[BACK]Return to errata27.html CVS log [TXT][DIR] Up to [local] / www

Diff for /www/errata27.html between version 1.66 and 1.67

version 1.66, 2014/03/31 03:12:47 version 1.67, 2014/03/31 03:36:54
Line 75 
Line 75 
   
 <hr>  <hr>
   
 <a name="all"></a>  
 <h3><font color="#e00000">All architectures</font></h3>  
 <ul>  <ul>
 <li><a name="readline"></a>  <li><a name="readline"></a>
 <font color="#009000"><strong>040: SECURITY FIX: Mar 18, 2001</strong></font><br>  <font color="#009000"><strong>040: SECURITY FIX: Mar 18, 2001</strong></font> &nbsp; <i>All architectures</i><br>
 The readline library shipped with OpenBSD allows history files creation  The readline library shipped with OpenBSD allows history files creation
 with a permissive  with a permissive
 <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=umask&amp;sektion=2">umask(2)</a>.  <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=umask&amp;sektion=2">umask(2)</a>.
Line 92 
Line 90 
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
 <li><a name="sudo"></a>  <li><a name="sudo"></a>
 <font color="#009000"><strong>039: SECURITY FIX: Feb 22, 2001</strong></font><br>  <font color="#009000"><strong>039: SECURITY FIX: Feb 22, 2001</strong></font> &nbsp; <i>All architectures</i><br>
 There is an exploitable heap corruption bug in  There is an exploitable heap corruption bug in
 <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=sudo&amp;sektion=8">sudo</a>.  <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=sudo&amp;sektion=8">sudo</a>.
 <br>  <br>
Line 100 
Line 98 
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
 <li><a name="ftpd"></a>  <li><a name="ftpd"></a>
 <font color="#009000"><strong>037: SECURITY FIX: Dec 4, 2000</strong></font><br>  <font color="#009000"><strong>037: SECURITY FIX: Dec 4, 2000</strong></font> &nbsp; <i>All architectures</i><br>
 OpenBSD 2.7's ftpd contains a one-byte overflow in the replydirname() function.<br>  OpenBSD 2.7's ftpd contains a one-byte overflow in the replydirname() function.<br>
 <a href="http://ftp.openbsd.org/pub/OpenBSD/patches/2.7/common/037_ftpd.patch">  <a href="http://ftp.openbsd.org/pub/OpenBSD/patches/2.7/common/037_ftpd.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
 <li><a name="sshforwarding"> </a>  <li><a name="sshforwarding"> </a>
 <font color="#009000"><strong>035: SECURITY FIX: Nov 10, 2000</strong></font><br>  <font color="#009000"><strong>035: SECURITY FIX: Nov 10, 2000</strong></font> &nbsp; <i>All architectures</i><br>
 Hostile servers can force OpenSSH clients to do agent or X11 forwarding.  Hostile servers can force OpenSSH clients to do agent or X11 forwarding.
 This problem is fixed as of OpenSSH 2.3.0.<br>  This problem is fixed as of OpenSSH 2.3.0.<br>
 <a href="http://ftp.openbsd.org/pub/OpenBSD/patches/2.7/common/035_sshforwarding.patch">  <a href="http://ftp.openbsd.org/pub/OpenBSD/patches/2.7/common/035_sshforwarding.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
 <li><a name="execsubr"> </a>  <li><a name="execsubr"> </a>
 <font color="#009000"><strong>033: RELIABILITY FIX: Nov 6, 2000</strong></font><br>  <font color="#009000"><strong>033: RELIABILITY FIX: Nov 6, 2000</strong></font> &nbsp; <i>All architectures</i><br>
 Invalid fields in the exec header could cause a crash.<br>  Invalid fields in the exec header could cause a crash.<br>
 <a href="http://ftp.openbsd.org/pub/OpenBSD/patches/2.7/common/033_execsubr.patch">  <a href="http://ftp.openbsd.org/pub/OpenBSD/patches/2.7/common/033_execsubr.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
 <li><a name="xtrans"> </a>  <li><a name="xtrans"> </a>
 <font color="#009000"><strong>032: SECURITY FIX: Oct 26, 2000</strong></font><br>  <font color="#009000"><strong>032: SECURITY FIX: Oct 26, 2000</strong></font> &nbsp; <i>All architectures</i><br>
 There are two possibly exploitable potential buffer overflows in the X11  There are two possibly exploitable potential buffer overflows in the X11
 libraries using the xtrans code. One of these vulnerabilities was  libraries using the xtrans code. One of these vulnerabilities was
 reported to the  reported to the
Line 130 
Line 128 
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
 <li><a name="httpd"></a>  <li><a name="httpd"></a>
 <font color="#009000"><strong>031: SECURITY FIX: Oct 18, 2000</strong></font><br>  <font color="#009000"><strong>031: SECURITY FIX: Oct 18, 2000</strong></font> &nbsp; <i>All architectures</i><br>
 Apache has several bugs in <tt>mod_rewrite</tt> and <tt>mod_vhost_alias</tt>  Apache has several bugs in <tt>mod_rewrite</tt> and <tt>mod_vhost_alias</tt>
 that could cause arbitrary files accessible to the www user on the server  that could cause arbitrary files accessible to the www user on the server
 to be exposed under certain configurations when these modules are used.  to be exposed under certain configurations when these modules are used.
