[BACK]Return to errata22.html CVS log [TXT][DIR] Up to [local] / www

Diff for /www/errata22.html between version 1.40 and 1.41

version 1.40, 2003/10/24 22:12:40 version 1.41, 2003/11/21 16:55:15
Line 8 
Line 8 
 <meta name="keywords" content="openbsd,cd,errata">  <meta name="keywords" content="openbsd,cd,errata">
 <meta name="distribution" content="global">  <meta name="distribution" content="global">
 <meta name="copyright" content="This document copyright 1997-2001 by OpenBSD.">  <meta name="copyright" content="This document copyright 1997-2001 by OpenBSD.">
   <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
 </head>  </head>
   
 <BODY BGCOLOR="#FFFFFF" TEXT="#000000" LINK="#23238E">  <BODY BGCOLOR="#FFFFFF" TEXT="#000000" LINK="#23238E">
Line 47 
Line 48 
   
 <hr>  <hr>
   
 <dl>  <a name="all"></a>
 <a name=all></a>  <h3><font color="#e00000">All architectures</font></h3>
 <li><h3><font color="#e00000">All architectures</font></h3>  
 <ul>  <ul>
 <a name=ipsec></a>  <li><a name="ipsec"></a>
 <li><font color="#009000"><strong>SECURITY FIX</strong></font><br>  <font color="#009000"><strong>SECURITY FIX</strong></font><br>
 If IPSEC communication is attempted by starting photurisd(8) (which is  If IPSEC communication is attempted by starting photurisd(8) (which is
 disabled by default), a system crash may be evoked from remote if  disabled by default), a system crash may be evoked from remote if
 an attacker uses some classes of invalid packets.  an attacker uses some classes of invalid packets.
 <a href="ftp://ftp.openbsd.org/pub/OpenBSD/patches/2.2/common/ipsec.patch">  <a href="ftp://ftp.openbsd.org/pub/OpenBSD/patches/2.2/common/ipsec.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
 <a name=xterm-xaw></a>  <li><a name="xterm-xaw"></a>
 <li><font color="#009000"><strong>SECURITY FIX</strong></font><br>  <font color="#009000"><strong>SECURITY FIX</strong></font><br>
 As stated in CERT advisory VB-98.04, there are buffer  As stated in CERT advisory VB-98.04, there are buffer
 overrun problems in <strong>xterm</strong> related to the input-Method,  overrun problems in <strong>xterm</strong> related to the input-Method,
 preeditType, and *Keymap resources. Additional buffer overruns exist in  preeditType, and *Keymap resources. Additional buffer overruns exist in
Line 74 
Line 74 
 <a href="ftp://ftp.openbsd.org/pub/OpenBSD/patches/2.2/common/xterm-xaw.patch">  <a href="ftp://ftp.openbsd.org/pub/OpenBSD/patches/2.2/common/xterm-xaw.patch">
 We provide a version of this patch file specifically for the OpenBSD 2.2 tree</a>.  We provide a version of this patch file specifically for the OpenBSD 2.2 tree</a>.
 <p>  <p>
 <a name=rmjob></a>  <li><a name="rmjob"></a>
 <li><font color="#009000"><strong>SECURITY FIX</strong></font><br>  <font color="#009000"><strong>SECURITY FIX</strong></font><br>
 An exploitable buffer mismanagement exists in a subroutine used by  An exploitable buffer mismanagement exists in a subroutine used by
 lprm and lpd.  The problem is exploitable by users on a particular  lprm and lpd.  The problem is exploitable by users on a particular
 machine if there is an entry in <strong>/etc/printcap</strong> which  machine if there is an entry in <strong>/etc/printcap</strong> which
Line 83 
Line 83 
 <a href="ftp://ftp.openbsd.org/pub/OpenBSD/patches/2.2/common/rmjob.patch">  <a href="ftp://ftp.openbsd.org/pub/OpenBSD/patches/2.2/common/rmjob.patch">
 A patch is available which corrects this behaviour</a>.  A patch is available which corrects this behaviour</a>.
 <p>  <p>
 <a name=uucpd></a>  <li><a name="uucpd"></a>
 <li><font color="#009000"><strong>SECURITY FIX</strong></font><br>  <font color="#009000"><strong>SECURITY FIX</strong></font><br>
 A DNS-based vulnerability exists when uucpd is used.  By default uucpd  A DNS-based vulnerability exists when uucpd is used.  By default uucpd
