version 1.86, 2017/03/28 04:04:52 |
version 1.87, 2017/03/28 06:41:18 |
|
|
<li id="uucp"> |
<li id="uucp"> |
<font color="#009000"><strong>033: SECURITY FIX: September 11, 2001</strong></font> |
<font color="#009000"><strong>033: SECURITY FIX: September 11, 2001</strong></font> |
<i>All architectures</i><br> |
<i>All architectures</i><br> |
A security hole exists in <a href="http://man.openbsd.org/?query=uuxqt&sektion=8">uuxqt(8)</a> |
A security hole exists in <a href="http://man.openbsd.org/OpenBSD-2.8/uuxqt.8">uuxqt(8)</a> |
that may allow an attacker to run arbitrary commands as user uucp and |
that may allow an attacker to run arbitrary commands as user uucp and |
use this to gain root access. |
use this to gain root access. |
The UUCP execution daemon, uuxqt(8), has a bug in its command line |
The UUCP execution daemon, uuxqt(8), has a bug in its command line |
|
|
<li id="lpd"> |
<li id="lpd"> |
<font color="#009000"><strong>032: SECURITY FIX: August 29, 2001</strong></font> |
<font color="#009000"><strong>032: SECURITY FIX: August 29, 2001</strong></font> |
<i>All architectures</i><br> |
<i>All architectures</i><br> |
A security hole exists in <a href="http://man.openbsd.org/?query=lpd&sektion=8">lpd(8)</a> |
A security hole exists in <a href="http://man.openbsd.org/OpenBSD-2.8/lpd.8">lpd(8)</a> |
that may allow an attacker with line printer access to gain root |
that may allow an attacker with line printer access to gain root |
privileges. A machine must be running lpd to be vulnerable (OpenBSD |
privileges. A machine must be running lpd to be vulnerable (OpenBSD |
does not start lpd by default). Only machines with line printer |
does not start lpd by default). Only machines with line printer |
|
|
<li id="sendmail2"> |
<li id="sendmail2"> |
<font color="#009000"><strong>031: SECURITY FIX: August 21, 2001</strong></font> |
<font color="#009000"><strong>031: SECURITY FIX: August 21, 2001</strong></font> |
<i>All architectures</i><br> |
<i>All architectures</i><br> |
A security hole exists in <a href="http://man.openbsd.org/?query=sendmail&sektion=8">sendmail(8)</a> |
A security hole exists in <a href="http://man.openbsd.org/OpenBSD-2.8/sendmail.8">sendmail(8)</a> |
that may allow an attacker on the local host to gain root privileges by |
that may allow an attacker on the local host to gain root privileges by |
specifying out-of-bounds debug parameters. |
specifying out-of-bounds debug parameters. |
<br> |
<br> |
|
|
<li id="kernexec"> |
<li id="kernexec"> |
<font color="#009000"><strong>030: SECURITY FIX: June 15, 2001</strong></font> |
<font color="#009000"><strong>030: SECURITY FIX: June 15, 2001</strong></font> |
<i>All architectures</i><br> |
<i>All architectures</i><br> |
A race condition exists in the kernel <a href="http://man.openbsd.org/?query=execve&sektion=2&format=html">execve(2)</a> implementation that opens a small window of vulnerability for a non-privileged user to <a href="http://man.openbsd.org/?query=ptrace&sektion=2&format=html">ptrace(2)</a> attach to a suid/sgid process. |
A race condition exists in the kernel <a href="http://man.openbsd.org/OpenBSD-2.8/execve.2">execve(2)</a> implementation that opens a small window of vulnerability for a non-privileged user to <a href="http://man.openbsd.org/OpenBSD-2.8/ptrace.2">ptrace(2)</a> attach to a suid/sgid process. |
<br> |
<br> |
<a href="https://ftp.openbsd.org/pub/OpenBSD/patches/2.8/common/030_kernexec.patch"> |