Line 140 
Line 138 
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
 <li><a name="telnetd"></a>  <li><a name="telnetd"></a>
 <font color="#009000"><strong>030: SECURITY FIX: Oct 10, 2000</strong></font><br>  <font color="#009000"><strong>030: SECURITY FIX: Oct 10, 2000</strong></font> &nbsp; <i>All architectures</i><br>
 The telnet daemon does not strip out the TERMINFO, TERMINFO_DIRS, TERMPATH  The telnet daemon does not strip out the TERMINFO, TERMINFO_DIRS, TERMPATH
 and TERMCAP (when it starts with a '/') environment variables.  and TERMCAP (when it starts with a '/') environment variables.
 <br>  <br>
Line 148 
Line 146 
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
 <li><a name="sendmail"></a>  <li><a name="sendmail"></a>
 <font color="#009000"><strong>029: RELIABILITY FIX: Oct 9, 2000</strong></font><br>  <font color="#009000"><strong>029: RELIABILITY FIX: Oct 9, 2000</strong></font> &nbsp; <i>All architectures</i><br>
 There is a non-exploitable buffer overflow in sendmail's test mode.  There is a non-exploitable buffer overflow in sendmail's test mode.
 <br>  <br>
 <a href="http://ftp.openbsd.org/pub/OpenBSD/patches/2.7/common/029_sendmail.patch">  <a href="http://ftp.openbsd.org/pub/OpenBSD/patches/2.7/common/029_sendmail.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
 <li><a name="format_strings"></a>  <li><a name="format_strings"></a>
 <font color="#009000"><strong>028: SECURITY FIX: Oct 6, 2000</strong></font><br>  <font color="#009000"><strong>028: SECURITY FIX: Oct 6, 2000</strong></font> &nbsp; <i>All architectures</i><br>
 There are printf-style format string bugs in several privileged programs.  There are printf-style format string bugs in several privileged programs.
 <br>  <br>
 <a href="http://ftp.openbsd.org/pub/OpenBSD/patches/2.7/common/028_format_strings.patch">  <a href="http://ftp.openbsd.org/pub/OpenBSD/patches/2.7/common/028_format_strings.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
 <li><a name="curses"></a>  <li><a name="curses"></a>
 <font color="#009000"><strong>027: SECURITY FIX: Oct 6, 2000</strong></font><br>  <font color="#009000"><strong>027: SECURITY FIX: Oct 6, 2000</strong></font> &nbsp; <i>All architectures</i><br>
 libcurses honored terminal descriptions in the $HOME/.terminfo directory  libcurses honored terminal descriptions in the $HOME/.terminfo directory
 as well as in the TERMCAP environment variable for setuid and setgid  as well as in the TERMCAP environment variable for setuid and setgid
 applications.  applications.
