OpenBSD 3.0 errata

=================================================================== RCS file: /cvsrepo/anoncvs/cvs/www/errata30.html,v retrieving revision 1.38 retrieving revision 1.39 diff -c -r1.38 -r1.39 *** www/errata30.html 2003/02/16 11:35:43 1.38 --- www/errata30.html 2003/03/06 21:44:07 1.39 *************** *** 1,8 **** ! OpenBSD 3.0 errata ! --- 1,8 ---- ! OpenBSD 3.0 errata ! *************** *** 13,19 ****

This is the OpenBSD 3.0 release errata & patch list:

--- 13,19 ----

This is the OpenBSD 3.0 release errata & patch list:

*************** *** 37,43 ****

! You can also fetch a tar.gz file containing all the following patches. This file is updated once a day. --- 37,43 ----

! You can also fetch a tar.gz file containing all the following patches. This file is updated once a day. *************** *** 51,59 ****

All architectures

036: SECURITY FIX: November 14, 2002
A buffer overflow in named(8) could allow an attacker to execute code with the privileges of named. --- 51,59 ----
!
All architectures
- 036: SECURITY FIX: November 14, 2002
  A buffer overflow in named(8) could allow an attacker to execute code with the privileges of named. *************** *** 63,69 **** source code patch exists which remedies the problem.
  !
- 035: SECURITY FIX: November 6, 2002
  Incorrect argument checking in the getrlimit(2) system call may allow an attacker to crash the kernel.
  --- 63,69 ---- source code patch exists which remedies the problem.
  !
- 035: SECURITY FIX: November 6, 2002
  Incorrect argument checking in the getrlimit(2) system call may allow an attacker to crash the kernel.
  *************** *** 71,77 **** source code patch exists which remedies the problem.
  !
- 034: SECURITY FIX: November 6, 2002
  An attacker can bypass the restrictions imposed by sendmail's restricted shell, smrsh(8), and execute arbitrary commands with the privileges of his own account.
  --- 71,77 ---- source code patch exists which remedies the problem.
  !
- 034: SECURITY FIX: November 6, 2002
  An attacker can bypass the restrictions imposed by sendmail's restricted shell, smrsh(8), and execute arbitrary commands with the privileges of his own account.
  *************** *** 79,98 **** source code patch exists which remedies the problem.
  !
- 033: SECURITY FIX: October 21, 2002
  A buffer overflow can occur in the kadmind(8) daemon, leading to possible remote crash or exploit.
  A source code patch exists which remedies the problem.
  !
- 032: SECURITY FIX: October 7, 2002
  Incorrect argument checking in the setitimer(2) system call may allow an attacker to write to kernel memory.
  A source code patch exists which remedies the problem.
  !
- 031: SECURITY FIX: August 11, 2002
  An insufficient boundary check in the select(2) system call allows an attacker to overwrite kernel memory and execute arbitrary --- 79,98 ---- source code patch exists which remedies the problem.
  !
- 033: SECURITY FIX: October 21, 2002
  A buffer overflow can occur in the kadmind(8) daemon, leading to possible remote crash or exploit.
  A source code patch exists which remedies the problem.
  !
- 032: SECURITY FIX: October 7, 2002
  Incorrect argument checking in the setitimer(2) system call may allow an attacker to write to kernel memory.
  A source code patch exists which remedies the problem.
  !
- 031: SECURITY FIX: August 11, 2002
  An insufficient boundary check in the select(2) system call allows an attacker to overwrite kernel memory and execute arbitrary *************** *** 101,107 **** source code patch exists which remedies the problem.
  !
- 030: SECURITY FIX: July 30, 2002
  Several remote buffer overflows can occur in the SSL2 server and SSL3 client of the ssl(8) library, as in the ASN.1 parser code in the --- 101,107 ---- source code patch exists which remedies the problem.
  !
- 030: SECURITY FIX: July 30, 2002
  Several remote buffer overflows can occur in the SSL2 server and SSL3 client of the ssl(8) library, as in the ASN.1 parser code in the *************** *** 110,130 **** A source code patch exists which remedies the problem.
  !
- 029: SECURITY FIX: July 29, 2002
  A buffer overflow can occur in the xdr_array(3) RPC code, leading to possible remote crash.
  A source code patch exists which remedies the problem.
  !
- 028: SECURITY FIX: July 29, 2002
  A race condition exists in the pppd(8) daemon which may cause it to alter the file permissions of an arbitrary file.
  A source code patch exists which remedies the problem.
  !
- 027: RELIABILITY FIX: July 5, 2002
  Receiving IKE payloads out of sequence can cause isakmpd(8) to crash.
  A source code patch exists which remedies the problem. --- 110,130 ---- A source code patch exists which remedies the problem.
  !
- 029: SECURITY FIX: July 29, 2002
  A buffer overflow can occur in the xdr_array(3) RPC code, leading to possible remote crash.
  A source code patch exists which remedies the problem.
  !
- 028: SECURITY FIX: July 29, 2002
  A race condition exists in the pppd(8) daemon which may cause it to alter the file permissions of an arbitrary file.
  A source code patch exists which remedies the problem.
  !
- 027: RELIABILITY FIX: July 5, 2002
  Receiving IKE payloads out of sequence can cause isakmpd(8) to crash.
