[BACK]Return to errata30.html CVS log [TXT][DIR] Up to [local] / www

Diff for /www/errata30.html between version 1.105 and 1.106

version 1.105, 2019/05/27 22:55:19 version 1.106, 2019/05/28 16:32:41
Line 84 
Line 84 
 <hr>  <hr>
   
 <ul>  <ul>
 <li id="named">  
 <strong>036: SECURITY FIX: November 14, 2002</strong>  <li id="hosts">
   <strong>001: INSTALL ISSUE: November 12, 2001</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 A buffer overflow in  A small bug in the installation script causes the <code>/etc/hosts</code> file to
 <a href="https://man.openbsd.org/OpenBSD-3.0/named.8">named(8)</a>  be incorrectly formed.<br>
 could allow an attacker to execute code with the privileges of named.  The resulting file contains a line which reads like:<p>
 On OpenBSD, named runs as a non-root user in a chrooted environment  <code>&nbsp;&nbsp;&nbsp;#.#.#.# hostname. hostname</code>
 which mitigates the effects of this bug.<br>  
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.0/common/036_named.patch">  
 A source code patch exists which remedies this problem.</a>  
 <p>  <p>
 <li id="kernresource">  This line should actually read something like:<p>
 <strong>035: SECURITY FIX: November 6, 2002</strong>  <code>&nbsp;&nbsp;&nbsp;#.#.#.# hostname.domainname.com hostname</code>
   <p>
   To correct this problem, simply edit the file and insert the domainname in
   the required place.
   <p>
   
   <li id="sshd">
   <strong>002: SECURITY FIX: November 12, 2001</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 Incorrect argument checking in the  <a href="https://man.openbsd.org/OpenBSD-3.0/sshd.8">sshd(8)</a>
 <a href="https://man.openbsd.org/OpenBSD-3.0/getrlimit.2">getrlimit(2)</a>  is being upgraded from OpenSSH 3.0 to OpenSSH 3.0.2 to fix a few problems:
 system call may allow an attacker to crash the kernel.<br>  <p>
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.0/common/035_kernresource.patch">  <ul>
   <li>A security hole that may allow an attacker to partially authenticate
   if -- and only if -- the administrator has enabled KerberosV.
   <br>
   By default, OpenSSH KerberosV support only becomes active after KerberosV
   has been properly configured.
   <p>
   <li>An excessive memory clearing bug (which we believe to be unexploitable)
   also exists, but since this may cause daemon crashes, we are providing a
   patch as well.
   <p>
   <li>A vulnerability in environment passing in the <code>UseLogin</code>
   <i>sshd</i> option
   <p>
   <li>Various other non-critical fixes.
   </ul>
   <p>
   Effectively an upgrade of OpenSSH 3.0 to OpenSSH 3.0.2.
   <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.0/common/002_ssh2.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
   This is the second version of this patch.
 <p>  <p>
 <li id="smrsh">  
 <strong>034: SECURITY FIX: November 6, 2002</strong>  <li id="sparc64cd">
 &nbsp; <i>All architectures</i><br>  <strong>003: RELIABILITY FIX: November 12, 2001</strong>
 An attacker can bypass the restrictions imposed by sendmail's restricted shell,  <br>
 <a href="https://man.openbsd.org/OpenBSD-3.0/smrsh.8">smrsh(8)</a>,  Access to a CD drive on the PCI ultrasparc machines results in a continuous stream
 and execute arbitrary commands with the privileges of his own account.<br>  of bogus interrupt messages, causing great user anguish.
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.0/common/034_smrsh.patch">  <br>
   <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.0/sparc64/003_sparc64cd.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
 <li id="kadmin">  
 <strong>033: SECURITY FIX: October 21, 2002</strong>  <li id="hifn">
 &nbsp; <i>All architectures</i><br>  <strong>004: RELIABILITY FIX: November 12, 2001</strong>
 A buffer overflow can occur in the  <br>
 <a href="https://man.openbsd.org/OpenBSD-3.0/kadmind.8">kadmind(8)</a>  Hifn7751 based cards may stop working on certain motherboards due to
 daemon, leading to possible remote crash or exploit.<br>  DMA errors.
