[BACK]Return to errata29.html CVS log [TXT][DIR] Up to [local] / www

Diff for /www/errata29.html between version 1.2 and 1.3

version 1.2, 2001/11/14 01:38:00 version 1.3, 2001/11/14 21:33:10
Line 52 
Line 52 
 A security issue exists in the vi.recover script that may allow an attacker  A security issue exists in the vi.recover script that may allow an attacker
 to remove arbitrary zero-length files, regardless of ownership.  to remove arbitrary zero-length files, regardless of ownership.
 <br>  <br>
 <a href="ftp://ftp.openbsd.org/pub/OpenBSD/patches/2.9/common/016_recover.patch">A source code patch exists which remedies the problem</a>  <a href="ftp://ftp.openbsd.org/pub/OpenBSD/patches/2.9/common/016_recover.patch">A source code patch exists which remedies the problem</a>.
 <p>  <p>
 <a name=uucp>  <a name=uucp>
 <li><font color=#009000><strong>015: SECURITY FIX: September 11, 2001</strong></font><br>  <li><font color=#009000><strong>015: SECURITY FIX: September 11, 2001</strong></font><br>
Line 64 
Line 64 
 some UUCP commands are run as root (and daemon) from cron it is possible  some UUCP commands are run as root (and daemon) from cron it is possible
 to leverage compromise of the UUCP user to gain root.  to leverage compromise of the UUCP user to gain root.
 <br>  <br>
 <a href="ftp://ftp.openbsd.org/pub/OpenBSD/patches/2.9/common/015_uucp.patch">A source code patch exists which remedies the problem</a>  <a href="ftp://ftp.openbsd.org/pub/OpenBSD/patches/2.9/common/015_uucp.patch">A source code patch exists which remedies the problem</a>.
 <p>  <p>
 <a name=lpd>  <a name=lpd>
 <li><font color=#009000><strong>014: SECURITY FIX: August 29, 2001</strong></font><br>  <li><font color=#009000><strong>014: SECURITY FIX: August 29, 2001</strong></font><br>
Line 75 
Line 75 
 access (ie: listed in either /etc/hosts.lpd or /etc/hosts.equiv)  access (ie: listed in either /etc/hosts.lpd or /etc/hosts.equiv)
 may be used to mount an attack.  may be used to mount an attack.
 <br>  <br>
 <a href="ftp://ftp.openbsd.org/pub/OpenBSD/patches/2.9/common/014_lpd.patch">A source code patch exists which remedies the problem</a>  <a href="ftp://ftp.openbsd.org/pub/OpenBSD/patches/2.9/common/014_lpd.patch">A source code patch exists which remedies the problem</a>.
 <p>  <p>
 <a name=sendmail2>  <a name=sendmail2>
 <li><font color=#009000><strong>013: SECURITY FIX: August 21, 2001</strong></font><br>  <li><font color=#009000><strong>013: SECURITY FIX: August 21, 2001</strong></font><br>
Line 83 
Line 83 
 that may allow an attacker on the local host to gain root privileges by  that may allow an attacker on the local host to gain root privileges by
 specifying out-of-bounds debug parameters.  specifying out-of-bounds debug parameters.
 <br>  <br>
 <a href="ftp://ftp.openbsd.org/pub/OpenBSD/patches/2.9/common/013_sendmail.patch">A source code patch exists which remedies the problem</a>  <a href="ftp://ftp.openbsd.org/pub/OpenBSD/patches/2.9/common/013_sendmail.patch">A source code patch exists which remedies the problem</a>.
 <p>  <p>
 <a name=nfs>  <a name=nfs>
 <li><font color=#009000><strong>012: SECURITY FIX: July 30, 2001</strong></font><br>  <li><font color=#009000><strong>012: SECURITY FIX: July 30, 2001</strong></font><br>
Line 93 
Line 93 
 privileges can initiate this attack.  In default installs, only super-user has  privileges can initiate this attack.  In default installs, only super-user has
 mount privileges.  The kern.usermount <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=sysctl&sektion=3">sysctl(3)</a> controls whether other users have mount privileges.  mount privileges.  The kern.usermount <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=sysctl&sektion=3">sysctl(3)</a> controls whether other users have mount privileges.
 <br>  <br>
 <a href="ftp://ftp.openbsd.org/pub/OpenBSD/patches/2.9/common/012_nfs.patch">A source code patch exists which remedies the problem</a>  <a href="ftp://ftp.openbsd.org/pub/OpenBSD/patches/2.9/common/012_nfs.patch">A source code patch exists which remedies the problem</a>.
 <p>  <p>
 <a name=pkg></a>  <a name=pkg></a>
 <li><font color=#009000><strong>011: RELIABILITY FIX: July 15, 2001</strong></font>  <li><font color=#009000><strong>011: RELIABILITY FIX: July 15, 2001</strong></font>
Legend:
Removed from v.1.2  
changed lines
  Added in v.1.3