  A source code patch exists which remedies the problem. *************** *** 132,148 **** This is the second version of the patch.
  !
- 026: SECURITY FIX: June 27, 2002
  The kernel would let any user ktrace(2) set[ug]id processes.
  A source code patch exists which remedies the problem.
  !
- 025: SECURITY FIX: June 25, 2002
  A potential buffer overflow in the DNS resolver has been found.
  A source code patch exists which remedies the problem.
  !
- 024: SECURITY FIX: June 24, 2002
  All versions of OpenSSH's sshd between 2.3.1 and 3.3 contain an input validation error that can result in an integer overflow and privilege escalation. This problem is fixed in OpenSSH --- 132,148 ---- This is the second version of the patch.
  !
- 026: SECURITY FIX: June 27, 2002
  The kernel would let any user ktrace(2) set[ug]id processes.
  A source code patch exists which remedies the problem.
  !
- 025: SECURITY FIX: June 25, 2002
  A potential buffer overflow in the DNS resolver has been found.
  A source code patch exists which remedies the problem.
  !
- 024: SECURITY FIX: June 24, 2002
  All versions of OpenSSH's sshd between 2.3.1 and 3.3 contain an input validation error that can result in an integer overflow and privilege escalation. This problem is fixed in OpenSSH *************** *** 150,182 **** security advisory.
  !
- 023: SECURITY FIX: June 24, 2002
  A buffer overflow can occur in the .htaccess parsing code in mod_ssl httpd module, leading to possible remote crash or exploit.
  A source code patch exists which remedies the problem.
  !
- 022: SECURITY FIX: June 19, 2002
  A buffer overflow can occur during the interpretation of chunked encoding in the http daemon, leading to possible remote crash or exploit.
  A source code patch exists which remedies the problem.
  !
- 021: SECURITY FIX: May 8, 2002
  A race condition exists where an attacker could fill the file descriptor table and defeat the kernel's protection of fd slots 0, 1, and 2 for a setuid or setgid process.
  A source code patch exists which remedies the problem.
  !
- 020: SECURITY FIX: April 25, 2002
  ! A bug in sudo(8) may allow an attacker to corrupt the heap by specifying a custom prompt.
  A source code patch exists which remedies the problem.
  !
- 019: SECURITY FIX: April 22, 2002
  A local user can gain super-user privileges due to a buffer overflow ! in sshd(8) if AFS has been configured on the system or if KerberosTgtPassing or AFSTokenPassing has been enabled in the sshd_config file. Ticket and token passing is not enabled --- 150,182 ---- security advisory.
  !
- 023: SECURITY FIX: June 24, 2002
  A buffer overflow can occur in the .htaccess parsing code in mod_ssl httpd module, leading to possible remote crash or exploit.
  A source code patch exists which remedies the problem.
  !
- 022: SECURITY FIX: June 19, 2002
  A buffer overflow can occur during the interpretation of chunked encoding in the http daemon, leading to possible remote crash or exploit.
  A source code patch exists which remedies the problem.
  !
- 021: SECURITY FIX: May 8, 2002
  A race condition exists where an attacker could fill the file descriptor table and defeat the kernel's protection of fd slots 0, 1, and 2 for a setuid or setgid process.
  A source code patch exists which remedies the problem.
  !
- 020: SECURITY FIX: April 25, 2002
  ! A bug in sudo(8) may allow an attacker to corrupt the heap by specifying a custom prompt.
  A source code patch exists which remedies the problem.
  !
- 019: SECURITY FIX: April 22, 2002
  A local user can gain super-user privileges due to a buffer overflow ! in sshd(8) if AFS has been configured on the system or if KerberosTgtPassing or AFSTokenPassing has been enabled in the sshd_config file. Ticket and token passing is not enabled *************** *** 184,248 **** A source code patch exists which remedies the problem.
  !
- 018: SECURITY FIX: April 11, 2002
  ! mail(1) will process tilde escapes even in non-interactive mode. This can lead to a local root compromise.
  A source code patch exists which remedies the problem.
  !
- 017: RELIABILITY FIX: March 26, 2002
  ! isakmpd(8) will crash when receiving a zero length IKE packet due to a too-late length check.
  A source code patch exists which remedies the problem.
  !
- 016: SECURITY FIX: March 19, 2002
  Under certain conditions, on systems using YP with netgroups in the password database, it is possible for the ! rexecd(8) and ! rshd(8) daemons to execute the shell from a different user's password entry. Due to a similar problem, ! atrun(8) may change to the wrong home directory when running ! at(1) jobs.
  A source code patch exists which remedies the problem.
  !
- 015: RELIABILITY FIX: March 13, 2002
  Under some circumstances the zlib compression library can free dynamically allocated memory twice. This is not a security issue on OpenBSD since the BSD ! free(3) function detects this. There is also a kernel zlib component that may be used by pppd and IPsec. The feasibility of attacking the kernel this way is currently unknown.
  A source code patch exists which remedies the problem.
  !
- 014: SECURITY FIX: March 8, 2002
  A local user can gain super-user privileges due to an off-by-one check in the channel forwarding code of OpenSSH.