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.0/common/033_kadmin.patch">  <br>
   <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.0/i386/004_hifn.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
 <li id="kerntime">  
 <strong>032: SECURITY FIX: October 7, 2002</strong>  <li id="altivec">
 &nbsp; <i>All architectures</i><br>  <strong>005: RELIABILITY FIX: November 12, 2001</strong>
 Incorrect argument checking in the  <br>
 <a href="https://man.openbsd.org/OpenBSD-3.0/setitimer.2">setitimer(2)</a> system call may allow an attacker to write to kernel memory.<br>  Execution of Altivec instructions will crash the kernel.
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.0/common/032_kerntime.patch">  <br>
   <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.0/macppc/005_altivec.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
 <li id="scarg">  
 <strong>031: SECURITY FIX: August 11, 2002</strong>  <li id="pf">
   <strong>006: SECURITY FIX: November 13, 2001</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 An insufficient boundary check in the  <a href="https://man.openbsd.org/OpenBSD-3.0/pf.4">pf(4)</a>
 <a href="https://man.openbsd.org/OpenBSD-3.0/select.2">select(2)</a>  was incapable of dealing with certain ipv6 icmp packets, resulting in a crash.
 system call allows an attacker to overwrite kernel memory and execute arbitrary  <br>
 code in kernel context.<br>  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.0/common/006_pf.patch">
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.0/common/031_scarg.patch">  
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
 <li id="ssl">  
 <strong>030: SECURITY FIX: July 30, 2002</strong>  <li id="vi.recover">
   <strong>007: SECURITY FIX: November 13, 2001</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 Several remote buffer overflows can occur in the SSL2 server and SSL3 client of the  A security issue exists in the vi.recover script that may allow an attacker
 <a href="https://man.openbsd.org/OpenBSD-3.0/ssl.8">ssl(8)</a>  to remove arbitrary zero-length files, regardless of ownership.
 library, as in the ASN.1 parser code in the  
 <a href="https://man.openbsd.org/OpenBSD-3.0/crypto.3">crypto(3)</a>  
 library, all of them being potentially remotely exploitable.<br>  
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.0/common/030_ssl.patch">  
 A source code patch exists which remedies this problem.</a>  
 <br>  <br>
 This is the second version of the patch.  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.0/common/007_recover.patch">
   A source code patch exists which remedies this problem.</a>
 <p>  <p>
 <li id="xdr">  
 <strong>029: SECURITY FIX: July 29, 2002</strong>  <li id="lpd">
   <strong>008: SECURITY FIX: November 28, 2001</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 A buffer overflow can occur in the  A security issue exists in the lpd daemon that may allow an attacker
 <a href="https://man.openbsd.org/OpenBSD-3.0/xdr_array.3">xdr_array(3)</a>  to create arbitrary new files in the root directory.  Only machines
 RPC code, leading to possible remote crash.<br>  with line printer access (ie: listed in either /etc/hosts.lpd or
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.0/common/029_xdr.patch">  /etc/hosts.equiv) may be used to mount an attack and the attacker
   must have root access on the machine.  OpenBSD does not start lpd
   in the default installation.<br>
   <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.0/common/008_lpd.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
   <p>
   
   <li id="macppcinstall">
   <strong>009: INSTALLATION FIX: December 11, 2001</strong>
 <br>  <br>
 This is the second version of the patch.  The 3.0 CD2 was created with an error which means that the instructions
   for booting this architecture will not work.  Instead, to boot the
   CD, press Option-Command-O-F during power up to get into OpenFirmware
   and then type:
   <br>
   <code>boot cd:,OFWBOOT /3.0/macppc/bsd.rd</code>
 <p>  <p>
 <li id="pppd">  
 <strong>028: SECURITY FIX: July 29, 2002</strong>  <li id="ipip">
   <strong>010: RELIABILITY FIX: December 13, 2001</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 A race condition exists in the  Systems running with IP-in-IP encapsulation can be made to crash by
 <a href="https://man.openbsd.org/OpenBSD-3.0/pppd.8">pppd(8)</a>  malformed packets.<br>
 daemon which may cause it to alter the file permissions of an arbitrary file.<br>  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.0/common/010_ipip.patch">
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.0/common/028_pppd.patch">  
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
 <li id="isakmpd2">  
 <strong>027: RELIABILITY FIX: July 5, 2002</strong>  <li id="sudo">
   <strong>011: SECURITY FIX: January 17, 2002</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 Receiving IKE payloads out of sequence can cause  If the Postfix sendmail replacement is installed on a system an
 <a href="https://man.openbsd.org/OpenBSD-3.0/isakmpd.8">isakmpd(8)</a> to crash.<br>  attacker may be able to gain root privileges on the local host via
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.0/common/027_isakmpd.patch">  sudo(8) which runs the mailer as root with an environment inherited
   from the invoking user.  While this is a bug in sudo it is not
   believed to be possible to exploit when sendmail (the mailer that
   ships with OpenBSD) is the mailer.  As of version 1.6.5, sudo passes
   the mailer an environment that is not subject to influence from the
   invoking user.<br>
   <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.0/common/011_sudo.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <br>  
 This is the second version of the patch.  
