[BACK]Return to errata27.html CVS log [TXT][DIR] Up to [local] / www

Diff for /www/errata27.html between version 1.95 and 1.96

version 1.95, 2019/05/27 22:55:19 version 1.96, 2019/05/28 16:32:41
Line 84 
Line 84 
 <hr>  <hr>
   
 <ul>  <ul>
 <li id="readline">  
 <strong>040: SECURITY FIX: Mar 18, 2001</strong>  <li id="ipf">
   <strong>001: SECURITY FIX: May 25, 2000</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 The readline library shipped with OpenBSD allows history files creation  A misuse of ipf(8)
 with a permissive  <i>keep-state</i> rules can result in firewall rules being bypassed.<br>
 <a href="https://man.openbsd.org/OpenBSD-2.7/umask.2">umask(2)</a>.  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/2.7/common/001_ipf.patch">
 This can lead to the leakage of sensitive information in applications  
 that use passwords and the like during user interaction (one such  
 application is mysql).  Additionally, if the HOME environment variable  
 is not set, the current working directory is used; this patch disables  
 the history file if HOME is not set.<br>  
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/2.7/common/040_readline.patch">  
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
   It updates ipf to version 3.3.16.
 <p>  <p>
 <li id="sudo">  
 <strong>039: SECURITY FIX: Feb 22, 2001</strong>  <li id="ef">
   <strong>002: DRIVER FIX: May 26, 2000</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 There is an exploitable heap corruption bug in  The
 <a href="https://man.openbsd.org/OpenBSD-2.7/sudo.8">sudo</a>.  <a href="https://man.openbsd.org/OpenBSD-2.7/ef.4">ef(4)</a>
 <br>  driver will complain when adding an address with ifconfig
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/2.7/common/038_named.patch">  (ifconfig: SIOCAIFADDR: Invalid argument).<br>
   <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/2.7/common/002_ef.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
 <li id="ftpd">  
 <strong>037: SECURITY FIX: Dec 4, 2000</strong>  <li id="bridge">
   <strong>003: SECURITY FIX: May 26, 2000</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 OpenBSD 2.7's ftpd contains a one-byte overflow in the replydirname() function.<br>  It is possible to bypass the <i>learning</i> flag on an interface if frames
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/2.7/common/037_ftpd.patch">  go directly to the machine acting as a
   <a href="https://man.openbsd.org/OpenBSD-2.7/bridge.4">bridge</a>.
   <br>
   <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/2.7/common/003_bridge.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
 <li id="qe">  
 <strong>036: RELIABILITY FIX: Nov 17, 2000</strong><br>  <li id="route">
 Configuring a qec+qe causes a NMI panic.<br>  <strong>004: RELIABILITY FIX: May 29, 2000</strong>
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/2.7/sparc/036_qe.patch">  &nbsp; <i>All architectures</i><br>
   Certain routing table modifications by the superuser could cause a system panic.
   <br>
   <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/2.7/common/004_route.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
 <li id="sshforwarding">  
 <strong>035: SECURITY FIX: Nov 10, 2000</strong>  <li id="ipopts">
   <strong>005: RELIABILITY FIX: May 29, 2000</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 Hostile servers can force OpenSSH clients to do agent or X11 forwarding.  Parse IPv4 options more carefully.  It is not yet clear if this can even be used
 This problem is fixed as of OpenSSH 2.3.0.<br>  to crash the machine remote or locally.
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/2.7/common/035_sshforwarding.patch">  <br>
   <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/2.7/common/005_ipopts.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
 <li id="zsconsole">  
 <strong>034: RELIABILITY FIX: Nov 10, 2000</strong><br>  <li id="uselogin">
 When running a sparc with a serial console, certain types of interrupts would  <strong>006: SECURITY FIX: June 6, 2000</strong>
 cause great grief.<br>  &nbsp; <i>All architectures</i><br>
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/2.7/sparc/034_zsconsole.patch">  The non-default UseLogin feature in <b>/etc/sshd_config</b> is broken and should not
 A source code patch exists which remedies this problem.</a>  be used.  On other operating systems, it results in a hole.<br>
   Avoid use of this feature, or update to OpenSSH 2.1.1 or later if you must use it.
