service to other users. |
<br> |
<br> |
|
|
<li><a name="st"></a> |
<li><a name="st"></a> |
<font color="#009000"><strong>001: RELIABILITY FIX: November 10, 2004</strong></font> <i>All architectures</i><br> |
<font color="#009000"><strong>001: RELIABILITY FIX: November 10, 2004</strong></font> <i>All architectures</i><br> |
Fix detection of tape blocksize during device open. Corrects problem with |
Fix detection of tape blocksize during device open. Corrects problem with |
<a href="http://www.openbsd.org/cgi-bin/man.cgi?query=restore&apropos=0&sektion=8&manpath=OpenBSD+Current&arch=i386&format=html">restore(8)</a>. |
<a href="http://www.openbsd.org/cgi-bin/man.cgi?query=restore&sektion=8">restore(8)</a>. |
<br> |
<br> |
<a href="ftp://ftp.openbsd.org/pub/OpenBSD/patches/3.6/common/001_st.patch"> |
<a href="ftp://ftp.openbsd.org/pub/OpenBSD/patches/3.6/common/001_st.patch"> |
A source code patch exists which remedies this problem</a>.<br> |
A source code patch exists which remedies this problem</a>.<br> |