 <p>  <p>
 <li id="ktrace">  
 <strong>026: SECURITY FIX: June 27, 2002</strong>  <li id="ptrace">
   <strong>012: SECURITY FIX: January 21, 2002</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 The kernel would let any user <a href="https://man.openbsd.org/OpenBSD-3.0/ktrace.2">ktrace(2)</a> set[ug]id processes.<br>  A race condition between the ptrace(2) and execve(2) system calls allows
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.0/common/026_ktrace.patch">  an attacker to modify the memory contents of suid/sgid processes which
   could lead to compromise of the super-user account.<br>
   <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.0/common/012_ptrace.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
 <li id="resolver">  
 <strong>025: SECURITY FIX: June 25, 2002</strong>  <li id="syspipe">
   <strong>013: RELIABILITY FIX: February 4, 2002</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 A potential buffer overflow in the DNS resolver has been found.<br>  The wrong filedescriptors are released when pipe(2) failed.<br>
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.0/common/025_resolver.patch">  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.0/common/013_syspipe.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
 <li id="sshdauth">  
 <strong>024: SECURITY FIX: June 24, 2002</strong>  <li id="openssh">
   <strong>014: SECURITY FIX: March 8, 2002</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 All versions of OpenSSH's sshd between 2.3.1 and 3.3 contain an input validation  A local user can gain super-user privileges due to an off-by-one check
 error that can result in an integer overflow and privilege escalation.  in the channel forwarding code of OpenSSH.<br>
 This problem is fixed in <a href="https://www.openssh.com/openbsd.html">OpenSSH  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.0/common/014_openssh.patch">
 3.4</a>, and a patch for the vulnerable releases is available as part of the  A source code patch exists which remedies this problem.</a>
 <a href="https://www.openssh.com/txt/preauth.adv">security advisory</a>.  
 <p>  <p>
 <li id="modssl">  
 <strong>023: SECURITY FIX: June 24, 2002</strong>  <li id="zlib">
   <strong>015: RELIABILITY FIX: March 13, 2002</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 A buffer overflow can occur in the .htaccess parsing code in mod_ssl httpd  Under some circumstances the zlib compression library can free dynamically
 module, leading to possible remote crash or exploit.<br>  allocated memory twice.  This is not a security issue on OpenBSD since the BSD
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.0/common/023_mod_ssl.patch">  <a href="https://man.openbsd.org/OpenBSD-3.0/free.3">free(3)</a>
   function detects this.
   There is also a kernel zlib component that may be used by pppd and IPsec.
   The feasibility of attacking the kernel this way is currently unknown.<br>
   <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.0/common/015_zlib.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
 <li id="httpd">  
 <strong>022: SECURITY FIX: June 19, 2002</strong>  <li id="approval">
   <strong>016: SECURITY FIX: March 19, 2002</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 A buffer overflow can occur during the interpretation of chunked  Under certain conditions, on systems using YP with netgroups in the password
 encoding in the http daemon, leading to possible remote crash or exploit.<br>  database, it is possible for the
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.0/common/022_httpd.patch">  <a href="https://man.openbsd.org/OpenBSD-3.0/rexecd.8">rexecd(8)</a>
   and
   <a href="https://man.openbsd.org/OpenBSD-3.0/rshd.8">rshd(8)</a>
   daemons to execute the shell from a different user's password entry.
