=================================================================== RCS file: /cvsrepo/anoncvs/cvs/www/errata22.html,v retrieving revision 1.40 retrieving revision 1.41 diff -c -r1.40 -r1.41 *** www/errata22.html 2003/10/24 22:12:40 1.40 --- www/errata22.html 2003/11/21 16:55:15 1.41 *************** *** 8,13 **** --- 8,14 ---- + *************** *** 47,66 ****

! !

All architectures

SECURITY FIX
If IPSEC communication is attempted by starting photurisd(8) (which is disabled by default), a system crash may be evoked from remote if an attacker uses some classes of invalid packets. A source code patch exists which remedies this problem.
! !
SECURITY FIX
As stated in CERT advisory VB-98.04, there are buffer overrun problems in xterm related to the input-Method, preeditType, and *Keymap resources. Additional buffer overruns exist in --- 48,66 ----
! !
All architectures
- ! SECURITY FIX
  If IPSEC communication is attempted by starting photurisd(8) (which is disabled by default), a system crash may be evoked from remote if an attacker uses some classes of invalid packets. A source code patch exists which remedies this problem.
  !
- ! SECURITY FIX
  As stated in CERT advisory VB-98.04, there are buffer overrun problems in xterm related to the input-Method, preeditType, and *Keymap resources. Additional buffer overruns exist in *************** *** 74,81 **** We provide a version of this patch file specifically for the OpenBSD 2.2 tree.
  ! !
- SECURITY FIX
  An exploitable buffer mismanagement exists in a subroutine used by lprm and lpd. The problem is exploitable by users on a particular machine if there is an entry in /etc/printcap which --- 74,81 ---- We provide a version of this patch file specifically for the OpenBSD 2.2 tree.
  !
- ! SECURITY FIX
  An exploitable buffer mismanagement exists in a subroutine used by lprm and lpd. The problem is exploitable by users on a particular machine if there is an entry in /etc/printcap which *************** *** 83,104 **** A patch is available which corrects this behaviour.
  ! !
- SECURITY FIX
  A DNS-based vulnerability exists when uucpd is used. By default uucpd is not enabled in the OpenBSD releases, but some sites may have enabled it. A patch is available which corrects this behaviour.
  ! !
- SECURITY FIX
  A vulnerability exists when (and only when) /etc/named.conf has the fake-iquery option enabled. A patch is available which corrects this behaviour.
  ! !
- SECURITY FIX
  A vulnerability exists in ping(8); if the -R option is used to record routes, an attacker can spoof a reply packet that will overflow inside ping. Preliminary investigation makes it look the worst attack --- 83,104 ---- A patch is available which corrects this behaviour.
  !
- ! SECURITY FIX
  A DNS-based vulnerability exists when uucpd is used. By default uucpd is not enabled in the OpenBSD releases, but some sites may have enabled it. A patch is available which corrects this behaviour.
  !
- ! SECURITY FIX
  A vulnerability exists when (and only when) /etc/named.conf has the fake-iquery option enabled. A patch is available which corrects this behaviour.
  !
- ! SECURITY FIX
  A vulnerability exists in ping(8); if the -R option is used to record routes, an attacker can spoof a reply packet that will overflow inside ping. Preliminary investigation makes it look the worst attack *************** *** 106,113 **** A patch is available which corrects this behaviour.
  ! !
- SECURITY FIX
  If the sysctl variable net.inet.ip.forwarding is enabled (value 1), but the variable net.inet.ip.sourceroute is disabled (value 0), the kernel will block source routed packets from --- 106,113 ---- A patch is available which corrects this behaviour.
  !
- ! SECURITY FIX
  If the sysctl variable net.inet.ip.forwarding is enabled (value 1), but the variable net.inet.ip.sourceroute is disabled (value 0), the kernel will block source routed packets from *************** *** 118,125 **** A kernel patch is provided.
  ! !
- SECURITY FIX
  A combination localhost+remote host security problem exists if a local user running a setuid binary causes a non-existent root .rhosts file to be created via a symbolic link with a specific kind of corefile, --- 118,125 ---- A kernel patch is provided.
  !
- ! SECURITY FIX
  A combination localhost+remote host security problem exists if a local user running a setuid binary causes a non-existent root .rhosts file to be created via a symbolic link with a specific kind of corefile, *************** *** 150,157 **** The problem with the ruserok() function appears to also exist in ssh 1.2.21 and previous (the ssh people have been alerted).
  ! !
- SECURITY FIX
  A bug in the vm system permits a file descriptor opened read-only on a device, to later on be mmap(2)'d read-write, and then modified. This does not result in a security hole by itself, but it does violate the --- 150,157 ---- The problem with the ruserok() function appears to also exist in ssh 1.2.21 and previous (the ssh people have been alerted).