<a href="https://ftp.openbsd.org/pub/OpenBSD/patches/2.8/common/030_kernexec.patch"> |
A source code patch exists which remedies this problem.</a> |
A source code patch exists which remedies this problem.</a> |
|
|
<li id="fts"> |
<li id="fts"> |
<font color="#009000"><strong>029: SECURITY FIX: May 30, 2001</strong></font> |
<font color="#009000"><strong>029: SECURITY FIX: May 30, 2001</strong></font> |
<i>All architectures</i><br> |
<i>All architectures</i><br> |
Programs using the <a href="http://man.openbsd.org/?query=fts&sektion=3&format=html">fts(3)</a> |
Programs using the <a href="http://man.openbsd.org/OpenBSD-2.8/fts.3">fts(3)</a> |
routines (such as rm, find, and most programs that take a <b>-R</b> |
routines (such as rm, find, and most programs that take a <b>-R</b> |
flag) can be tricked into changing into the wrong directory if the |
flag) can be tricked into changing into the wrong directory if the |
parent dir is changed out from underneath it. This is similar to |
parent dir is changed out from underneath it. This is similar to |
|
|
<li id="sendmail"> |
<li id="sendmail"> |
<font color="#009000"><strong>028: SECURITY FIX: May 29, 2001</strong></font> |
<font color="#009000"><strong>028: SECURITY FIX: May 29, 2001</strong></font> |
<i>All architectures</i><br> |
<i>All architectures</i><br> |
The signal handlers in <a href="http://man.openbsd.org/?query=sen |
The signal handlers in <a href="http://man.openbsd.org/OpenBSD-2.8/sendmail.8">sendmail(8)</a> contain code that is unsafe in the |
dmail&sektion=8&format=html">sendmail(8)</a> contain code that is unsafe in the |
|
context of a signal handler. This leads to potentially serious |
context of a signal handler. This leads to potentially serious |
race conditions. At the moment this is a theoretical attack only |
race conditions. At the moment this is a theoretical attack only |
and can only be exploited on the local host (if at all).<br> |
and can only be exploited on the local host (if at all).<br> |
|
|
<li id="glob_limit"> |
<li id="glob_limit"> |
<font color="#009000"><strong>026: SECURITY FIX: Apr 23, 2001</strong></font> |
<font color="#009000"><strong>026: SECURITY FIX: Apr 23, 2001</strong></font> |
<i>All architectures</i><br> |
<i>All architectures</i><br> |
<a href="http://man.openbsd.org/?query=glob&sektion=3">ftpd(8)</a> has a potential DoS related to <a href="http://man.openbsd.org/?query=glob&sektion=3">glob(3)</a>. This patch introduces a GLOB_LIMIT, eliminating the DoS. You must have <a href="#glob">025_glob.patch</a> installed before installing this patch.<br> |
<a href="http://man.openbsd.org/OpenBSD-2.8/glob.3">ftpd(8)</a> has a potential DoS related to <a href="http://man.openbsd.org/OpenBSD-2.8/glob.3">glob(3)</a>. This patch introduces a GLOB_LIMIT, eliminating the DoS. You must have <a href="#glob">025_glob.patch</a> installed before installing this patch.<br> |
<a href="https://ftp.openbsd.org/pub/OpenBSD/patches/2.8/common/026_globlimit.patch"> |
<a href="https://ftp.openbsd.org/pub/OpenBSD/patches/2.8/common/026_globlimit.patch"> |
A source code patch exists which remedies this problem.</a> |
A source code patch exists which remedies this problem.</a> |
<p> |
<p> |
<li id="glob"> |
<li id="glob"> |
<font color="#009000"><strong>025: SECURITY FIX: Apr 10, 2001</strong></font> |
<font color="#009000"><strong>025: SECURITY FIX: Apr 10, 2001</strong></font> |