 <p>  <p>
 <li id="execsubr">  
 <strong>033: RELIABILITY FIX: Nov 6, 2000</strong>  <li id="cd9660">
   <strong>007: RELIABILITY FIX: June 8, 2000</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 Invalid fields in the exec header could cause a crash.<br>  NFS exporting of CD filesystems caused a system panic.
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/2.7/common/033_execsubr.patch">  <br>
   <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/2.7/common/007_cd9660.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
 <li id="xtrans">  
 <strong>032: SECURITY FIX: Oct 26, 2000</strong>  <li id="msdosfs">
   <strong>008: RELIABILITY FIX: June 8, 2000</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 There are two possibly exploitable potential buffer overflows in the X11  Some operations in msdosfs could result in a system panic.
 libraries using the xtrans code. One of these vulnerabilities was  
 reported to the  
 <a href="http://www.securityfocus.com/archive/1/139436">BUGTRAQ</a>  
 mailing list.  
 <br>  <br>
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/2.7/common/032_xtrans.patch">  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/2.7/common/008_msdosfs.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
 <li id="httpd">  
 <strong>031: SECURITY FIX: Oct 18, 2000</strong>  <li id="isakmpd">
   <strong>009: SECURITY FIX: June 9, 2000</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 Apache has several bugs in <code>mod_rewrite</code> and <code>mod_vhost_alias</code>  A serious bug in isakmpd(8) policy handling wherein policy
 that could cause arbitrary files accessible to the www user on the server  verification could be completely bypassed in isakmpd.
 to be exposed under certain configurations when these modules are used.  
 (These modules are not active by default).  
 <br>  <br>
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/2.7/common/031_httpd.patch">  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/2.7/common/009_isakmpd.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
 <li id="telnetd">  
 <strong>030: SECURITY FIX: Oct 10, 2000</strong>  <li id="amiga_cd">
 &nbsp; <i>All architectures</i><br>  <strong>010: CD DISTRIBUTION ERROR: June 15, 2000</strong><br>
 The telnet daemon does not strip out the TERMINFO, TERMINFO_DIRS, TERMPATH  On the 2.7 CD media, the <b>amiga</b> distribution contains two pairs of archives
 and TERMCAP (when it starts with a '/') environment variables.  files for installation, ie:
   <pre>
   -rw-r--r--  1 root  mirftp  20191465 Apr 29 14:27 base27.tar.gz
   -rw-r--r--  1 root  mirftp  20291753 May 13 19:33 base27.tgz
   -rw-r--r--  1 root  mirftp  13699507 Apr 29 14:26 comp27.tar.gz
   -rw-r--r--  1 root  mirftp  13748096 May 13 19:33 comp27.tgz
   -rw-r--r--  1 root  mirftp   1005376 Apr 29 14:26 etc27.tar.gz
   -rw-r--r--  1 root  mirftp   1010772 May 13 19:33 etc27.tgz
   -rw-r--r--  1 root  mirftp   2755567 Apr 29 14:26 game27.tar.gz
   -rw-r--r--  1 root  mirftp   2755624 May 13 19:33 game27.tgz
   -rw-r--r--  1 root  mirftp   5002872 Apr 29 14:26 man27.tar.gz
   -rw-r--r--  1 root  mirftp   5038896 May 13 19:33 man27.tgz
   -rw-r--r--  1 root  mirftp   1684356 Apr 29 14:26 misc27.tar.gz
   -rw-r--r--  1 root  mirftp   1684381 May 13 19:33 misc27.tgz
   </pre>
   The installation script will list ALL of these files.  For proper
   operation one should install the <b>*.tgz</b> versions, and deselect
   the <b>*.tar.gz</b> versions.<br>
   The FTP area sets do not suffer from this problem.
   <p>
   
   <li id="if_an">
   <strong>011: DRIVER BUG: June 17, 2000</strong><br>
   The <a href="https://man.openbsd.org/OpenBSD-2.7/an.4">an(4)</a>
   Aironet Communications 4500/4800 IEEE 802.11DS driver has a bug which prevents
   <a href="https://man.openbsd.org/OpenBSD-2.7/ancontrol.8">ancontrol(8)</a> from working correctly, instead causing a panic.
