[BACK]Return to errata26.html CVS log [TXT][DIR] Up to [local] / www

Diff for /www/errata26.html between version 1.1 and 1.2

version 1.1, 2000/05/19 20:04:53 version 1.2, 2000/05/25 07:36:21
Line 37 
Line 37 
 <a name=all></a>  <a name=all></a>
 <li><h3><font color=#e00000>All architectures</font></h3>  <li><h3><font color=#e00000>All architectures</font></h3>
 <ul>  <ul>
   <a name=xlockmore></a>
   <li><font color=#009000><strong>022: SECURITY FIX: May 25, 2000</strong></font><br>
   xlockmore has a localhost attack against it which allows recovery of the encrypted
   hash of the root password.  The damage to systems using DES passwords from this
   attack is pretty heavy, but to systems with a well-chosen root password under
   blowfish encoding
   (see <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=crypt&sektion=3">
   crypt(3)</a>)
   the impact is much reduced.<br>
   (Aside:  We do not consider this a localhost root hole in the default install,
   since we have not seen a fast blowfish cracker yet ;-)<br>
   <a href=ftp://ftp.openbsd.org/pub/OpenBSD/patches/2.6/common/022_syslog.patch>
   A source code patch exists, which remedies this problem.</a>
   <p>
 <a name=rzsz></a>  <a name=rzsz></a>
 <li><font color=#009000><strong>021: RZSZ SNOOPING: Jan 31, 2000</strong></font><br>  <li><font color=#009000><strong>021: RZSZ SNOOPING: Jan 31, 2000</strong></font><br>
 The rzsz port was removed from the ports collection, as it collects and  The rzsz port was removed from the ports collection, as it collects and
Legend:
Removed from v.1.1  
changed lines
  Added in v.1.2