  A source code patch exists which remedies the problem.
  !
- 013: RELIABILITY FIX: February 4, 2002
  The wrong filedescriptors are released when pipe(2) failed.
  A source code patch exists which remedies the problem.
  !
- 012: SECURITY FIX: January 21, 2002
  A race condition between the ptrace(2) and execve(2) system calls allows an attacker to modify the memory contents of suid/sgid processes which could lead to compromise of the super-user account.
  A source code patch exists which remedies the problem.
  !
- 011: SECURITY FIX: January 17, 2002
  If the Postfix sendmail replacement is installed on a system an attacker may be able to gain root privileges on the local host via sudo(8) which runs the mailer as root with an environment inherited --- 184,248 ---- A source code patch exists which remedies the problem.
  !
- 018: SECURITY FIX: April 11, 2002
  ! mail(1) will process tilde escapes even in non-interactive mode. This can lead to a local root compromise.
  A source code patch exists which remedies the problem.
  !
- 017: RELIABILITY FIX: March 26, 2002
  ! isakmpd(8) will crash when receiving a zero length IKE packet due to a too-late length check.
  A source code patch exists which remedies the problem.
  !
- 016: SECURITY FIX: March 19, 2002
  Under certain conditions, on systems using YP with netgroups in the password database, it is possible for the ! rexecd(8) and ! rshd(8) daemons to execute the shell from a different user's password entry. Due to a similar problem, ! atrun(8) may change to the wrong home directory when running ! at(1) jobs.
  A source code patch exists which remedies the problem.
  !
- 015: RELIABILITY FIX: March 13, 2002
  Under some circumstances the zlib compression library can free dynamically allocated memory twice. This is not a security issue on OpenBSD since the BSD ! free(3) function detects this. There is also a kernel zlib component that may be used by pppd and IPsec. The feasibility of attacking the kernel this way is currently unknown.
  A source code patch exists which remedies the problem.
  !
- 014: SECURITY FIX: March 8, 2002
  A local user can gain super-user privileges due to an off-by-one check in the channel forwarding code of OpenSSH.
  A source code patch exists which remedies the problem.
  !
- 013: RELIABILITY FIX: February 4, 2002
  The wrong filedescriptors are released when pipe(2) failed.
  A source code patch exists which remedies the problem.
  !
- 012: SECURITY FIX: January 21, 2002
  A race condition between the ptrace(2) and execve(2) system calls allows an attacker to modify the memory contents of suid/sgid processes which could lead to compromise of the super-user account.
  A source code patch exists which remedies the problem.
  !
- 011: SECURITY FIX: January 17, 2002
  If the Postfix sendmail replacement is installed on a system an attacker may be able to gain root privileges on the local host via sudo(8) which runs the mailer as root with an environment inherited *************** *** 254,266 **** A source code patch exists which remedies the problem.
  !
- 010: RELIABILITY FIX: December 13, 2001
  Systems running with IP-in-IP encapsulation can be made to crash by malformed packets.
  A source code patch exists which remedies the problem.
  !
- 008: SECURITY FIX: November 28, 2001
  A security issue exists in the lpd daemon that may allow an attacker to create arbitrary new files in the root directory. Only machines with line printer access (ie: listed in either /etc/hosts.lpd or --- 254,266 ---- A source code patch exists which remedies the problem.
  !
- 010: RELIABILITY FIX: December 13, 2001
  Systems running with IP-in-IP encapsulation can be made to crash by malformed packets.
  A source code patch exists which remedies the problem.
  !
- 008: SECURITY FIX: November 28, 2001
  A security issue exists in the lpd daemon that may allow an attacker to create arbitrary new files in the root directory. Only machines with line printer access (ie: listed in either /etc/hosts.lpd or *************** *** 270,292 **** A source code patch exists which remedies the problem.
  !
- 007: SECURITY FIX: November 13, 2001
  A security issue exists in the vi.recover script that may allow an attacker to remove arbitrary zero-length files, regardless of ownership.
  A source code patch exists which remedies the problem.
  !
- 006: SECURITY FIX: November 13, 2001
  ! pf(4) was incapable of dealing with certain ipv6 icmp packets, resulting in a crash.
  A source code patch exists which remedies the problem.
  !
- 002: SECURITY FIX: November 12, 2001
  ! sshd(8) is being upgraded from OpenSSH 3.0 to OpenSSH 3.0.2 to fix a few problems:
  - 007: SECURITY FIX: November 13, 2001
    A security issue exists in the vi.recover script that may allow an attacker to remove arbitrary zero-length files, regardless of ownership.
    A source code patch exists which remedies the problem.
    !
  - 006: SECURITY FIX: November 13, 2001
    ! pf(4) was incapable of dealing with certain ipv6 icmp packets, resulting in a crash.
    A source code patch exists which remedies the problem.
    !
  - 002: SECURITY FIX: November 12, 2001
    ! sshd(8) is being upgraded from OpenSSH 3.0 to OpenSSH 3.0.2 to fix a few problems:
    