 is not enabled in the OpenBSD releases, but some sites may have enabled it.  is not enabled in the OpenBSD releases, but some sites may have enabled it.
 <a href="ftp://ftp.openbsd.org/pub/OpenBSD/patches/2.2/common/uucpd.patch">  <a href="ftp://ftp.openbsd.org/pub/OpenBSD/patches/2.2/common/uucpd.patch">
 A patch is available which corrects this behaviour</a>.  A patch is available which corrects this behaviour</a>.
 <p>  <p>
 <a name=named></a>  <li><a name="named"></a>
 <li><font color="#009000"><strong>SECURITY FIX</strong></font><br>  <font color="#009000"><strong>SECURITY FIX</strong></font><br>
 A vulnerability exists when (and only when) /etc/named.conf has the  A vulnerability exists when (and only when) /etc/named.conf has the
 <strong>fake-iquery</strong> option enabled.  <strong>fake-iquery</strong> option enabled.
 <a href="ftp://ftp.openbsd.org/pub/OpenBSD/patches/2.2/common/named.patch">  <a href="ftp://ftp.openbsd.org/pub/OpenBSD/patches/2.2/common/named.patch">
 A patch is available which corrects this behaviour</a>.  A patch is available which corrects this behaviour</a>.
 <p>  <p>
 <a name=ping></a>  <li><a name="ping"></a>
 <li><font color="#009000"><strong>SECURITY FIX</strong></font><br>  <font color="#009000"><strong>SECURITY FIX</strong></font><br>
 A vulnerability exists in ping(8); if the -R option is used to record  A vulnerability exists in ping(8); if the -R option is used to record
 routes, an attacker can spoof a reply packet that will overflow inside  routes, an attacker can spoof a reply packet that will overflow inside
 ping.  Preliminary investigation makes it look the worst attack  ping.  Preliminary investigation makes it look the worst attack
Line 106 
Line 106 
 <a href="ftp://ftp.openbsd.org/pub/OpenBSD/patches/2.2/common/ping.patch">  <a href="ftp://ftp.openbsd.org/pub/OpenBSD/patches/2.2/common/ping.patch">
 A patch is available which corrects this behaviour</a>.  A patch is available which corrects this behaviour</a>.
 <p>  <p>
 <a name=sourceroute></a>  <li><a name="sourceroute"></a>
 <li><strong><font color="#009000">SECURITY FIX</font></strong><br>  <strong><font color="#009000">SECURITY FIX</font></strong><br>
 If the sysctl variable <strong>net.inet.ip.forwarding</strong> is  If the sysctl variable <strong>net.inet.ip.forwarding</strong> is
 enabled (value 1), but the variable <strong>net.inet.ip.sourceroute</strong>  enabled (value 1), but the variable <strong>net.inet.ip.sourceroute</strong>
 is disabled (value 0), the kernel will block source routed packets from  is disabled (value 0), the kernel will block source routed packets from
Line 118 
Line 118 
 <a href="ftp://ftp.openbsd.org/pub/OpenBSD/patches/2.2/common/sourceroute.patch">  <a href="ftp://ftp.openbsd.org/pub/OpenBSD/patches/2.2/common/sourceroute.patch">
 A kernel patch is provided</a>.  A kernel patch is provided</a>.
 <p>  <p>
 <a name=ruserok></a>  <li><a name="ruserok"></a>
 <li><font color="#009000"><strong>SECURITY FIX</strong></font><br>  <font color="#009000"><strong>SECURITY FIX</strong></font><br>
 A combination localhost+remote host security problem exists if a  A combination localhost+remote host security problem exists if a
 local user running a setuid binary causes a non-existent root .rhosts  local user running a setuid binary causes a non-existent root .rhosts
 file to be created via a symbolic link with a specific kind of corefile,  file to be created via a symbolic link with a specific kind of corefile,
Line 150 
Line 150 
 The problem with the ruserok() function appears to also exist in  The problem with the ruserok() function appears to also exist in
 ssh 1.2.21 and previous (the ssh people have been alerted).  ssh 1.2.21 and previous (the ssh people have been alerted).
 <p>  <p>
 <a name=mmap></a>  <li><a name="mmap"></a>
 <li><strong><font color="#009000">SECURITY FIX</font></strong><br>  <strong><font color="#009000">SECURITY FIX</font></strong><br>
