www/errata30.html - diff - 1.14

Return to errata30.html CVS log

Up to [local] / www

Diff for /www/errata30.html between version 1.13 and 1.14

version 1.13, 2002/06/26 06:10:48

version 1.14, 2002/06/26 19:07:53

Line 54

Line 54

A potential buffer overflow in the DNS resolver has been found.<br>

A potential buffer overflow in the DNS resolver has been found.<br>

<a href="ftp://ftp.openbsd.org/pub/OpenBSD/patches/3.0/common/025_resolver.patch">A source code patch exists which remedies the problem</a>.

<a href="ftp://ftp.openbsd.org/pub/OpenBSD/patches/3.0/common/025_resolver.patch">A source code patch exists which remedies the problem</a>.

<p>

<p>

<a name=sshdprivsep></a>

<a name=sshdauth></a>

<li><font color=#009000><strong>024: SECURITY FIX: June 24, 2002</strong></font><br>

<li><font color=#009000><strong>024: SECURITY FIX: June 24, 2002</strong></font><br>

An (as yet) undisclosed bug exists in OpenSSH which a patch is not forthcoming

All versions of OpenSSH's sshd between 2.9.9 and 3.3 contain an input validation

for yet -- no patch exists yet!<br>

error that can result in an integer overflow and privilege escalation.

However, upgrading to <a href="http://www.openssh.com/openbsd.html">OpenSSH 3.3</a>

This problem is fixed in <a href="http://www.openssh.com/openbsd.html">OpenSSH

with the <strong>UsePrivilegeSeparation</strong> option enabled will block this

3.4</a>, and a patch for the vulnerable releases is available as part of the

problem.<br>

<a href="http://www.openssh.com/txt/preauth.adv">security advisory</a>.

All users are advised to update immediately, and keep an eye out for

<br>

a upcoming OpenSSH 3.4 release on Monday containing a real fix.

<p>

<a name=modssl></a>

<li><font color=#009000><strong>023: SECURITY FIX: June 24, 2002</strong></font><br>

A buffer overflow can occur in the .htaccess parsing code in mod_ssl httpd

module, leading to possible remote crash.

<a href="ftp://ftp.openbsd.org/pub/OpenBSD/patches/3.0/common/023_mod_ssl.patch">A source code patch exists which remedies the problem</a>.

<p>

<p>

<a name=httpd></a>

<a name=httpd></a>

<li><font color=#009000><strong>022: SECURITY FIX: June 19, 2002</strong></font><br>

<li><font color=#009000><strong>022: SECURITY FIX: June 19, 2002</strong></font><br>