===================================================================
RCS file: /cvsrepo/anoncvs/cvs/www/errata.html,v
retrieving revision 1.71
retrieving revision 1.72
diff -c -r1.71 -r1.72
*** www/errata.html	1998/02/16 00:59:46	1.71
--- www/errata.html	1998/02/19 10:42:30	1.72
***************
*** 21,36 ****
  <a name=all></a>
  <li><h3><font color=#e00000>All architectures</font></h3>
  <ul>
! <li>Building an object tree from a read-only source tree (such as off a CDROM)
! may fail under certain circumstances (e.g. when creating a symlink on sparc
! whose target name is exactly 33 characters).  As a workaround you have to
! either provide the source tree read/write, or install a newer version of
! /usr/bin/readlink.  You wish to use
! <a href=http://www.openbsd.org/cgi-bin/cvsweb/src/usr.bin/readlink/readlink.c?rev=1.13>
! revision 1.13 of usr.bin/readlink/readlink.c</a>.
  <p>
  <a name=ruserok></a>
! <li><strong>IMPORTANT</strong>
  A combination localhost+remote host security problem exists if a
  local user running a setuid binary causes a non-existant root .rhosts
  file to be created via a symbolic link with a specific kind of corefile,
--- 21,39 ----
  <a name=all></a>
  <li><h3><font color=#e00000>All architectures</font></h3>
  <ul>
! <a name=sourceroute></a>
! <li><strong><font color=#009000>SECURITY FIX</strong></font><br>
! If the sysctl variable <strong>net.inet.ip.forwarding</strong> is
! enabled (value 1), but the variable <strong>net.inet.ip.sourceroute</strong>
! is disabled (value 0), the kernel will still accept source routing packets
! itself.  Our fix changes the <strong>net.inet.ip.sourceroute</strong>
! variable to mean that all block all source routed packets should be
! blocked completely.
! <a href=ftp://ftp.openbsd.org/pub/OpenBSD/patches/2.2/common/sourceroute.patch>
! A kernel patch is provided</a>.
  <p>
  <a name=ruserok></a>
! <li><font color=#009000><strong>SECURITY FIX</strong></font><br>
  A combination localhost+remote host security problem exists if a
  local user running a setuid binary causes a non-existant root .rhosts
  file to be created via a symbolic link with a specific kind of corefile,
***************
*** 43,56 ****
  <ul>
  <li>
  <a href=ftp://ftp.openbsd.org/pub/OpenBSD/patches/2.2/common/nosuidcoredump.patch>
! (1) Adds a new sysctl option which permits the adminstrator to decide
! whether setuid corefiles should be written or not.</a>
  <p>
  <li><a href=ftp://ftp.openbsd.org/pub/OpenBSD/patches/2.2/common/rcmd.patch>
  (2) Replaces the ruserok() function in libc with a much more paranoid
  version which can detect these bogus looking .rhosts files better.  If the
  previous patch is used to stop setuid coredumps, then this patch is not
! as important.</a>
  </ul>
  <p>
  This problem is fixed much better in OpenBSD-current, where the kernel's
--- 46,59 ----
  <ul>
  <li>
  <a href=ftp://ftp.openbsd.org/pub/OpenBSD/patches/2.2/common/nosuidcoredump.patch>
! (1) A kernel patch which adds a new sysctl option which permits the
! administrator to decide whether setuid corefiles should be written or not</a>.
  <p>
  <li><a href=ftp://ftp.openbsd.org/pub/OpenBSD/patches/2.2/common/rcmd.patch>
  (2) Replaces the ruserok() function in libc with a much more paranoid
  version which can detect these bogus looking .rhosts files better.  If the
  previous patch is used to stop setuid coredumps, then this patch is not
! as important</a>.
  </ul>
  <p>
  This problem is fixed much better in OpenBSD-current, where the kernel's
***************
*** 58,68 ****
  create a file on the other side of a symbolic link.  Such a patch is not
  possible for the 4.4lite1 VFS layer in the OpenBSD 2.2 kernel.
