=================================================================== RCS file: /cvsrepo/anoncvs/cvs/www/errata27.html,v retrieving revision 1.54 retrieving revision 1.55 diff -c -r1.54 -r1.55 *** www/errata27.html 2010/03/08 21:53:37 1.54 --- www/errata27.html 2010/07/08 19:00:07 1.55 *************** *** 53,59 ****

! You can also fetch a tar.gz file containing all the following patches. This file is updated once a day. --- 53,59 ----

! You can also fetch a tar.gz file containing all the following patches. This file is updated once a day. *************** *** 78,84 **** application is mysql). Additionally, if the HOME environment variable is not set, the current working directory is used; this patch disables the history file if HOME is not set.
! A source code patch exists which remedies the problem.

  • --- 78,84 ---- application is mysql). Additionally, if the HOME environment variable is not set, the current working directory is used; this patch disables the history file if HOME is not set.
    ! A source code patch exists which remedies the problem.

  • *************** *** 86,110 **** There is an exploitable heap corruption bug in sudo.
    ! A source code patch exists which remedies the problem.

  • 037: SECURITY FIX: Dec 4, 2000
    OpenBSD 2.7's ftpd contains a one-byte overflow in the replydirname() function.
    ! A source code patch exists which remedies the problem.

  • 035: SECURITY FIX: Nov 10, 2000
    Hostile servers can force OpenSSH clients to do agent or X11 forwarding. This problem is fixed as of OpenSSH 2.3.0.
    ! A source code patch exists which remedies this problem.

  • 033: RELIABILITY FIX: Nov 6, 2000
    Invalid fields in the exec header could cause a crash.
    ! A source code patch exists which remedies this problem.

  • --- 86,110 ---- There is an exploitable heap corruption bug in sudo.
    ! A source code patch exists which remedies the problem.

  • 037: SECURITY FIX: Dec 4, 2000
    OpenBSD 2.7's ftpd contains a one-byte overflow in the replydirname() function.
    ! A source code patch exists which remedies the problem.

  • 035: SECURITY FIX: Nov 10, 2000
    Hostile servers can force OpenSSH clients to do agent or X11 forwarding. This problem is fixed as of OpenSSH 2.3.0.
    ! A source code patch exists which remedies this problem.

  • 033: RELIABILITY FIX: Nov 6, 2000
    Invalid fields in the exec header could cause a crash.
    ! A source code patch exists which remedies this problem.

  • *************** *** 115,121 **** BUGTRAQ mailing list.
    ! A source code patch exists which remedies this problem.

  • --- 115,121 ---- BUGTRAQ mailing list.
    ! A source code patch exists which remedies this problem.

  • *************** *** 125,131 **** to be exposed under certain configurations when these modules are used. (These modules are not active by default).
    ! A source code patch exists which remedies this problem.

  • --- 125,131 ---- to be exposed under certain configurations when these modules are used. (These modules are not active by default).
    ! A source code patch exists which remedies this problem.

  • *************** *** 133,153 **** The telnet daemon does not strip out the TERMINFO, TERMINFO_DIRS, TERMPATH and TERMCAP (when it starts with a '/') environment variables.
    ! A source code patch exists which remedies this problem.

  • 029: RELIABILITY FIX: Oct 9, 2000
    There is a non-exploitable buffer overflow in sendmail's test mode.
    ! A source code patch exists which remedies this problem.

  • 028: SECURITY FIX: Oct 6, 2000
    There are printf-style format string bugs in several privileged programs.
    ! A source code patch exists which remedies this problem.

  • --- 133,153 ---- The telnet daemon does not strip out the TERMINFO, TERMINFO_DIRS, TERMPATH and TERMCAP (when it starts with a '/') environment variables.
    ! A source code patch exists which remedies this problem.

  • 029: RELIABILITY FIX: Oct 9, 2000
    There is a non-exploitable buffer overflow in sendmail's test mode.
    ! A source code patch exists which remedies this problem.

  • 028: SECURITY FIX: Oct 6, 2000
    There are printf-style format string bugs in several privileged programs.
    ! A source code patch exists which remedies this problem.

  • *************** *** 156,162 **** as well as in the TERMCAP environment variable for setuid and setgid applications.
    ! A source code patch exists which remedies this problem.

  • --- 156,162 ---- as well as in the TERMCAP environment variable for setuid and setgid applications.
    ! A source code patch exists which remedies this problem.

  • *************** *** 164,170 **** A format string vulnerability exists in talkd(8). It is not clear yet what the impact is.
    ! A source code patch exists which remedies this problem.