Line 171 
Line 169 
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
 <li><a name="talkd"></a>  <li><a name="talkd"></a>
 <font color="#009000"><strong>026: SECURITY FIX: Oct 6, 2000</strong></font><br>  <font color="#009000"><strong>026: SECURITY FIX: Oct 6, 2000</strong></font> &nbsp; <i>All architectures</i><br>
 A format string vulnerability exists in talkd(8).  It is not clear  A format string vulnerability exists in talkd(8).  It is not clear
 yet what the impact is.  yet what the impact is.
 <br>  <br>
Line 179 
Line 177 
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
 <li><a name="pw_error"></a>  <li><a name="pw_error"></a>
 <font color="#009000"><strong>025: SECURITY FIX: Oct 3, 2000</strong></font><br>  <font color="#009000"><strong>025: SECURITY FIX: Oct 3, 2000</strong></font> &nbsp; <i>All architectures</i><br>
 A format string vulnerability exists in the pw_error(3) function.  This  A format string vulnerability exists in the pw_error(3) function.  This
 manifests itself as a security hole in the chpass utility.  As a workaround  manifests itself as a security hole in the chpass utility.  As a workaround
 which disables its functionality, do  which disables its functionality, do
Line 190 
Line 188 
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
 <li><a name="ipsec"></a>  <li><a name="ipsec"></a>
 <font color="#009000"><strong>024: SECURITY FIX: Sep 18, 2000</strong></font><br>  <font color="#009000"><strong>024: SECURITY FIX: Sep 18, 2000</strong></font> &nbsp; <i>All architectures</i><br>
 Bad ESP/AH packets could cause a crash under certain conditions.  Bad ESP/AH packets could cause a crash under certain conditions.
 <a href="http://ftp.openbsd.org/pub/OpenBSD/patches/2.7/common/024_ipsec.patch"><br>  <a href="http://ftp.openbsd.org/pub/OpenBSD/patches/2.7/common/024_ipsec.patch"><br>
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
 <li><a name="xlock"></a>  <li><a name="xlock"></a>
 <font color="#009000"><strong>023: SECURITY FIX: Aug 16, 2000</strong></font><br>  <font color="#009000"><strong>023: SECURITY FIX: Aug 16, 2000</strong></font> &nbsp; <i>All architectures</i><br>
 A format string vulnerability exists in xlock. As a workaround which disables  A format string vulnerability exists in xlock. As a workaround which disables
 its functionality, do  its functionality, do
 <pre>  <pre>
Line 206 
Line 204 
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
 <li><a name="X11_libs"></a>  <li><a name="X11_libs"></a>
 <font color="#009000"><strong>021: SECURITY FIX: July 14, 2000</strong></font><br>  <font color="#009000"><strong>021: SECURITY FIX: July 14, 2000</strong></font> &nbsp; <i>All architectures</i><br>
 Various problems in X11 libraries have various side effects.  We provide a  Various problems in X11 libraries have various side effects.  We provide a
 jumbo patch to fix them.<p>  jumbo patch to fix them.<p>
 <ul>  <ul>
Line 237 
Line 235 
 time /etc/weekly runs.  time /etc/weekly runs.
 <p>  <p>
 <li><a name="ftpd"></a>  <li><a name="ftpd"></a>
 <font color="#009000"><strong>019: SECURITY FIX: July 5, 2000</strong></font><br>  <font color="#009000"><strong>019: SECURITY FIX: July 5, 2000</strong></font> &nbsp; <i>All architectures</i><br>
 Just like pretty much all the other unix ftp daemons on the planet,  Just like pretty much all the other unix ftp daemons on the planet,
 ftpd had a remote root hole in it.  Luckily, ftpd was not enabled by default.  ftpd had a remote root hole in it.  Luckily, ftpd was not enabled by default.
 The problem exists if anonymous ftp is enabled.  The problem exists if anonymous ftp is enabled.
Line 246 
Line 244 
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
 <li><a name="mopd"></a>  <li><a name="mopd"></a>
 <font color="#009000"><strong>018: SECURITY FIX: July 5, 2000</strong></font><br>  <font color="#009000"><strong>018: SECURITY FIX: July 5, 2000</strong></font> &nbsp; <i>All architectures</i><br>
 Mopd contained a buffer overflow.  Mopd contained a buffer overflow.