 A bug in the vm system permits a file descriptor opened read-only on a  A bug in the vm system permits a file descriptor opened read-only on a
 device, to later on be mmap(2)'d read-write, and then modified.  This  device, to later on be mmap(2)'d read-write, and then modified.  This
 does not result in a security hole by itself, but it does violate the  does not result in a security hole by itself, but it does violate the
Line 171 
Line 171 
 <a href="ftp://ftp.openbsd.org/pub/OpenBSD/patches/2.2/common/readlink.c">  <a href="ftp://ftp.openbsd.org/pub/OpenBSD/patches/2.2/common/readlink.c">
 A replacement source file exists</a>.  A replacement source file exists</a>.
 <p>  <p>
 <a name=mountd></a>  <li><a name="mountd"></a>
 <li><font color="#009000"><strong>SECURITY FIX</strong></font><br>  <font color="#009000"><strong>SECURITY FIX</strong></font><br>
 If a line in /etc/exports which contains hostnames results in an empty  If a line in /etc/exports which contains hostnames results in an empty
 list because none of the supplied hostnames is known, mountd(8) will  list because none of the supplied hostnames is known, mountd(8) will
 accidentally export the filesystem to the world.  accidentally export the filesystem to the world.
Line 186 
Line 186 
 A patch</a> to return EINVAL in this case is available.  A patch</a> to return EINVAL in this case is available.
 <p>  <p>
 </ul>  </ul>
 <a name=i386></a>  <a name="i386"></a>
 <li><h3><font color="#e00000">i386</font></h3>  <h3><font color="#e00000">i386</font></h3>
 <ul>  <ul>
 <a name=f00f></a>  <li><a name="f00f"></a>
 <li><font color="#009000"><strong>RELIABILITY FIX</strong></font><br>  <font color="#009000"><strong>RELIABILITY FIX</strong></font><br>
 The Intel P5 F00F bug was discovered after the CDRs had already been  The Intel P5 F00F bug was discovered after the CDRs had already been
 sent to the manufacturer.  This problem permits any user who has an account  sent to the manufacturer.  This problem permits any user who has an account
 to lock your machine up using a 4-line program.  The problem only affects  to lock your machine up using a 4-line program.  The problem only affects
Line 222 
Line 222 
 "edit" command ensure the type field is set to "ST506".  "edit" command ensure the type field is set to "ST506".
 <p>  <p>
 </ul>  </ul>
 <a name=mac68k></a>  <a name="mac68k"></a>
 <li><h3><font color="#e00000">mac68k</font></h3>  <h3><font color="#e00000">mac68k</font></h3>
 <ul>  <ul>
 <li><font color="#009000"><strong>NEW SOFTWARE</strong></font><br>  <li><font color="#009000"><strong>NEW SOFTWARE</strong></font><br>
 Unfortunately, X11 binaries for the mac68k did not manage to make it onto the  Unfortunately, X11 binaries for the mac68k did not manage to make it onto the
Line 256 
Line 256 
 with the Installer and use the mini-shell to move the binary from <tt>/usr/src/...</tt> to <tt>/bsd</tt>.  with the Installer and use the mini-shell to move the binary from <tt>/usr/src/...</tt> to <tt>/bsd</tt>.
 <p>  <p>
 </ul>  </ul>
 <a name=sparc></a>  <a name="sparc"></a>
 <li><h3><font color="#e00000">sparc</font></h3>  <h3><font color="#e00000">sparc</font></h3>
 <ul>  <ul>
 <li><font color="#009000"><strong>RELIABILITY FIX</strong></font><br>  <li><font color="#009000"><strong>RELIABILITY FIX</strong></font><br>
 Older 4/xxx systems (particularly the 4/300's) cannot boot  Older 4/xxx systems (particularly the 4/300's) cannot boot
Line 269 
Line 269 
 <a href="ftp://ftp.OpenBSD.org/pub/OpenBSD/patches/2.2/sparc/bsd.scsi3">bsd.scsi3</a>,  <a href="ftp://ftp.OpenBSD.org/pub/OpenBSD/patches/2.2/sparc/bsd.scsi3">bsd.scsi3</a>,
 and a replacement for bsd.rd is coming soon.  and a replacement for bsd.rd is coming soon.
 <p>  <p>
 <a name=sparciommu></a>  <li><a name="sparciommu"></a>
 <li><font color="#009000"><strong>RELIABILITY FIX</strong></font><br>  <font color="#009000"><strong>RELIABILITY FIX</strong></font><br>