  !
- ! SECURITY FIX
  A bug in the vm system permits a file descriptor opened read-only on a device, to later on be mmap(2)'d read-write, and then modified. This does not result in a security hole by itself, but it does violate the *************** *** 171,178 **** A replacement source file exists.
  ! !
- SECURITY FIX
  If a line in /etc/exports which contains hostnames results in an empty list because none of the supplied hostnames is known, mountd(8) will accidentally export the filesystem to the world. --- 171,178 ---- A replacement source file exists.
  !
- ! SECURITY FIX
  If a line in /etc/exports which contains hostnames results in an empty list because none of the supplied hostnames is known, mountd(8) will accidentally export the filesystem to the world. *************** *** 186,196 **** A patch to return EINVAL in this case is available.
! !
i386
- RELIABILITY FIX
  The Intel P5 F00F bug was discovered after the CDRs had already been sent to the manufacturer. This problem permits any user who has an account to lock your machine up using a 4-line program. The problem only affects --- 186,196 ---- A patch to return EINVAL in this case is available.
! !
i386
- ! RELIABILITY FIX
  The Intel P5 F00F bug was discovered after the CDRs had already been sent to the manufacturer. This problem permits any user who has an account to lock your machine up using a 4-line program. The problem only affects *************** *** 222,229 **** "edit" command ensure the type field is set to "ST506".
! !
mac68k
- NEW SOFTWARE
  Unfortunately, X11 binaries for the mac68k did not manage to make it onto the --- 222,229 ---- "edit" command ensure the type field is set to "ST506".
! !
mac68k
- NEW SOFTWARE
  Unfortunately, X11 binaries for the mac68k did not manage to make it onto the *************** *** 256,263 **** with the Installer and use the mini-shell to move the binary from /usr/src/... to /bsd.
! !
sparc
- RELIABILITY FIX
  Older 4/xxx systems (particularly the 4/300's) cannot boot --- 256,263 ---- with the Installer and use the mini-shell to move the binary from /usr/src/... to /bsd.
! !
sparc
- RELIABILITY FIX
  Older 4/xxx systems (particularly the 4/300's) cannot boot *************** *** 269,276 **** bsd.scsi3, and a replacement for bsd.rd is coming soon.
  ! !
- RELIABILITY FIX
  SPARCstation 4 and 5 (Microsparc 2) users may see kernel panics when using a custom kernel configured for option sun4m only. --- 269,276 ---- bsd.scsi3, and a replacement for bsd.rd is coming soon.
  !
- ! RELIABILITY FIX
  SPARCstation 4 and 5 (Microsparc 2) users may see kernel panics when using a custom kernel configured for option sun4m only. *************** *** 278,284 **** then re-build your kernel.
!
amiga
- FUNCTIONALITY FIX
  --- 278,284 ---- then re-build your kernel.
!
amiga
- FUNCTIONALITY FIX
  *************** *** 293,300 **** source level fixes available shortly. If you are in a hurry mail Niklas for a test kernel.
! !
pmax
- FUNCTIONALITY FIX
  There is a Year-1998 problem in the time-setting code (which causes the --- 293,300 ---- source level fixes available shortly. If you are in a hurry mail Niklas for a test kernel.
! !
pmax
- FUNCTIONALITY FIX
  There is a Year-1998 problem in the time-setting code (which causes the *************** *** 312,319 **** A source code patch is available.
  ! !
- SECURITY FIX
  A security problem in the shared library linker ld.so requires that you replace it with a new binary. The following binary will work on both pmax and arc machines. --- 312,319 ---- A source code patch is available.
  !
- ! SECURITY FIX
  A security problem in the shared library linker ld.so requires that you replace it with a new binary. The following binary will work on both pmax and arc machines. *************** *** 321,328 **** The replacement binary is here.
! !
arc
- SECURITY FIX
  A security problem in the shared library linker ld.so requires --- 321,328 ---- The replacement binary is here.
! !
arc
- SECURITY FIX
  A security problem in the shared library linker ld.so requires *************** *** 332,338 **** The replacement binary is here.
!
alpha
- MISSING FUNCTIONALITY
  --- 332,338 ---- The replacement binary is here.
!
alpha
- MISSING FUNCTIONALITY
  *************** *** 341,359 **** in a snapshot. There is no patch for 2.2.
!
hp300
- No problems identified yet.
!
mvme68k
- No problems identified yet.
-

--- 341,358 ---- in a snapshot. There is no patch for 2.2.

hp300

No problems identified yet.

mvme68k

No problems identified yet.

*************** *** 378,384 ****

www@openbsd.org !
$OpenBSD: errata22.html,v 1.40 2003/10/24 22:12:40 david Exp $ --- 377,383 ----

www@openbsd.org !
$OpenBSD: errata22.html,v 1.41 2003/11/21 16:55:15 henning Exp $

All architectures

All architectures

i386

i386

mac68k

mac68k

sparc

sparc

amiga

amiga

pmax

pmax

arc

arc

alpha

alpha

hp300

mvme68k

hp300

mvme68k