 <br>  <br>
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/2.7/common/030_telnetd.patch">  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/2.7/i386/011_an.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
 <li id="sendmail">  
 <strong>029: RELIABILITY FIX: Oct 9, 2000</strong>  <li id="dhclient">
   <strong>012: SECURITY FIX: June 24, 2000</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 There is a non-exploitable buffer overflow in sendmail's test mode.  A serious bug in dhclient(8) could allow strings from a malicious dhcp
   server to be executed in the shell as root.
 <br>  <br>
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/2.7/common/029_sendmail.patch">  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/2.7/common/012_dhclient.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
 <li id="format_strings">  
 <strong>028: SECURITY FIX: Oct 6, 2000</strong>  <li id="libedit">
   <strong>013: SECURITY FIX: June 28, 2000</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 There are printf-style format string bugs in several privileged programs.  libedit would check for a <b>.editrc</b> file in the current directory.
   That behaviour is not nice; this does not turn into a security problem in
   any real world situation that we know of, but a patch is available anyways.
 <br>  <br>
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/2.7/common/028_format_strings.patch">  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/2.7/common/013_libedit.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
 <li id="curses">  
 <strong>027: SECURITY FIX: Oct 6, 2000</strong>  <li id="pcvt">
 &nbsp; <i>All architectures</i><br>  <strong>014: DRIVER BUG: June 30, 2000</strong><br>
 libcurses honored terminal descriptions in the $HOME/.terminfo directory  The PC console driver (PCVT) has two bugs. Display problems can result if
 as well as in the TERMCAP environment variable for setuid and setgid  reverse video mode is turned on or off twice in a row. This patch also
 applications.  fixes a problem with scrolling region handling that has been seen by many
   users trying to use the BitchX irc client with the screen program.<br>
 <br>  <br>
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/2.7/common/027_curses.patch">  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/2.7/i386/014_pcvt.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
   This is the second revision of the patch.
 <p>  <p>
 <li id="talkd">  
 <strong>026: SECURITY FIX: Oct 6, 2000</strong>  <li id="ste">
 &nbsp; <i>All architectures</i><br>  <strong>015: DRIVER BUG: June 30, 2000</strong><br>
 A format string vulnerability exists in talkd(8).  It is not clear  The <a href="https://man.openbsd.org/OpenBSD-2.7/ste.4">ste(4)</a>
 yet what the impact is.  driver supporting Ethernet cards based on the Sundance ST201 chipset
   (i.e., the D-Link 550TX) has a bug which causes the machine to panic at
   boot-time.
 <br>  <br>
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/2.7/common/026_talkd.patch">  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/2.7/i386/015_ste.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
 <li id="pw_error">  
 <strong>025: SECURITY FIX: Oct 3, 2000</strong>  <li id="xlhash">
   <strong>016: DRIVER BUG: July 2, 2000</strong><br>
   The <a href="https://man.openbsd.org/OpenBSD-2.7/xl.4">xl(4)</a>
   driver supporting various 3com cards, had a bug which prevented the multicast
   filter from working correctly on the 3c905B, thus preventing many IPv6 things
   from working.
   <br>
   <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/2.7/i386/016_xlhash.patch">
   A source code patch exists which remedies this problem.</a>
   <p>
   
   <li id="screen">
   <strong>017: INSTALLATION FIX: July 3, 2000</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 A format string vulnerability exists in the pw_error(3) function.  This  The screen package shipped with 2.7 does not install itself properly.  The
 manifests itself as a security hole in the chpass utility.  As a workaround  existing package in 2.7/packages/_ARCH_/screen-3.9.5.tgz has been renamed to
 which disables its functionality, do  screen-3.9.5.tgz.old and a replacement package has been provided under the
 <pre>  name screen-3.9.5p1.tgz.
 # chmod u-s /usr/bin/chpass  <br>
 </pre>  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/2.7/ports/017_screen.patch">
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/2.7/common/025_pw_error.patch">  
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
 <li id="ipsec">  
 <strong>024: SECURITY FIX: Sep 18, 2000</strong>  <li id="mopd">
   <strong>018: SECURITY FIX: July 5, 2000</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 Bad ESP/AH packets could cause a crash under certain conditions.  Mopd contained a buffer overflow.
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/2.7/common/024_ipsec.patch"><br>  <br>
   <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/2.7/common/018_mopd.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
 <li id="xlock">  
 <strong>023: SECURITY FIX: Aug 16, 2000</strong>  <li id="ftpd2">
   <strong>019: SECURITY FIX: July 5, 2000</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 A format string vulnerability exists in xlock. As a workaround which disables  Just like pretty much all the other unix ftp daemons on the planet,
 its functionality, do  ftpd had a remote root hole in it.  Luckily, ftpd was not enabled by default.