 <br>  <br>
 <a href="http://ftp.openbsd.org/pub/OpenBSD/patches/2.7/common/018_mopd.patch">  <a href="http://ftp.openbsd.org/pub/OpenBSD/patches/2.7/common/018_mopd.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
 <li><a name="screen"></a>  <li><a name="screen"></a>
 <font color="#009000"><strong>017: INSTALLATION FIX: July 3, 2000</strong></font>  <font color="#009000"><strong>017: INSTALLATION FIX: July 3, 2000</strong></font> &nbsp; <i>All architectures</i><br>
 <br>  
 The screen package shipped with 2.7 does not install itself properly.  The  The screen package shipped with 2.7 does not install itself properly.  The
 existing package in 2.7/packages/_ARCH_/screen-3.9.5.tgz has been renamed to  existing package in 2.7/packages/_ARCH_/screen-3.9.5.tgz has been renamed to
 screen-3.9.5.tgz.old and a replacement package has been provided under the  screen-3.9.5.tgz.old and a replacement package has been provided under the
Line 264 
Line 261 
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
 <li><a name="libedit"></a>  <li><a name="libedit"></a>
 <font color="#009000"><strong>013: SECURITY FIX: June 28, 2000</strong></font><br>  <font color="#009000"><strong>013: SECURITY FIX: June 28, 2000</strong></font> &nbsp; <i>All architectures</i><br>
 libedit would check for a <b>.editrc</b> file in the current directory.  libedit would check for a <b>.editrc</b> file in the current directory.
 That behaviour is not nice; this does not turn into a security problem in  That behaviour is not nice; this does not turn into a security problem in
 any real world situation that we know of, but a patch is available anyways.  any real world situation that we know of, but a patch is available anyways.
Line 273 
Line 270 
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
 <li><a name="dhclient"></a>  <li><a name="dhclient"></a>
 <font color="#009000"><strong>012: SECURITY FIX: June 24, 2000</strong></font><br>  <font color="#009000"><strong>012: SECURITY FIX: June 24, 2000</strong></font> &nbsp; <i>All architectures</i><br>
 A serious bug in dhclient(8) could allow strings from a malicious dhcp  A serious bug in dhclient(8) could allow strings from a malicious dhcp
 server to be executed in the shell as root.  server to be executed in the shell as root.
 <br>  <br>
Line 281 
Line 278 
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
 <li><a name="isakmpd"></a>  <li><a name="isakmpd"></a>
 <font color="#009000"><strong>009: SECURITY FIX: June 9, 2000</strong></font><br>  <font color="#009000"><strong>009: SECURITY FIX: June 9, 2000</strong></font> &nbsp; <i>All architectures</i><br>
 A serious bug in isakmpd(8) policy handling wherein policy  A serious bug in isakmpd(8) policy handling wherein policy
 verification could be completely bypassed in isakmpd.  verification could be completely bypassed in isakmpd.
 <br>  <br>
Line 289 
Line 286 
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
 <li><a name="msdosfs"></a>  <li><a name="msdosfs"></a>
 <font color="#009000"><strong>008: RELIABILITY FIX: June 8, 2000</strong></font><br>  <font color="#009000"><strong>008: RELIABILITY FIX: June 8, 2000</strong></font> &nbsp; <i>All architectures</i><br>
 Some operations in msdosfs could result in a system panic.  Some operations in msdosfs could result in a system panic.
 <br>  <br>
 <a href="http://ftp.openbsd.org/pub/OpenBSD/patches/2.7/common/008_msdosfs.patch">  <a href="http://ftp.openbsd.org/pub/OpenBSD/patches/2.7/common/008_msdosfs.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
 <li><a name="cd9660"></a>  <li><a name="cd9660"></a>
 <font color="#009000"><strong>007: RELIABILITY FIX: June 8, 2000</strong></font><br>  <font color="#009000"><strong>007: RELIABILITY FIX: June 8, 2000</strong></font> &nbsp; <i>All architectures</i><br>
 NFS exporting of CD filesystems caused a system panic.  NFS exporting of CD filesystems caused a system panic.