   Due to a similar problem,
   <a href="https://man.openbsd.org/OpenBSD-3.0/atrun.8">atrun(8)</a>
   may change to the wrong home directory when running
   <a href="https://man.openbsd.org/OpenBSD-3.0/at.1">at(1)</a>
   jobs.<br>
   <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.0/common/016_approval.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
 <li id="fdalloc2">  
 <strong>021: SECURITY FIX: May 8, 2002</strong>  <li id="isakmpd">
   <strong>017: RELIABILITY FIX: March 26, 2002</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 A race condition exists where an attacker could fill the file descriptor  <a href="https://man.openbsd.org/OpenBSD-3.0/isakmpd.8">isakmpd(8)</a>
 table and defeat the kernel's protection of fd slots 0, 1, and 2 for a  will crash when receiving a zero length IKE packet due to a too-late length check.
 setuid or setgid process.<br>  <br>
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.0/common/021_fdalloc2.patch">  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.0/common/017_isakmpd.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
 <li id="sudo2">  
 <strong>020: SECURITY FIX: April 25, 2002</strong>  <li id="mail">
   <strong>018: SECURITY FIX: April 11, 2002</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 A bug in <a href="https://man.openbsd.org/OpenBSD-3.0/sudo.8">sudo(8)</a> may allow an attacker to corrupt the heap by specifying a custom prompt.<br>  <a href="https://man.openbsd.org/OpenBSD-3.0/mail.1">mail(1)</a>
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.0/common/020_sudo.patch">  will process tilde escapes even in non-interactive mode.
   This can lead to a local root compromise.
   <br>
   <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.0/common/018_mail.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
   
 <li id="sshafs">  <li id="sshafs">
 <strong>019: SECURITY FIX: April 22, 2002</strong>  <strong>019: SECURITY FIX: April 22, 2002</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
Line 250 
Line 317 
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.0/common/019_sshafs.patch">  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.0/common/019_sshafs.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
 <li id="mail">  
 <strong>018: SECURITY FIX: April 11, 2002</strong>  <li id="sudo2">
   <strong>020: SECURITY FIX: April 25, 2002</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 <a href="https://man.openbsd.org/OpenBSD-3.0/mail.1">mail(1)</a>  A bug in <a href="https://man.openbsd.org/OpenBSD-3.0/sudo.8">sudo(8)</a> may allow an attacker to corrupt the heap by specifying a custom prompt.<br>
 will process tilde escapes even in non-interactive mode.  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.0/common/020_sudo.patch">
 This can lead to a local root compromise.  
 <br>  
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.0/common/018_mail.patch">  
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
 <li id="isakmpd">  
 <strong>017: RELIABILITY FIX: March 26, 2002</strong>  <li id="fdalloc2">
   <strong>021: SECURITY FIX: May 8, 2002</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 <a href="https://man.openbsd.org/OpenBSD-3.0/isakmpd.8">isakmpd(8)</a>  A race condition exists where an attacker could fill the file descriptor
 will crash when receiving a zero length IKE packet due to a too-late length check.  table and defeat the kernel's protection of fd slots 0, 1, and 2 for a
 <br>  setuid or setgid process.<br>
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.0/common/017_isakmpd.patch">  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.0/common/021_fdalloc2.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
 <li id="approval">  
 <strong>016: SECURITY FIX: March 19, 2002</strong>  <li id="httpd">
   <strong>022: SECURITY FIX: June 19, 2002</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 Under certain conditions, on systems using YP with netgroups in the password  A buffer overflow can occur during the interpretation of chunked
 database, it is possible for the  encoding in the http daemon, leading to possible remote crash or exploit.<br>
 <a href="https://man.openbsd.org/OpenBSD-3.0/rexecd.8">rexecd(8)</a>  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.0/common/022_httpd.patch">
 and  
 <a href="https://man.openbsd.org/OpenBSD-3.0/rshd.8">rshd(8)</a>  
 daemons to execute the shell from a different user's password entry.  