  <p>
  </ul>
  <a name=i386></a>
  <li><h3><font color=#e00000>i386</font></h3>
  <ul>
! <li>The Intel P5 F00F bug was discovered after the CDR's had already been
  sent to the manufacturer.  This problem permits any user who has an account
  to lock your machine up using a 4-line program.  The problem only affects
  Intel P5 processors (the i386, i486, P-Pro, and P-II are not vulnerable,
--- 61,92 ----
  create a file on the other side of a symbolic link.  Such a patch is not
  possible for the 4.4lite1 VFS layer in the OpenBSD 2.2 kernel.
  <p>
+ <a name=mmap></a>
+ <li><strong><font color=#009000>SECURITY FIX</strong></font><br>
+ If you rely on the system securelevels as described in init(8), you
+ will want this fix.  A bug in the vm system permits a file descriptor
+ opened read-only on a device, to later on be mmap(2)'d read-write, and
+ then modified.  This does not result in a security hole by itself, but
+ it does violate the safety semantics which securelevels are supposed to
+ provide.
+ <a href=ftp://ftp.openbsd.org/pub/OpenBSD/patches/2.2/common/vm_mmap.patch>
+ A kernel patch is available which corrects this behaviour</a>.
+ <p>
+ <li><font color=#009000><strong>BUILD PROCESS FIX</strong></font><br>
+ Building an object tree from a read-only source tree (such as off a CDROM)
+ may fail under certain circumstances (e.g. when creating a symlink on sparc
+ whose target name is exactly 33 characters).  As a workaround you have to
+ either provide the source tree read/write, or install a newer version of
+ /usr/bin/readlink.  
+ <a href=ftp://ftp.openbsd.org/pub/OpenBSD/patches/2.2/common/readlink.c>
+ A replacement source file exists</a>.
+ <p>
  </ul>
  <a name=i386></a>
  <li><h3><font color=#e00000>i386</font></h3>
  <ul>
! <li><font color=#009000><strong>RELIABILITY FIX</strong></font><br>
! The Intel P5 F00F bug was discovered after the CDR's had already been
  sent to the manufacturer.  This problem permits any user who has an account
  to lock your machine up using a 4-line program.  The problem only affects
  Intel P5 processors (the i386, i486, P-Pro, and P-II are not vulnerable,
***************
*** 70,86 ****
  <a href=ftp://ftp.openbsd.org/pub/OpenBSD/patches/2.2/i386/f00f.patch>
  A kernel source-code patch is available</a>.
  <p>
! <li>Some Linux binaries will execute in SVR4 emulation mode, which is
  definately a problem for people who need Linux emulation to work correctly.
  To solve this mis-identification problem,
  <a href=ftp://ftp.openbsd.org/pub/OpenBSD/patches/2.2/i386/compat_linux.patch>
! a patch file is provided.</a>
  <p>
! <li>APM can crash on machines without it.
  <a href=ftp://ftp.openbsd.org/pub/OpenBSD/patches/2.2/i386/apm.patch>
  A kernel source-code patch is available</a>.
  <p>
! <li>A few people are running into this problem, particularily if they had some
  other *BSD operating system on their machine before trying OpenBSD: if after
  installation onto an IDE-based machine, the kernel fails to mount the root
  partition because it thinks that it should be opening sd0 (0x400), this means
--- 94,113 ----
  <a href=ftp://ftp.openbsd.org/pub/OpenBSD/patches/2.2/i386/f00f.patch>
  A kernel source-code patch is available</a>.
  <p>
! <li><font color=#009000><strong>FUNCTIONALITY FIX</strong></font><br>
! Some Linux binaries will execute in SVR4 emulation mode, which is
  definately a problem for people who need Linux emulation to work correctly.
  To solve this mis-identification problem,
  <a href=ftp://ftp.openbsd.org/pub/OpenBSD/patches/2.2/i386/compat_linux.patch>
! a patch file is provided</a>.
  <p>
! <li><font color=#009000><strong>RELIABILITY FIX</strong></font><br>
! APM can crash on machines without it.
  <a href=ftp://ftp.openbsd.org/pub/OpenBSD/patches/2.2/i386/apm.patch>
  A kernel source-code patch is available</a>.