 <pre>  The problem exists if anonymous ftp is enabled.
 # chmod u-s /usr/X11R6/bin/xlock  <br>
 </pre>  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/2.7/common/019_ftpd.patch">
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/2.7/common/023_xlock.patch">  
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
 <li id="mac68k_arandom">  
 <strong>022: INSTALLATION FIX: July 14, 2000</strong>  <li id="pmax_msgbuf">
   <strong>020: KERNEL BUG: July 10, 2000</strong><br>
   As originally shipped, the pmax port would fail to install due to
   <b>/kern/msgbuf</b> bugs.<br>
   The necessary fixes have been merged,
   and the binaries needed re-released on the FTP site.<br>
   However, the 2.7 <b>srcsys.tar.gz</b> file has not been updated.<br>
   If you recompile a kernel, you should use either the
   <a href=stable.html>stable release source tree</a> or apply the
   provided patch to a 2.7 source tree.
 <br>  <br>
 The MacOS installer shipped with OpenBSD 2.7 does not correctly make all  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/2.7/pmax/020_pmax_msgbuf.patch">
 devices, specifically it does not make the <code>/dev/arandom</code> device  A source code patch exists which remedies this problem.</a>
 needed for the userland crypto such as ssh to work.  The problem shows itself  
 when ssh-keygen fails to make RSA or DSA keys, resulting in messages like  
 <b>RSA-generate_keys failed</b> or <b>DSA-generate_keys failed</b>.  
 <br>  
 To work around this, once your machine is up and running run the following  
 commands as root:  
 <pre>  
 # cd /dev  
 # ./MAKEDEV arandom  
 </pre>  
 <p>  <p>
 After doing this (and possibly installing one of the ssl27 packages),  
 reboot your machine and it will generate ssh keys correctly.  
 <p>  
 <li id="X11_libs">  <li id="X11_libs">
 <strong>021: SECURITY FIX: July 14, 2000</strong>  <strong>021: SECURITY FIX: July 14, 2000</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
Line 290 
Line 340 
 ignore the build error.   The whatis database will be rebuilt the next  ignore the build error.   The whatis database will be rebuilt the next
 time /etc/weekly runs.  time /etc/weekly runs.
 <p>  <p>
 <li id="pmax_msgbuf">  
 <strong>020: KERNEL BUG: July 10, 2000</strong><br>  <li id="mac68k_arandom">
 As originally shipped, the pmax port would fail to install due to  <strong>022: INSTALLATION FIX: July 14, 2000</strong>
 <b>/kern/msgbuf</b> bugs.<br>  
 The necessary fixes have been merged,  
 and the binaries needed re-released on the FTP site.<br>  
 However, the 2.7 <b>srcsys.tar.gz</b> file has not been updated.<br>  
 If you recompile a kernel, you should use either the  
 <a href=stable.html>stable release source tree</a> or apply the  
 provided patch to a 2.7 source tree.  
 <br>  <br>
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/2.7/pmax/020_pmax_msgbuf.patch">  The MacOS installer shipped with OpenBSD 2.7 does not correctly make all
 A source code patch exists which remedies this problem.</a>  devices, specifically it does not make the <code>/dev/arandom</code> device
   needed for the userland crypto such as ssh to work.  The problem shows itself
   when ssh-keygen fails to make RSA or DSA keys, resulting in messages like
   <b>RSA-generate_keys failed</b> or <b>DSA-generate_keys failed</b>.
   <br>
   To work around this, once your machine is up and running run the following
   commands as root:
   <pre>
   # cd /dev
   # ./MAKEDEV arandom
   </pre>
 <p>  <p>
 <li id="ftpd2">  After doing this (and possibly installing one of the ssl27 packages),
 <strong>019: SECURITY FIX: July 5, 2000</strong>  reboot your machine and it will generate ssh keys correctly.