 Due to a similar problem,  
 <a href="https://man.openbsd.org/OpenBSD-3.0/atrun.8">atrun(8)</a>  
 may change to the wrong home directory when running  
 <a href="https://man.openbsd.org/OpenBSD-3.0/at.1">at(1)</a>  
 jobs.<br>  
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.0/common/016_approval.patch">  
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
 <li id="zlib">  
 <strong>015: RELIABILITY FIX: March 13, 2002</strong>  <li id="modssl">
   <strong>023: SECURITY FIX: June 24, 2002</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 Under some circumstances the zlib compression library can free dynamically  A buffer overflow can occur in the .htaccess parsing code in mod_ssl httpd
 allocated memory twice.  This is not a security issue on OpenBSD since the BSD  module, leading to possible remote crash or exploit.<br>
 <a href="https://man.openbsd.org/OpenBSD-3.0/free.3">free(3)</a>  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.0/common/023_mod_ssl.patch">
 function detects this.  
 There is also a kernel zlib component that may be used by pppd and IPsec.  
 The feasibility of attacking the kernel this way is currently unknown.<br>  
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.0/common/015_zlib.patch">  
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
 <li id="openssh">  
 <strong>014: SECURITY FIX: March 8, 2002</strong>  <li id="sshdauth">
   <strong>024: SECURITY FIX: June 24, 2002</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 A local user can gain super-user privileges due to an off-by-one check  All versions of OpenSSH's sshd between 2.3.1 and 3.3 contain an input validation
 in the channel forwarding code of OpenSSH.<br>  error that can result in an integer overflow and privilege escalation.
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.0/common/014_openssh.patch">  This problem is fixed in <a href="https://www.openssh.com/openbsd.html">OpenSSH
 A source code patch exists which remedies this problem.</a>  3.4</a>, and a patch for the vulnerable releases is available as part of the
   <a href="https://www.openssh.com/txt/preauth.adv">security advisory</a>.
 <p>  <p>
 <li id="syspipe">  
 <strong>013: RELIABILITY FIX: February 4, 2002</strong>  <li id="resolver">
   <strong>025: SECURITY FIX: June 25, 2002</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 The wrong filedescriptors are released when pipe(2) failed.<br>  A potential buffer overflow in the DNS resolver has been found.<br>
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.0/common/013_syspipe.patch">  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.0/common/025_resolver.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
 <li id="ptrace">  
 <strong>012: SECURITY FIX: January 21, 2002</strong>  <li id="ktrace">
   <strong>026: SECURITY FIX: June 27, 2002</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 A race condition between the ptrace(2) and execve(2) system calls allows  The kernel would let any user <a href="https://man.openbsd.org/OpenBSD-3.0/ktrace.2">ktrace(2)</a> set[ug]id processes.<br>
 an attacker to modify the memory contents of suid/sgid processes which  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.0/common/026_ktrace.patch">
 could lead to compromise of the super-user account.<br>  
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.0/common/012_ptrace.patch">  
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
 <li id="sudo">  
 <strong>011: SECURITY FIX: January 17, 2002</strong>  <li id="isakmpd2">
   <strong>027: RELIABILITY FIX: July 5, 2002</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 If the Postfix sendmail replacement is installed on a system an  Receiving IKE payloads out of sequence can cause
 attacker may be able to gain root privileges on the local host via  <a href="https://man.openbsd.org/OpenBSD-3.0/isakmpd.8">isakmpd(8)</a> to crash.<br>
 sudo(8) which runs the mailer as root with an environment inherited  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.0/common/027_isakmpd.patch">
 from the invoking user.  While this is a bug in sudo it is not  
 believed to be possible to exploit when sendmail (the mailer that  
 ships with OpenBSD) is the mailer.  As of version 1.6.5, sudo passes  
 the mailer an environment that is not subject to influence from the  
 invoking user.<br>  
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.0/common/011_sudo.patch">  
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
   <br>
   This is the second version of the patch.