 <br>  <br>
 <a href="http://ftp.openbsd.org/pub/OpenBSD/patches/2.7/common/007_cd9660.patch">  <a href="http://ftp.openbsd.org/pub/OpenBSD/patches/2.7/common/007_cd9660.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
 <li><a name="uselogin"></a>  <li><a name="uselogin"></a>
 <font color="#009000"><strong>006: SECURITY FIX: June 6, 2000</strong></font><br>  <font color="#009000"><strong>006: SECURITY FIX: June 6, 2000</strong></font> &nbsp; <i>All architectures</i><br>
 The non-default UseLogin feature in <b>/etc/sshd_config</b> is broken and should not  The non-default UseLogin feature in <b>/etc/sshd_config</b> is broken and should not
 be used.  On other operating systems, it results in a hole.<br>  be used.  On other operating systems, it results in a hole.<br>
 Avoid use of this feature, or update to OpenSSH 2.1.1 or later if you must use it.  Avoid use of this feature, or update to OpenSSH 2.1.1 or later if you must use it.
 <p>  <p>
 <li><a name="ipopts"></a>  <li><a name="ipopts"></a>
 <font color="#009000"><strong>005: RELIABILITY FIX: May 29, 2000</strong></font><br>  <font color="#009000"><strong>005: RELIABILITY FIX: May 29, 2000</strong></font> &nbsp; <i>All architectures</i><br>
 Parse IPv4 options more carefully.  It is not yet clear if this can even be used  Parse IPv4 options more carefully.  It is not yet clear if this can even be used
 to crash the machine remote or locally.  to crash the machine remote or locally.
 <br>  <br>
Line 317 
Line 314 
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
 <li><a name="route"></a>  <li><a name="route"></a>
 <font color="#009000"><strong>004: RELIABILITY FIX: May 29, 2000</strong></font><br>  <font color="#009000"><strong>004: RELIABILITY FIX: May 29, 2000</strong></font> &nbsp; <i>All architectures</i><br>
 Certain routing table modifications by the superuser could cause a system panic.  Certain routing table modifications by the superuser could cause a system panic.
 <br>  <br>
 <a href="http://ftp.openbsd.org/pub/OpenBSD/patches/2.7/common/004_route.patch">  <a href="http://ftp.openbsd.org/pub/OpenBSD/patches/2.7/common/004_route.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
 <li><a name="bridge"></a>  <li><a name="bridge"></a>
 <font color="#009000"><strong>003: SECURITY FIX: May 26, 2000</strong></font><br>  <font color="#009000"><strong>003: SECURITY FIX: May 26, 2000</strong></font> &nbsp; <i>All architectures</i><br>
 It is possible to bypass the <i>learning</i> flag on an interface if frames  It is possible to bypass the <i>learning</i> flag on an interface if frames
 go directly to the machine acting as a  go directly to the machine acting as a
 <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=bridge&amp;sektion=4">bridge</a>.  <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=bridge&amp;sektion=4">bridge</a>.
Line 333 
Line 330 
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
 <li><a name="ef"></a>  <li><a name="ef"></a>
 <font color="#009000"><strong>002: DRIVER FIX: May 26, 2000</strong></font><br>  <font color="#009000"><strong>002: DRIVER FIX: May 26, 2000</strong></font> &nbsp; <i>All architectures</i><br>
 The  The
 <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=ef&amp;sektion=4">ef(4)</a>  <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=ef&amp;sektion=4">ef(4)</a>
 driver will complain when adding an address with ifconfig  driver will complain when adding an address with ifconfig
Line 342 
Line 339 
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
 <li><a name="ipf"></a>  <li><a name="ipf"></a>
 <font color="#009000"><strong>001: SECURITY FIX: May 25, 2000</strong></font><br>  <font color="#009000"><strong>001: SECURITY FIX: May 25, 2000</strong></font> &nbsp; <i>All architectures</i><br>
 A misuse of ipf(8)  A misuse of ipf(8)
 <i>keep-state</i> rules can result in firewall rules being bypassed.<br>  <i>keep-state</i> rules can result in firewall rules being bypassed.<br>
 <a href="http://ftp.openbsd.org/pub/OpenBSD/patches/2.7/common/001_ipf.patch">  <a href="http://ftp.openbsd.org/pub/OpenBSD/patches/2.7/common/001_ipf.patch">
Legend:
Removed from v.1.66  
changed lines
  Added in v.1.67