   <p>
   
   <li id="xlock">
   <strong>023: SECURITY FIX: Aug 16, 2000</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 Just like pretty much all the other unix ftp daemons on the planet,  A format string vulnerability exists in xlock. As a workaround which disables
 ftpd had a remote root hole in it.  Luckily, ftpd was not enabled by default.  its functionality, do
 The problem exists if anonymous ftp is enabled.  <pre>
 <br>  # chmod u-s /usr/X11R6/bin/xlock
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/2.7/common/019_ftpd.patch">  </pre>
   <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/2.7/common/023_xlock.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
 <li id="mopd">  
 <strong>018: SECURITY FIX: July 5, 2000</strong>  <li id="ipsec">
   <strong>024: SECURITY FIX: Sep 18, 2000</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 Mopd contained a buffer overflow.  Bad ESP/AH packets could cause a crash under certain conditions.
 <br>  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/2.7/common/024_ipsec.patch"><br>
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/2.7/common/018_mopd.patch">  
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
 <li id="screen">  
 <strong>017: INSTALLATION FIX: July 3, 2000</strong>  <li id="pw_error">
   <strong>025: SECURITY FIX: Oct 3, 2000</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 The screen package shipped with 2.7 does not install itself properly.  The  A format string vulnerability exists in the pw_error(3) function.  This
 existing package in 2.7/packages/_ARCH_/screen-3.9.5.tgz has been renamed to  manifests itself as a security hole in the chpass utility.  As a workaround
 screen-3.9.5.tgz.old and a replacement package has been provided under the  which disables its functionality, do
 name screen-3.9.5p1.tgz.  <pre>
 <br>  # chmod u-s /usr/bin/chpass
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/2.7/ports/017_screen.patch">  </pre>
   <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/2.7/common/025_pw_error.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
 <li id="xlhash">  
 <strong>016: DRIVER BUG: July 2, 2000</strong><br>  <li id="talkd">
 The <a href="https://man.openbsd.org/OpenBSD-2.7/xl.4">xl(4)</a>  <strong>026: SECURITY FIX: Oct 6, 2000</strong>
 driver supporting various 3com cards, had a bug which prevented the multicast  &nbsp; <i>All architectures</i><br>
 filter from working correctly on the 3c905B, thus preventing many IPv6 things  A format string vulnerability exists in talkd(8).  It is not clear
 from working.  yet what the impact is.
 <br>  <br>
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/2.7/i386/016_xlhash.patch">  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/2.7/common/026_talkd.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
 <li id="ste">  
 <strong>015: DRIVER BUG: June 30, 2000</strong><br>  <li id="curses">
 The <a href="https://man.openbsd.org/OpenBSD-2.7/ste.4">ste(4)</a>  <strong>027: SECURITY FIX: Oct 6, 2000</strong>
 driver supporting Ethernet cards based on the Sundance ST201 chipset  &nbsp; <i>All architectures</i><br>
 (i.e., the D-Link 550TX) has a bug which causes the machine to panic at  libcurses honored terminal descriptions in the $HOME/.terminfo directory
 boot-time.  as well as in the TERMCAP environment variable for setuid and setgid
   applications.
 <br>  <br>
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/2.7/i386/015_ste.patch">  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/2.7/common/027_curses.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
 <li id="pcvt">  
 <strong>014: DRIVER BUG: June 30, 2000</strong><br>  <li id="format_strings">
 The PC console driver (PCVT) has two bugs. Display problems can result if  <strong>028: SECURITY FIX: Oct 6, 2000</strong>
 reverse video mode is turned on or off twice in a row. This patch also  &nbsp; <i>All architectures</i><br>
 fixes a problem with scrolling region handling that has been seen by many  There are printf-style format string bugs in several privileged programs.
 users trying to use the BitchX irc client with the screen program.<br>  
 <br>  <br>
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/2.7/i386/014_pcvt.patch">  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/2.7/common/028_format_strings.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 This is the second revision of the patch.  
 <p>  <p>
 <li id="libedit">  
 <strong>013: SECURITY FIX: June 28, 2000</strong>  <li id="sendmail">
   <strong>029: RELIABILITY FIX: Oct 9, 2000</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 libedit would check for a <b>.editrc</b> file in the current directory.  There is a non-exploitable buffer overflow in sendmail's test mode.
 That behaviour is not nice; this does not turn into a security problem in  
 any real world situation that we know of, but a patch is available anyways.  