 <p>  <p>
 <li id="ipip">  
 <strong>010: RELIABILITY FIX: December 13, 2001</strong>  <li id="pppd">
   <strong>028: SECURITY FIX: July 29, 2002</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 Systems running with IP-in-IP encapsulation can be made to crash by  A race condition exists in the
 malformed packets.<br>  <a href="https://man.openbsd.org/OpenBSD-3.0/pppd.8">pppd(8)</a>
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.0/common/010_ipip.patch">  daemon which may cause it to alter the file permissions of an arbitrary file.<br>
   <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.0/common/028_pppd.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
 <li id="macppcinstall">  
 <strong>009: INSTALLATION FIX: December 11, 2001</strong>  <li id="xdr">
   <strong>029: SECURITY FIX: July 29, 2002</strong>
   &nbsp; <i>All architectures</i><br>
   A buffer overflow can occur in the
   <a href="https://man.openbsd.org/OpenBSD-3.0/xdr_array.3">xdr_array(3)</a>
   RPC code, leading to possible remote crash.<br>
   <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.0/common/029_xdr.patch">
   A source code patch exists which remedies this problem.</a>
 <br>  <br>
 The 3.0 CD2 was created with an error which means that the instructions  This is the second version of the patch.
 for booting this architecture will not work.  Instead, to boot the  
 CD, press Option-Command-O-F during power up to get into OpenFirmware  
 and then type:  
 <br>  
 <code>boot cd:,OFWBOOT /3.0/macppc/bsd.rd</code>  
 <p>  <p>
 <li id="lpd">  
 <strong>008: SECURITY FIX: November 28, 2001</strong>  <li id="ssl">
   <strong>030: SECURITY FIX: July 30, 2002</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 A security issue exists in the lpd daemon that may allow an attacker  Several remote buffer overflows can occur in the SSL2 server and SSL3 client of the
 to create arbitrary new files in the root directory.  Only machines  <a href="https://man.openbsd.org/OpenBSD-3.0/ssl.8">ssl(8)</a>
 with line printer access (ie: listed in either /etc/hosts.lpd or  library, as in the ASN.1 parser code in the
 /etc/hosts.equiv) may be used to mount an attack and the attacker  <a href="https://man.openbsd.org/OpenBSD-3.0/crypto.3">crypto(3)</a>
 must have root access on the machine.  OpenBSD does not start lpd  library, all of them being potentially remotely exploitable.<br>
 in the default installation.<br>  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.0/common/030_ssl.patch">
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.0/common/008_lpd.patch">  
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
   <br>
   This is the second version of the patch.
 <p>  <p>
 <li id="vi.recover">  
 <strong>007: SECURITY FIX: November 13, 2001</strong>  <li id="scarg">
   <strong>031: SECURITY FIX: August 11, 2002</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 A security issue exists in the vi.recover script that may allow an attacker  An insufficient boundary check in the
 to remove arbitrary zero-length files, regardless of ownership.  <a href="https://man.openbsd.org/OpenBSD-3.0/select.2">select(2)</a>
 <br>  system call allows an attacker to overwrite kernel memory and execute arbitrary
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.0/common/007_recover.patch">  code in kernel context.<br>
   <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.0/common/031_scarg.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
 <li id="pf">  
 <strong>006: SECURITY FIX: November 13, 2001</strong>  <li id="kerntime">
   <strong>032: SECURITY FIX: October 7, 2002</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 <a href="https://man.openbsd.org/OpenBSD-3.0/pf.4">pf(4)</a>  Incorrect argument checking in the
 was incapable of dealing with certain ipv6 icmp packets, resulting in a crash.  <a href="https://man.openbsd.org/OpenBSD-3.0/setitimer.2">setitimer(2)</a> system call may allow an attacker to write to kernel memory.<br>
 <br>  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.0/common/032_kerntime.patch">
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.0/common/006_pf.patch">  
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
 <li id="altivec">  
 <strong>005: RELIABILITY FIX: November 12, 2001</strong>  <li id="kadmin">