<i>All architectures</i><br> |
<i>All architectures</i><br> |
<a href="http://man.openbsd.org/?query=glob&sektion=3">glob(3)</a> contains multiple buffer overflows. <br> |
<a href="http://man.openbsd.org/OpenBSD-2.8/glob.3">glob(3)</a> contains multiple buffer overflows. <br> |
<a href="https://ftp.openbsd.org/pub/OpenBSD/patches/2.8/common/025_glob.patch"> |
<a href="https://ftp.openbsd.org/pub/OpenBSD/patches/2.8/common/025_glob.patch"> |
A source code patch exists which remedies this problem.</a> |
A source code patch exists which remedies this problem.</a> |
<p> |
<p> |
|
|
<i>All architectures</i><br> |
<i>All architectures</i><br> |
The readline library shipped with OpenBSD allows history files creation |
The readline library shipped with OpenBSD allows history files creation |
with a permissive |
with a permissive |
<a href="http://man.openbsd.org/?query=umask&sektion=2">umask(2)</a>. |
<a href="http://man.openbsd.org/OpenBSD-2.8/umask.2">umask(2)</a>. |
This can lead to the leakage of sensitive information in applications |
This can lead to the leakage of sensitive information in applications |
that use passwords and the like during user interaction (one such |
that use passwords and the like during user interaction (one such |
application is mysql).<br> |
application is mysql).<br> |
|
|
<font color="#009000"><strong>021: SECURITY FIX: Feb 22, 2001</strong></font> |
<font color="#009000"><strong>021: SECURITY FIX: Feb 22, 2001</strong></font> |
<i>All architectures</i><br> |
<i>All architectures</i><br> |
There is an exploitable heap corruption bug in |
There is an exploitable heap corruption bug in |
<a href="http://man.openbsd.org/?query=sudo&sektion=8">sudo</a>. |
<a href="http://man.openbsd.org/OpenBSD-2.8/sudo.8">sudo</a>. |
<br> |
<br> |
<a href="https://ftp.openbsd.org/pub/OpenBSD/patches/2.8/common/021_sudo.patch"> |
<a href="https://ftp.openbsd.org/pub/OpenBSD/patches/2.8/common/021_sudo.patch"> |
A source code patch exists which remedies this problem.</a> |
A source code patch exists which remedies this problem.</a> |
|
|
<li id="libwrap"> |
<li id="libwrap"> |
<font color="#009000"><strong>020: IMPLEMENTATION FIX: Feb 15, 2001</strong></font> |
<font color="#009000"><strong>020: IMPLEMENTATION FIX: Feb 15, 2001</strong></font> |
<i>All architectures</i><br> |
<i>All architectures</i><br> |
Client side ident protocol was broken in libwrap, affecting anything using libwrap including <a href="http://man.openbsd.org/?query=tcpd&sektion=8">tcpd</a>. The effect of this was that libwrap would never retrieve and log ident values from remote hosts on connections.<br> |
Client side ident protocol was broken in libwrap, affecting anything using libwrap including <a href="http://man.openbsd.org/OpenBSD-2.8/tcpd.8">tcpd</a>. The effect of this was that libwrap would never retrieve and log ident values from remote hosts on connections.<br> |
<a href="https://ftp.openbsd.org/pub/OpenBSD/patches/2.8/common/020_libwrap.patch"> |
<a href="https://ftp.openbsd.org/pub/OpenBSD/patches/2.8/common/020_libwrap.patch"> |
A source code patch exists which remedies this problem.</a> |
A source code patch exists which remedies this problem.</a> |
<p> |
<p> |
<li id="lepci"> |
<li id="lepci"> |
<font color="#009000"><strong>019: IMPLEMENTATION FIX: Jan 31, 2001</strong></font> |
<font color="#009000"><strong>019: IMPLEMENTATION FIX: Jan 31, 2001</strong></font> |