 SPARCstation 4 and 5 (Microsparc 2) users may see kernel panics when  SPARCstation 4 and 5 (Microsparc 2) users may see kernel panics when
 using a custom kernel configured for option sun4m only.  using a custom kernel configured for option sun4m only.
 <a href="ftp://ftp.OpenBSD.org/pub/OpenBSD/patches/2.2/sparc/sun4m.patch">  <a href="ftp://ftp.OpenBSD.org/pub/OpenBSD/patches/2.2/sparc/sun4m.patch">
Line 278 
Line 278 
 then re-build your kernel.  then re-build your kernel.
 <p>  <p>
 </ul>  </ul>
 <li><h3><font color="#e00000">amiga</font></h3>  <h3><font color="#e00000">amiga</font></h3>
 <p>  <p>
 <ul>  <ul>
 <li><font color="#009000"><strong>FUNCTIONALITY FIX</strong></font><br>  <li><font color="#009000"><strong>FUNCTIONALITY FIX</strong></font><br>
Line 293 
Line 293 
 source level fixes available shortly.  If you are in a hurry mail  source level fixes available shortly.  If you are in a hurry mail
 <a href="mailto:niklas@openbsd.org">Niklas</a> for a test kernel.<p>  <a href="mailto:niklas@openbsd.org">Niklas</a> for a test kernel.<p>
 </ul>  </ul>
 <a name=pmax></a>  <a name="pmax"></a>
 <li><h3><font color="#e00000">pmax</font></h3>  <h3><font color="#e00000">pmax</font></h3>
 <ul>  <ul>
 <li><font color="#009000"><strong>FUNCTIONALITY FIX</strong></font><br>  <li><font color="#009000"><strong>FUNCTIONALITY FIX</strong></font><br>
 There is a Year-1998 problem in the time-setting code (which causes the  There is a Year-1998 problem in the time-setting code (which causes the
Line 312 
Line 312 
 <a href="ftp://ftp.openbsd.org/pub/OpenBSD/patches/2.2/pmax/fb.patch">  <a href="ftp://ftp.openbsd.org/pub/OpenBSD/patches/2.2/pmax/fb.patch">
 A source code patch is available</a>.  A source code patch is available</a>.
 <p>  <p>
 <a name=ldso></a>  <li><a name="ldso"></a>
 <li><font color="#009000"><strong>SECURITY FIX</strong></font><br>  <font color="#009000"><strong>SECURITY FIX</strong></font><br>
 A security problem in the shared library linker <strong>ld.so</strong>  A security problem in the shared library linker <strong>ld.so</strong>
 requires that you replace it with a new binary.  The following binary  requires that you replace it with a new binary.  The following binary
 will work on both pmax and arc machines.  will work on both pmax and arc machines.
Line 321 
Line 321 
 The replacement binary is here</a>.  The replacement binary is here</a>.
 <p>  <p>
 </ul>  </ul>
 <a name=arc></a>  <a name="arc"></a>
 <li><h3><font color="#e00000">arc</font></h3>  <h3><font color="#e00000">arc</font></h3>
 <ul>  <ul>
 <li><font color="#009000"><strong>SECURITY FIX</strong></font><br>  <li><font color="#009000"><strong>SECURITY FIX</strong></font><br>
 A security problem in the shared library linker <strong>ld.so</strong> requires  A security problem in the shared library linker <strong>ld.so</strong> requires
Line 332 
Line 332 
 The replacement binary is here</a>.  The replacement binary is here</a>.
 <p>  <p>
 </ul>  </ul>
 <li><h3><font color="#e00000">alpha</font></h3>  <h3><font color="#e00000">alpha</font></h3>
 <p>  <p>
 <ul>  <ul>
 <li><font color="#009000"><strong>MISSING FUNCTIONALITY</strong></font><br>  <li><font color="#009000"><strong>MISSING FUNCTIONALITY</strong></font><br>
Line 341 
Line 341 
 in a snapshot.  There is no patch for 2.2.  in a snapshot.  There is no patch for 2.2.
 <p>  <p>
 </ul>  </ul>
 <li><h3><font color="#e00000">hp300</font></h3>  <h3><font color="#e00000">hp300</font></h3>
 <p>  <p>
 <ul>  <ul>
 <li>No problems identified yet.  <li>No problems identified yet.
 <p>  <p>
 </ul>  </ul>
 <li><h3><font color="#e00000">mvme68k</font></h3>  <h3><font color="#e00000">mvme68k</font></h3>
 <ul>  <ul>
 <li>No problems identified yet.  <li>No problems identified yet.
 <p>  <p>
 </ul>  </ul>
   
 </dl>  
 <br>  <br>
   
 <hr>  <hr>
Legend:
Removed from v.1.40  
changed lines
  Added in v.1.41