 <br>  <strong>033: SECURITY FIX: October 21, 2002</strong>
 Execution of Altivec instructions will crash the kernel.  &nbsp; <i>All architectures</i><br>
 <br>  A buffer overflow can occur in the
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.0/macppc/005_altivec.patch">  <a href="https://man.openbsd.org/OpenBSD-3.0/kadmind.8">kadmind(8)</a>
   daemon, leading to possible remote crash or exploit.<br>
   <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.0/common/033_kadmin.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
 <li id="hifn">  
 <strong>004: RELIABILITY FIX: November 12, 2001</strong>  <li id="smrsh">
 <br>  <strong>034: SECURITY FIX: November 6, 2002</strong>
 Hifn7751 based cards may stop working on certain motherboards due to  &nbsp; <i>All architectures</i><br>
 DMA errors.  An attacker can bypass the restrictions imposed by sendmail's restricted shell,
 <br>  <a href="https://man.openbsd.org/OpenBSD-3.0/smrsh.8">smrsh(8)</a>,
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.0/i386/004_hifn.patch">  and execute arbitrary commands with the privileges of his own account.<br>
   <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.0/common/034_smrsh.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
 <li id="sparc64cd">  
 <strong>003: RELIABILITY FIX: November 12, 2001</strong>  <li id="kernresource">
 <br>  <strong>035: SECURITY FIX: November 6, 2002</strong>
 Access to a CD drive on the PCI ultrasparc machines results in a continuous stream  
 of bogus interrupt messages, causing great user anguish.  
 <br>  
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.0/sparc64/003_sparc64cd.patch">  
 A source code patch exists which remedies this problem.</a>  
 <p>  
 <li id="sshd">  
 <strong>002: SECURITY FIX: November 12, 2001</strong>  
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 <a href="https://man.openbsd.org/OpenBSD-3.0/sshd.8">sshd(8)</a>  Incorrect argument checking in the
 is being upgraded from OpenSSH 3.0 to OpenSSH 3.0.2 to fix a few problems:  <a href="https://man.openbsd.org/OpenBSD-3.0/getrlimit.2">getrlimit(2)</a>
 <p>  system call may allow an attacker to crash the kernel.<br>
 <ul>  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.0/common/035_kernresource.patch">
 <li>A security hole that may allow an attacker to partially authenticate  
 if -- and only if -- the administrator has enabled KerberosV.  
 <br>  
 By default, OpenSSH KerberosV support only becomes active after KerberosV  
 has been properly configured.  
 <p>  
 <li>An excessive memory clearing bug (which we believe to be unexploitable)  
 also exists, but since this may cause daemon crashes, we are providing a  
 patch as well.  
 <p>  
 <li>A vulnerability in environment passing in the <code>UseLogin</code>  
 <i>sshd</i> option  
 <p>  
 <li>Various other non-critical fixes.  
 </ul>  
 <p>  
 Effectively an upgrade of OpenSSH 3.0 to OpenSSH 3.0.2.  
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.0/common/002_ssh2.patch">  
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 This is the second version of this patch.  
 <p>  <p>
 <li id="hosts">  
 <strong>001: INSTALL ISSUE: November 12, 2001</strong>  <li id="named">
   <strong>036: SECURITY FIX: November 14, 2002</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 A small bug in the installation script causes the <code>/etc/hosts</code> file to  A buffer overflow in
 be incorrectly formed.<br>  <a href="https://man.openbsd.org/OpenBSD-3.0/named.8">named(8)</a>
 The resulting file contains a line which reads like:<p>  could allow an attacker to execute code with the privileges of named.
 <code>&nbsp;&nbsp;&nbsp;#.#.#.# hostname. hostname</code>  On OpenBSD, named runs as a non-root user in a chrooted environment
 <p>  which mitigates the effects of this bug.<br>
 This line should actually read something like:<p>  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.0/common/036_named.patch">
 <code>&nbsp;&nbsp;&nbsp;#.#.#.# hostname.domainname.com hostname</code>  A source code patch exists which remedies this problem.</a>
 <p>  
 To correct this problem, simply edit the file and insert the domainname in  
 the required place.  
 <p>  <p>
   
 </ul>  </ul>
Legend:
Removed from v.1.105  
changed lines
  Added in v.1.106