<i>All architectures</i><br> |
<i>All architectures</i><br> |
Fix memory allocation in the PCI LANCE driver, <a href="http://man.openbsd.org/?query=le&sektion=4&arch=i386">le</a>. A side effect of this is that OpenBSD under VMWare now works again.<br> |
Fix memory allocation in the PCI LANCE driver, <a href="http://man.openbsd.org/OpenBSD-2.8/le.4">le</a>. A side effect of this is that OpenBSD under VMWare now works again.<br> |
<a href="https://ftp.openbsd.org/pub/OpenBSD/patches/2.8/common/019_lepci.patch"> |
<a href="https://ftp.openbsd.org/pub/OpenBSD/patches/2.8/common/019_lepci.patch"> |
A source code patch exists which remedies this problem.</a> |
A source code patch exists which remedies this problem.</a> |
<p> |
<p> |
<li id="named"> |
<li id="named"> |
<font color="#009000"><strong>018: SECURITY FIX: Jan 29, 2001</strong></font> |
<font color="#009000"><strong>018: SECURITY FIX: Jan 29, 2001</strong></font> |
<i>All architectures</i><br> |
<i>All architectures</i><br> |
Merge <a href="http://man.openbsd.org/?query=named&sektion=8">named</a> |
Merge <a href="http://man.openbsd.org/OpenBSD-2.8/named.8">named</a> |
with ISC BIND 4.9.8-REL, which fixes some buffer vulnerabilities (actually it appears |
with ISC BIND 4.9.8-REL, which fixes some buffer vulnerabilities (actually it appears |
that these were already impossible to exploit beforehand).<br> |
that these were already impossible to exploit beforehand).<br> |
<a href="https://ftp.openbsd.org/pub/OpenBSD/patches/2.8/common/018_named.patch"> |
<a href="https://ftp.openbsd.org/pub/OpenBSD/patches/2.8/common/018_named.patch"> |
|
|
<li id="rnd"> |
<li id="rnd"> |
<font color="#009000"><strong>017: SECURITY FIX: Jan 22, 2001</strong></font> |
<font color="#009000"><strong>017: SECURITY FIX: Jan 22, 2001</strong></font> |
<i>All architectures</i><br> |
<i>All architectures</i><br> |
The <a href="http://man.openbsd.org/?query=random&sektion=4">rnd(4)</a> device does not use all of its input when data is written to it.<br> |
The <a href="http://man.openbsd.org/OpenBSD-2.8/random.4">rnd(4)</a> device does not use all of its input when data is written to it.<br> |
<a href="https://ftp.openbsd.org/pub/OpenBSD/patches/2.8/common/017_rnd.patch"> |
<a href="https://ftp.openbsd.org/pub/OpenBSD/patches/2.8/common/017_rnd.patch"> |
A source code patch exists which remedies this problem.</a> |
A source code patch exists which remedies this problem.</a> |
<p> |
<p> |
|
|
<li id="procfs"> |
<li id="procfs"> |
<font color="#009000"><strong>013: SECURITY FIX: Dec 18, 2000</strong></font> |
<font color="#009000"><strong>013: SECURITY FIX: Dec 18, 2000</strong></font> |
<i>All architectures</i><br> |
<i>All architectures</i><br> |
<a href="http://man.openbsd.org/?query=mount_procfs&sektion=8">Procfs</a> contained numerous overflows, which could lead an intruder to root permissions. Procfs is NOT enabled by default in OpenBSD. <br> |
<a href="http://man.openbsd.org/OpenBSD-2.8/mount_procfs.8">Procfs</a> contained numerous overflows, which could lead an intruder to root permissions. Procfs is NOT enabled by default in OpenBSD. <br> |
<a href="https://ftp.openbsd.org/pub/OpenBSD/patches/2.8/common/013_procfs.patch"> |
<a href="https://ftp.openbsd.org/pub/OpenBSD/patches/2.8/common/013_procfs.patch"> |
A source code patch exists which remedies this problem.</a> |
A source code patch exists which remedies this problem.</a> |
<p> |
<p> |