  <p>
! <li><font color=#009000><strong>INSTALLATION PROCESS FLAW</strong></font><br>
! A few people are running into this problem, particularily if they had some
  other *BSD operating system on their machine before trying OpenBSD: if after
  installation onto an IDE-based machine, the kernel fails to mount the root
  partition because it thinks that it should be opening sd0 (0x400), this means
***************
*** 93,108 ****
  <a name=mac68k></a>
  <li><h3><font color=#e00000>mac68k</font></h3>
  <ul>
! <li>Unfortunately, X11 binaries for the mac68k did not manage to make it onto the
  CDROM.  However, X11 for the mac68k is immediately available from
  <a href="ftp://ftp.openbsd.org/pub/OpenBSD/2.2/mac68k/X11/X11R6.tar.gz">
  ftp://ftp.OpenBSD.org/pub/OpenBSD/2.2/mac68k/X11/X11R6.tar.gz</a>.  Please
  be sure to read the <a href="ftp://ftp.openbsd.org/pub/OpenBSD/2.2/mac68k/X11/README.X11">README file</a> also in that directory for instructions on installing
  and setting up X.
  <p>
! <li>As shipped on the CDROM, both the <a href="ftp://ftp.openbsd.org/pub/OpenBSD/2.2/mac68k/bsd-generic.tar.gz">generic kernel</a> and the
  <a href="ftp://ftp.openbsd.org/pub/OpenBSD/2.2/bsd-genericbsc.tar.gz">
! genericsbc kernel</a> extract themselves into the wrong place in the filesystem.
  Both <strong>should</strong> extract a kernel named <tt>/bsd</tt>, but they extract
  the kernel into <tt>/usr/src/sys/arch/mac68k/compile</tt> instead.
  <p>
--- 120,141 ----
  <a name=mac68k></a>
  <li><h3><font color=#e00000>mac68k</font></h3>
  <ul>
! <li><font color=#009000><strong>NEW SOFTWARE</strong></font><br>
! Unfortunately, X11 binaries for the mac68k did not manage to make it onto the
  CDROM.  However, X11 for the mac68k is immediately available from
  <a href="ftp://ftp.openbsd.org/pub/OpenBSD/2.2/mac68k/X11/X11R6.tar.gz">
  ftp://ftp.OpenBSD.org/pub/OpenBSD/2.2/mac68k/X11/X11R6.tar.gz</a>.  Please
  be sure to read the <a href="ftp://ftp.openbsd.org/pub/OpenBSD/2.2/mac68k/X11/README.X11">README file</a> also in that directory for instructions on installing
  and setting up X.
  <p>
! <li><font color=#009000><strong>INSTALLATION PROCESS FLAW</strong></font><br>
! As shipped on the CDROM, both the
! <a href="ftp://ftp.openbsd.org/pub/OpenBSD/2.2/mac68k/bsd-generic.tar.gz">
! generic kernel</a>
! and the
  <a href="ftp://ftp.openbsd.org/pub/OpenBSD/2.2/bsd-genericbsc.tar.gz">
! genericsbc kernel</a>
! extract themselves into the wrong place in the filesystem.
  Both <strong>should</strong> extract a kernel named <tt>/bsd</tt>, but they extract
  the kernel into <tt>/usr/src/sys/arch/mac68k/compile</tt> instead.
  <p>
***************
*** 121,186 ****
  <a name=sparc></a>
  <li><h3><font color=#e00000>sparc</font></h3>
  <ul>
! <li>Older 4/xxx systems (particularily the 4/300's) cannot boot
  with the 2.2 kernel due to bugs in the scsi device driver.
  <a href=ftp://ftp.OpenBSD.org/pub/OpenBSD/patches/2.2/sparc/esp.patch>
! A kernel source patch is available.</a>
  Replacement kernels are available for:
  <a href=ftp://ftp.OpenBSD.org/pub/OpenBSD/patches/2.2/sparc/bsd>bsd</a>,
  <a href=ftp://ftp.OpenBSD.org/pub/OpenBSD/patches/2.2/sparc/bsd.scsi3>bsd.scsi3</a>,
  and a replacement for bsd.rd is coming soon.
  <p>
  <a name=sparciommu></a>
! <li>SPARCstation 4 and 5 (Microsparc 2) users may see kernel panics when
  using a custom kernel configured for option sun4m only.