 <br>  <br>
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/2.7/common/013_libedit.patch">  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/2.7/common/029_sendmail.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
 <li id="dhclient">  
 <strong>012: SECURITY FIX: June 24, 2000</strong>  <li id="telnetd">
   <strong>030: SECURITY FIX: Oct 10, 2000</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 A serious bug in dhclient(8) could allow strings from a malicious dhcp  The telnet daemon does not strip out the TERMINFO, TERMINFO_DIRS, TERMPATH
 server to be executed in the shell as root.  and TERMCAP (when it starts with a '/') environment variables.
 <br>  <br>
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/2.7/common/012_dhclient.patch">  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/2.7/common/030_telnetd.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
 <li id="if_an">  
 <strong>011: DRIVER BUG: June 17, 2000</strong><br>  <li id="httpd">
 The <a href="https://man.openbsd.org/OpenBSD-2.7/an.4">an(4)</a>  <strong>031: SECURITY FIX: Oct 18, 2000</strong>
 Aironet Communications 4500/4800 IEEE 802.11DS driver has a bug which prevents  &nbsp; <i>All architectures</i><br>
 <a href="https://man.openbsd.org/OpenBSD-2.7/ancontrol.8">ancontrol(8)</a> from working correctly, instead causing a panic.  Apache has several bugs in <code>mod_rewrite</code> and <code>mod_vhost_alias</code>
   that could cause arbitrary files accessible to the www user on the server
   to be exposed under certain configurations when these modules are used.
   (These modules are not active by default).
 <br>  <br>
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/2.7/i386/011_an.patch">  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/2.7/common/031_httpd.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
 <li id="amiga_cd">  
 <strong>010: CD DISTRIBUTION ERROR: June 15, 2000</strong><br>  <li id="xtrans">
 On the 2.7 CD media, the <b>amiga</b> distribution contains two pairs of archives  <strong>032: SECURITY FIX: Oct 26, 2000</strong>
 files for installation, ie:  
 <pre>  
 -rw-r--r--  1 root  mirftp  20191465 Apr 29 14:27 base27.tar.gz  
 -rw-r--r--  1 root  mirftp  20291753 May 13 19:33 base27.tgz  
 -rw-r--r--  1 root  mirftp  13699507 Apr 29 14:26 comp27.tar.gz  
 -rw-r--r--  1 root  mirftp  13748096 May 13 19:33 comp27.tgz  
 -rw-r--r--  1 root  mirftp   1005376 Apr 29 14:26 etc27.tar.gz  
 -rw-r--r--  1 root  mirftp   1010772 May 13 19:33 etc27.tgz  
 -rw-r--r--  1 root  mirftp   2755567 Apr 29 14:26 game27.tar.gz  
 -rw-r--r--  1 root  mirftp   2755624 May 13 19:33 game27.tgz  
 -rw-r--r--  1 root  mirftp   5002872 Apr 29 14:26 man27.tar.gz  
 -rw-r--r--  1 root  mirftp   5038896 May 13 19:33 man27.tgz  
 -rw-r--r--  1 root  mirftp   1684356 Apr 29 14:26 misc27.tar.gz  
 -rw-r--r--  1 root  mirftp   1684381 May 13 19:33 misc27.tgz  
 </pre>  
 The installation script will list ALL of these files.  For proper  
 operation one should install the <b>*.tgz</b> versions, and deselect  
 the <b>*.tar.gz</b> versions.<br>  
 The FTP area sets do not suffer from this problem.  
 <p>  
 <li id="isakmpd">  
 <strong>009: SECURITY FIX: June 9, 2000</strong>  
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 A serious bug in isakmpd(8) policy handling wherein policy  There are two possibly exploitable potential buffer overflows in the X11
 verification could be completely bypassed in isakmpd.  libraries using the xtrans code. One of these vulnerabilities was
   reported to the
   <a href="http://www.securityfocus.com/archive/1/139436">BUGTRAQ</a>
   mailing list.