  • --- 164,170 ---- A format string vulnerability exists in talkd(8). It is not clear yet what the impact is.
    ! A source code patch exists which remedies this problem.

  • *************** *** 175,187 ****
      # chmod u-s /usr/bin/chpass
      
    ! A source code patch exists which remedies this problem.

  • 024: SECURITY FIX: Sep 18, 2000
    Bad ESP/AH packets could cause a crash under certain conditions. !
    A source code patch exists which remedies this problem.

  • --- 175,187 ----
      # chmod u-s /usr/bin/chpass
      
    ! A source code patch exists which remedies this problem.

  • 024: SECURITY FIX: Sep 18, 2000
    Bad ESP/AH packets could cause a crash under certain conditions. !
    A source code patch exists which remedies this problem.

  • *************** *** 191,197 ****
      # chmod u-s /usr/X11R6/bin/xlock
      
    ! A source code patch exists which remedies this problem.

  • --- 191,197 ----
      # chmod u-s /usr/X11R6/bin/xlock
      
    ! A source code patch exists which remedies this problem.

  • *************** *** 216,222 **** the XFree86 Xwrapper already has tests for bad arguments.
    ! A source code patch exists which remedies these problems.
    Note 1: tcl/tk is required to build X11 from source.
    Note 2: When re-building use the command --- 216,222 ---- the XFree86 Xwrapper already has tests for bad arguments.
    ! A source code patch exists which remedies these problems.
    Note 1: tcl/tk is required to build X11 from source.
    Note 2: When re-building use the command *************** *** 231,244 **** ftpd had a remote root hole in it. Luckily, ftpd was not enabled by default. The problem exists if anonymous ftp is enabled.
    ! A source code patch exists which remedies this problem.

  • 018: SECURITY FIX: July 5, 2000
    Mopd contained a buffer overflow.
    ! A source code patch exists which remedies this problem.

  • --- 231,244 ---- ftpd had a remote root hole in it. Luckily, ftpd was not enabled by default. The problem exists if anonymous ftp is enabled.
    ! A source code patch exists which remedies this problem.

  • 018: SECURITY FIX: July 5, 2000
    Mopd contained a buffer overflow.
    ! A source code patch exists which remedies this problem.

  • *************** *** 249,255 **** screen-3.9.5.tgz.old and a replacement package has been provided under the name screen-3.9.5p1.tgz.
    ! A source code patch exists which remedies this problem.

  • --- 249,255 ---- screen-3.9.5.tgz.old and a replacement package has been provided under the name screen-3.9.5p1.tgz.
    ! A source code patch exists which remedies this problem.

  • *************** *** 258,264 **** That behaviour is not nice; this does not turn into a security problem in any real world situation that we know of, but a patch is available anyways.
    ! A source code patch exists which remedies this problem.

  • --- 258,264 ---- That behaviour is not nice; this does not turn into a security problem in any real world situation that we know of, but a patch is available anyways.
    ! A source code patch exists which remedies this problem.

  • *************** *** 266,272 **** A serious bug in dhclient(8) could allow strings from a malicious dhcp server to be executed in the shell as root.
    ! A source code patch exists which remedies this problem.

  • --- 266,272 ---- A serious bug in dhclient(8) could allow strings from a malicious dhcp server to be executed in the shell as root.
    ! A source code patch exists which remedies this problem.

  • *************** *** 274,294 **** A serious bug in isakmpd(8) policy handling wherein policy verification could be completely bypassed in isakmpd.
    ! A source code patch exists which remedies this problem.

  • 008: RELIABILITY FIX: June 8, 2000
    Some operations in msdosfs could result in a system panic.
    ! A source code patch exists which remedies this problem.

  • 007: RELIABILITY FIX: June 8, 2000
    NFS exporting of CD filesystems caused a system panic.
    ! A source code patch exists which remedies this problem.

  • --- 274,294 ---- A serious bug in isakmpd(8) policy handling wherein policy verification could be completely bypassed in isakmpd.
    ! A source code patch exists which remedies this problem.

  • 008: RELIABILITY FIX: June 8, 2000
    Some operations in msdosfs could result in a system panic.
    ! A source code patch exists which remedies this problem.

  • 007: RELIABILITY FIX: June 8, 2000
    NFS exporting of CD filesystems caused a system panic.
    ! A source code patch exists which remedies this problem.

  • *************** *** 302,315 **** Parse IPv4 options more carefully. It is not yet clear if this can even be used to crash the machine remote or locally.
    ! A source code patch exists which remedies this problem.