  <a href=ftp://ftp.OpenBSD.org/pub/OpenBSD/patches/2.2/sparc/sun4m.patch>
! A workaround (kernel source patch) is available.</a>  Apply the patch and
  then re-build your kernel.
  <p>
  </ul>
  <li><h3><font color=#e00000>amiga</font></h3>
  <p>
  <ul>
! <li>Missing Xamiga manual page.  Get
  <a href=ftp://ftp.openbsd.org/pub/OpenBSD/patches/2.2/amiga/Xamiga-manual.tgz>
  this package</a> and execute, <i>as root</i>:<br>
  <pre><b># </b>pkg_add Xamiga-manual.tgz</pre>
  The MD5 checksum of this package is:<br>
  <b>MD5 (Xamiga-manual.tgz) = 2362a7857264b9d17f65cca258b42031</b><p>
! <li>The Ariadne ethernet support was broken, there will be both binary and
  source level fixes available shortly.  If you are in a hurry mail
  <a href=mailto:niklas@openbsd.org>Niklas</a> for a test kernel.<p>
  </ul>
  <a name=pmax></a>
  <li><h3><font color=#e00000>pmax</font></h3>
  <ul>
! <li>There is a Year-1998 problem in the time-setting code (which causes the 
  date and time to be set incorrectly after a reboot in 1998).
  <a href=ftp://ftp.openbsd.org/pub/OpenBSD/patches/2.2/pmax/clock.patch>
! A source code patch file is available.</a> plus replacement installation
  kernels for the 2.2 release at
  <a href=ftp://ftp.openbsd.org/pub/OpenBSD/patches/2.2/pmax/bsd.NFS>bsd.NFS</a>,
  <a href=ftp://ftp.openbsd.org/pub/OpenBSD/patches/2.2/pmax/bsd>bsd</a>,
  <a href=ftp://ftp.openbsd.org/pub/OpenBSD/patches/2.2/pmax/bsd.rz0>bsd.rz0</a>.
  <p>
! <li>X11 support for the 3min and 3maxplus machines was broken
  due to a kernel bug.
  <a href=ftp://ftp.openbsd.org/pub/OpenBSD/patches/2.2/pmax/fb.patch>
  A source code patch is available</a>.
  <p>
! <li>A bug in the shared library linker <strong>ld.so</strong> requires that
  you replace it with a new binary.
  <a href=ftp://ftp.openbsd.org/pub/OpenBSD/patches/2.2//pmax/ld.so>
! The replacement binary is here.</a>
  <p>
  </ul>
  <a name=arc></a>
  <li><h3><font color=#e00000>arc</font></h3>
  <ul>
! <li>A bug in the shared library linker <strong>ld.so</strong> requires that
! you replace it with a new binary.
  <a href=ftp://ftp.openbsd.org/pub/OpenBSD/patches/2.2//pmax/ld.so>
! The replacement binary is here.</a>
  <p>
  </ul>
  <li><h3><font color=#e00000>alpha</font></h3>
--- 154,227 ----
  <a name=sparc></a>
  <li><h3><font color=#e00000>sparc</font></h3>
  <ul>
! <li><font color=#009000><strong>RELIABILITY FIX</strong></font><br>
! Older 4/xxx systems (particularily the 4/300's) cannot boot
  with the 2.2 kernel due to bugs in the scsi device driver.
  <a href=ftp://ftp.OpenBSD.org/pub/OpenBSD/patches/2.2/sparc/esp.patch>
! A kernel source patch is available</a>.
  Replacement kernels are available for:
  <a href=ftp://ftp.OpenBSD.org/pub/OpenBSD/patches/2.2/sparc/bsd>bsd</a>,
  <a href=ftp://ftp.OpenBSD.org/pub/OpenBSD/patches/2.2/sparc/bsd.scsi3>bsd.scsi3</a>,
  and a replacement for bsd.rd is coming soon.
  <p>
  <a name=sparciommu></a>
! <li><font color=#009000><strong>RELIABILITY FIX</strong></font><br>
! SPARCstation 4 and 5 (Microsparc 2) users may see kernel panics when
  using a custom kernel configured for option sun4m only.