 <br>  <br>
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/2.7/common/009_isakmpd.patch">  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/2.7/common/032_xtrans.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
 <li id="msdosfs">  
 <strong>008: RELIABILITY FIX: June 8, 2000</strong>  <li id="execsubr">
   <strong>033: RELIABILITY FIX: Nov 6, 2000</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 Some operations in msdosfs could result in a system panic.  Invalid fields in the exec header could cause a crash.<br>
 <br>  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/2.7/common/033_execsubr.patch">
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/2.7/common/008_msdosfs.patch">  
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
 <li id="cd9660">  
 <strong>007: RELIABILITY FIX: June 8, 2000</strong>  <li id="zsconsole">
 &nbsp; <i>All architectures</i><br>  <strong>034: RELIABILITY FIX: Nov 10, 2000</strong><br>
 NFS exporting of CD filesystems caused a system panic.  When running a sparc with a serial console, certain types of interrupts would
 <br>  cause great grief.<br>
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/2.7/common/007_cd9660.patch">  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/2.7/sparc/034_zsconsole.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
 <li id="uselogin">  
 <strong>006: SECURITY FIX: June 6, 2000</strong>  <li id="sshforwarding">
   <strong>035: SECURITY FIX: Nov 10, 2000</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 The non-default UseLogin feature in <b>/etc/sshd_config</b> is broken and should not  Hostile servers can force OpenSSH clients to do agent or X11 forwarding.
 be used.  On other operating systems, it results in a hole.<br>  This problem is fixed as of OpenSSH 2.3.0.<br>
 Avoid use of this feature, or update to OpenSSH 2.1.1 or later if you must use it.  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/2.7/common/035_sshforwarding.patch">
   A source code patch exists which remedies this problem.</a>
 <p>  <p>
 <li id="ipopts">  
 <strong>005: RELIABILITY FIX: May 29, 2000</strong>  <li id="qe">
 &nbsp; <i>All architectures</i><br>  <strong>036: RELIABILITY FIX: Nov 17, 2000</strong><br>
 Parse IPv4 options more carefully.  It is not yet clear if this can even be used  Configuring a qec+qe causes a NMI panic.<br>
 to crash the machine remote or locally.  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/2.7/sparc/036_qe.patch">
 <br>  
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/2.7/common/005_ipopts.patch">  
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
 <li id="route">  
 <strong>004: RELIABILITY FIX: May 29, 2000</strong>  <li id="ftpd">
   <strong>037: SECURITY FIX: Dec 4, 2000</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 Certain routing table modifications by the superuser could cause a system panic.  OpenBSD 2.7's ftpd contains a one-byte overflow in the replydirname() function.<br>
 <br>  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/2.7/common/037_ftpd.patch">
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/2.7/common/004_route.patch">  
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
 <li id="bridge">  
 <strong>003: SECURITY FIX: May 26, 2000</strong>  <li id="sudo">
   <strong>039: SECURITY FIX: Feb 22, 2001</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 It is possible to bypass the <i>learning</i> flag on an interface if frames  There is an exploitable heap corruption bug in
 go directly to the machine acting as a  <a href="https://man.openbsd.org/OpenBSD-2.7/sudo.8">sudo</a>.
 <a href="https://man.openbsd.org/OpenBSD-2.7/bridge.4">bridge</a>.  
 <br>  <br>
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/2.7/common/003_bridge.patch">  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/2.7/common/038_named.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
 <li id="ef">  
 <strong>002: DRIVER FIX: May 26, 2000</strong>  <li id="readline">
   <strong>040: SECURITY FIX: Mar 18, 2001</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 The  The readline library shipped with OpenBSD allows history files creation
 <a href="https://man.openbsd.org/OpenBSD-2.7/ef.4">ef(4)</a>  with a permissive
 driver will complain when adding an address with ifconfig  <a href="https://man.openbsd.org/OpenBSD-2.7/umask.2">umask(2)</a>.
 (ifconfig: SIOCAIFADDR: Invalid argument).<br>  This can lead to the leakage of sensitive information in applications
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/2.7/common/002_ef.patch">  that use passwords and the like during user interaction (one such
   application is mysql).  Additionally, if the HOME environment variable
   is not set, the current working directory is used; this patch disables
   the history file if HOME is not set.<br>
   <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/2.7/common/040_readline.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  
 <li id="ipf">  
 <strong>001: SECURITY FIX: May 25, 2000</strong>  
 &nbsp; <i>All architectures</i><br>  
 A misuse of ipf(8)  
 <i>keep-state</i> rules can result in firewall rules being bypassed.<br>  
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/2.7/common/001_ipf.patch">  
 A source code patch exists which remedies this problem.</a>  
 It updates ipf to version 3.3.16.  
 <p>  <p>
   
 </ul>  </ul>
Legend:
Removed from v.1.95  
changed lines
  Added in v.1.96