  • 004: RELIABILITY FIX: May 29, 2000
    Certain routing table modifications by the superuser could cause a system panic.
    ! A source code patch exists which remedies this problem.

  • --- 302,315 ---- Parse IPv4 options more carefully. It is not yet clear if this can even be used to crash the machine remote or locally.
    ! A source code patch exists which remedies this problem.

  • 004: RELIABILITY FIX: May 29, 2000
    Certain routing table modifications by the superuser could cause a system panic.
    ! A source code patch exists which remedies this problem.

  • *************** *** 318,324 **** go directly to the machine acting as a bridge.
    ! A source code patch exists which remedies this problem.

  • --- 318,324 ---- go directly to the machine acting as a bridge.
    ! A source code patch exists which remedies this problem.

  • *************** *** 327,340 **** ef(4) driver will complain when adding an address with ifconfig (ifconfig: SIOCAIFADDR: Invalid argument).
    ! A source code patch exists which remedies this problem.

  • 001: SECURITY FIX: May 25, 2000
    A misuse of ipf(8) keep-state rules can result in firewall rules being bypassed.
    ! A source code patch exists, which remedies this problem, and updates ipf to version 3.3.16.

    --- 327,340 ---- ef(4) driver will complain when adding an address with ifconfig (ifconfig: SIOCAIFADDR: Invalid argument).
    ! A source code patch exists which remedies this problem.

  • 001: SECURITY FIX: May 25, 2000
    A misuse of ipf(8) keep-state rules can result in firewall rules being bypassed.
    ! A source code patch exists, which remedies this problem, and updates ipf to version 3.3.16.

    *************** *** 350,356 **** filter from working correctly on the 3c905B, thus preventing many IPv6 things from working.
    ! A source code patch exists which remedies this problem.

  • --- 350,356 ---- filter from working correctly on the 3c905B, thus preventing many IPv6 things from working.
    ! A source code patch exists which remedies this problem.

  • *************** *** 360,366 **** (i.e., the D-Link 550TX) has a bug which causes the machine to panic at boot-time.
    ! A source code patch exists which remedies this problem.

  • --- 360,366 ---- (i.e., the D-Link 550TX) has a bug which causes the machine to panic at boot-time.
    ! A source code patch exists which remedies this problem.

  • *************** *** 370,376 **** fixes a problem with scrolling region handling that has been seen by many users trying to use the BitchX irc client with the screen program.

    ! There is now a second revision of the source code patch which remedies this problem.

  • --- 370,376 ---- fixes a problem with scrolling region handling that has been seen by many users trying to use the BitchX irc client with the screen program.

    ! There is now a second revision of the source code patch which remedies this problem.

  • *************** *** 379,385 **** Aironet Communications 4500/4800 IEEE 802.11DS driver has a bug which prevents ancontrol(8) from working correctly, instead causing a panic.
    ! A source code patch exists which remedies this problem.

    --- 379,385 ---- Aironet Communications 4500/4800 IEEE 802.11DS driver has a bug which prevents ancontrol(8) from working correctly, instead causing a panic.
    ! A source code patch exists which remedies this problem.

    *************** *** 413,426 ****

  • 036: RELIABILITY FIX: Nov 17, 2000
    Configuring a qec+qe causes a NMI panic.
    ! A source code patch exists which remedies this problem.

  • 034: RELIABILITY FIX: Nov 10, 2000
    When running a sparc with a serial console, certain types of interrupts would cause great grief.
    ! A source code patch exists which remedies this problem.

    --- 413,426 ----

  • 036: RELIABILITY FIX: Nov 17, 2000
    Configuring a qec+qe causes a NMI panic.
    ! A source code patch exists which remedies this problem.

  • 034: RELIABILITY FIX: Nov 10, 2000
    When running a sparc with a serial console, certain types of interrupts would cause great grief.
    ! A source code patch exists which remedies this problem.

    *************** *** 467,473 **** stable release source tree or apply the provided patch to a 2.7 source tree.
    ! A source code patch exists which remedies this problem.

    --- 467,473 ---- stable release source tree or apply the provided patch to a 2.7 source tree.
    ! A source code patch exists which remedies this problem.

    *************** *** 540,546 ****


    OpenBSD www@openbsd.org !
    $OpenBSD: errata27.html,v 1.54 2010/03/08 21:53:37 deraadt Exp $ --- 540,546 ----
    OpenBSD www@openbsd.org !
    $OpenBSD: errata27.html,v 1.55 2010/07/08 19:00:07 sthen Exp $