    *************** *** 311,317 **** This is the second version of this patch.
    !
    001: INSTALL ISSUE: November 12, 2001
    A small bug in the installation script causes the /etc/hosts file to be incorrectly formed.
    The resulting file contains a line which reads like:
    --- 311,317 ---- This is the second version of this patch.
    !
    001: INSTALL ISSUE: November 12, 2001
    A small bug in the installation script causes the /etc/hosts file to be incorrectly formed.
    The resulting file contains a line which reads like:
    *************** *** 330,339 ****
    
    !
  - i386
    
    !
    004: RELIABILITY FIX: November 12, 2001
    Hifn7751 based cards may stop working on certain motherboards due to DMA errors. --- 330,339 ----
    
    !
  - i386
    
    !
    004: RELIABILITY FIX: November 12, 2001
    Hifn7751 based cards may stop working on certain motherboards due to DMA errors. *************** *** 343,370 ****
    
    !
  - alpha
    
    No problems identified yet.
    
    !
  - mac68k
    
    No problems identified yet.
    
    !
  - sparc
    
    No problems identified yet.
    
    !
  - sparc64
    
    !
    003: RELIABILITY FIX: November 12, 2001
    Access to a CD drive on the PCI ultrasparc machines results in a continuous stream of bogus interrupt messages, causing great user anguish. --- 343,370 ----
    
    !
  - alpha
    
    No problems identified yet.
    
    !
  - mac68k
    
    No problems identified yet.
    
    !
  - sparc
    
    No problems identified yet.
    
    !
  - sparc64
    
    !
    003: RELIABILITY FIX: November 12, 2001
    Access to a CD drive on the PCI ultrasparc machines results in a continuous stream of bogus interrupt messages, causing great user anguish. *************** *** 374,401 ****
    
    !
  - amiga
    
    No problems identified yet.
    
    !
  - hp300
    
    No problems identified yet.
    
    !
  - mvme68k
    
    No problems identified yet.
    
    !
  - macppc
    
    !
    009: INSTALLATION FIX: December 11, 2001
    The 3.0 CD2 was created with an error which means that the instructions for booting this architecture will not work. Instead, to boot the --- 374,401 ----
    
    !
  - amiga
    
    No problems identified yet.
    
    !
  - hp300
    
    No problems identified yet.
    
    !
  - mvme68k
    
    No problems identified yet.
    
    !
  - macppc
    
    !
    009: INSTALLATION FIX: December 11, 2001
    The 3.0 CD2 was created with an error which means that the instructions for booting this architecture will not work. Instead, to boot the *************** *** 405,411 **** boot cd:,OFWBOOT /3.0/macppc/bsd.rd
    !
    005: RELIABILITY FIX: November 12, 2001
    Execution of Altivec instructions will crash the kernel.
    --- 405,411 ---- boot cd:,OFWBOOT /3.0/macppc/bsd.rd
    !
    005: RELIABILITY FIX: November 12, 2001
    Execution of Altivec instructions will crash the kernel.
    *************** *** 414,420 ****
    
    !
  - vax
    
    No problems identified yet.
    --- 414,420 ----
  !
- vax
  - No problems identified yet.
  *************** *** 442,449 ****
  ! www@openbsd.org !
  $OpenBSD: errata30.html,v 1.38 2003/02/16 11:35:43 jufi Exp $ --- 442,449 ----
  ! www@openbsd.org !
  $OpenBSD: errata30.html,v 1.39 2003/03/06 21:44:07 naddy Exp $

This is the OpenBSD 3.0 release errata & patch list:

This is the OpenBSD 3.0 release errata & patch list:

All architectures

All architectures

i386

i386

alpha

mac68k

sparc

sparc64

alpha

mac68k

sparc

sparc64

amiga

hp300

mvme68k

macppc

amiga

hp300

mvme68k

macppc

vax

vax