  <a href=ftp://ftp.OpenBSD.org/pub/OpenBSD/patches/2.2/sparc/sun4m.patch>
! A workaround (kernel source patch) is available</a>.  Apply the patch and
  then re-build your kernel.
  <p>
  </ul>
  <li><h3><font color=#e00000>amiga</font></h3>
  <p>
  <ul>
! <li><font color=#009000><strong>FUNCTIONALITY FIX</strong></font><br>
! Missing Xamiga manual pages.  Get
  <a href=ftp://ftp.openbsd.org/pub/OpenBSD/patches/2.2/amiga/Xamiga-manual.tgz>
  this package</a> and execute, <i>as root</i>:<br>
  <pre><b># </b>pkg_add Xamiga-manual.tgz</pre>
  The MD5 checksum of this package is:<br>
  <b>MD5 (Xamiga-manual.tgz) = 2362a7857264b9d17f65cca258b42031</b><p>
! <li><font color=#009000><strong>FUNCTIONALITY FIX</strong></font><br>
! The Ariadne ethernet support was broken, there will be both binary and
  source level fixes available shortly.  If you are in a hurry mail
  <a href=mailto:niklas@openbsd.org>Niklas</a> for a test kernel.<p>
  </ul>
  <a name=pmax></a>
  <li><h3><font color=#e00000>pmax</font></h3>
  <ul>
! <li><font color=#009000><strong>FUNCTIONALITY FIX</strong></font><br>
! There is a Year-1998 problem in the time-setting code (which causes the 
  date and time to be set incorrectly after a reboot in 1998).
  <a href=ftp://ftp.openbsd.org/pub/OpenBSD/patches/2.2/pmax/clock.patch>
! A source code patch file is available</a> plus replacement installation
  kernels for the 2.2 release at
  <a href=ftp://ftp.openbsd.org/pub/OpenBSD/patches/2.2/pmax/bsd.NFS>bsd.NFS</a>,
  <a href=ftp://ftp.openbsd.org/pub/OpenBSD/patches/2.2/pmax/bsd>bsd</a>,
  <a href=ftp://ftp.openbsd.org/pub/OpenBSD/patches/2.2/pmax/bsd.rz0>bsd.rz0</a>.
  <p>
! <li><font color=#009000><strong>FUNCTIONALITY FIX</strong></font><br>
! X11 support for the 3min and 3maxplus machines was broken
  due to a kernel bug.
  <a href=ftp://ftp.openbsd.org/pub/OpenBSD/patches/2.2/pmax/fb.patch>
  A source code patch is available</a>.
  <p>
! <li><font color=#009000><strong>SECURITY FIX</strong></font><br>
! A security problem in the shared library linker <strong>ld.so</strong> requires that
  you replace it with a new binary.
  <a href=ftp://ftp.openbsd.org/pub/OpenBSD/patches/2.2//pmax/ld.so>
! The replacement binary is here</a>.
  <p>
  </ul>
  <a name=arc></a>
  <li><h3><font color=#e00000>arc</font></h3>
  <ul>
! <li><font color=#009000><strong>SECURITY FIX</strong></font><br>
! A security problem in the shared library linker <strong>ld.so</strong> requires
! that you replace it with a new binary.
  <a href=ftp://ftp.openbsd.org/pub/OpenBSD/patches/2.2//pmax/ld.so>
! The replacement binary is here</a>.
  <p>
  </ul>
  <li><h3><font color=#e00000>alpha</font></h3>
***************
*** 381,387 ****
  <hr>
  <a href=orders.html><img src=back.gif border=0 alt=OpenBSD></a> 
  <a href=mailto:www@openbsd.org>www@openbsd.org</a>
! <br><small>$OpenBSD: errata.html,v 1.71 1998/02/16 00:59:46 gene Exp $</small>
  
  </body>
  </html>
--- 422,428 ----
  <hr>
  <a href=orders.html><img src=back.gif border=0 alt=OpenBSD></a> 
  <a href=mailto:www@openbsd.org>www@openbsd.org</a>
! <br><small>$OpenBSD: errata.html,v 1.72 1998/02/19 10:42:30 deraadt Exp $</small>
  
  </body>
  </html>