www/errata30.html - diff

Return to errata30.html CVS log

Up to [local] / www

Diff for /www/errata30.html between version 1.43 and 1.44

version 1.43, 2003/10/24 22:12:40

version 1.44, 2003/11/21 16:55:16

Line 8

</head>

Line 51

Line 52

consult the <a href="./faq/faq10.html#10.14">OpenBSD FAQ</a>.

<hr>

<dl>

<h3>All architectures</h3>

<li><h3>All architectures</h3>

<ul>

<li>036: SECURITY FIX: November 14, 2002

A buffer overflow in

Line 64

<a href="ftp://ftp.openbsd.org/pub/OpenBSD/patches/3.0/common/036_named.patch">A

source code patch exists which remedies the problem</a>.

<li>035: SECURITY FIX: November 6, 2002

035: SECURITY FIX: November 6, 2002

Incorrect argument checking in the

<a href="http://www.openbsd.org/cgi-bin/man.cgi?query=getrlimit&sektion=2">getrlimit(2)</a>

system call may allow an attacker to crash the kernel.

<a href="ftp://ftp.openbsd.org/pub/OpenBSD/patches/3.0/common/035_kernresource.patch">A

source code patch exists which remedies the problem</a>.

<li>034: SECURITY FIX: November 6, 2002

034: SECURITY FIX: November 6, 2002

An attacker can bypass the restrictions imposed by sendmail's restricted shell,

<a href="http://www.openbsd.org/cgi-bin/man.cgi?query=smrsh&sektion=8">smrsh(8)</a>,

and execute arbitrary commands with the privileges of his own account.

<a href="ftp://ftp.openbsd.org/pub/OpenBSD/patches/3.0/common/034_smrsh.patch">A

source code patch exists which remedies the problem</a>.

<li>033: SECURITY FIX: October 21, 2002

033: SECURITY FIX: October 21, 2002

A buffer overflow can occur in the

<a href="http://www.openbsd.org/cgi-bin/man.cgi?query=kadmind&sektion=8">kadmind(8)</a>

daemon, leading to possible remote crash or exploit.

<a href="ftp://ftp.openbsd.org/pub/OpenBSD/patches/3.0/common/033_kadmin.patch">A source code patch exists which remedies the problem</a>.

<li>032: SECURITY FIX: October 7, 2002

032: SECURITY FIX: October 7, 2002

Incorrect argument checking in the

<a href="http://www.openbsd.org/cgi-bin/man.cgi?query=setitimer&sektion=2">setitimer(2)</a> system call may allow an attacker to write to kernel memory.

<a href="ftp://ftp.openbsd.org/pub/OpenBSD/patches/3.0/common/032_kerntime.patch">A source code patch exists which remedies the problem</a>.

<li>031: SECURITY FIX: August 11, 2002

031: SECURITY FIX: August 11, 2002

An insufficient boundary check in the

<a href="http://www.openbsd.org/cgi-bin/man.cgi?query=select&sektion=2">select(2)</a>

system call allows an attacker to overwrite kernel memory and execute arbitrary

Line 102

<a href="ftp://ftp.openbsd.org/pub/OpenBSD/patches/3.0/common/031_scarg.patch">A

source code patch exists which remedies the problem</a>.

<li>030: SECURITY FIX: July 30, 2002

030: SECURITY FIX: July 30, 2002

Several remote buffer overflows can occur in the SSL2 server and SSL3 client of the

library, as in the ASN.1 parser code in the

Line 113

This is the second version of the patch.

<li>029: SECURITY FIX: July 29, 2002

029: SECURITY FIX: July 29, 2002

A buffer overflow can occur in the

<a href="http://www.openbsd.org/cgi-bin/man.cgi?query=xdr_array&sektion=3">xdr_array(3)</a>

RPC code, leading to possible remote crash.

Line 122

This is the second version of the patch.

<li>028: SECURITY FIX: July 29, 2002

028: SECURITY FIX: July 29, 2002

A race condition exists in the

daemon which may cause it to alter the file permissions of an arbitrary file.

<a href="ftp://ftp.openbsd.org/pub/OpenBSD/patches/3.0/common/028_pppd.patch">A source code patch exists which remedies the problem</a>.

<li>027: RELIABILITY FIX: July 5, 2002

027: RELIABILITY FIX: July 5, 2002

Receiving IKE payloads out of sequence can cause

<a href="http://www.openbsd.org/cgi-bin/man.cgi?query=isakmpd&sektion=8">isakmpd(8)</a> to crash.

<a href="ftp://ftp.openbsd.org/pub/OpenBSD/patches/3.0/common/027_isakmpd.patch">A source code patch exists which remedies the problem</a>.

This is the second version of the patch.

<li>026: SECURITY FIX: June 27, 2002

026: SECURITY FIX: June 27, 2002

The kernel would let any user <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=ktrace&sektion=2">ktrace(2)</a> set[ug]id processes.

<a href="ftp://ftp.openbsd.org/pub/OpenBSD/patches/3.0/common/026_ktrace.patch">A source code patch exists which remedies the problem</a>.

<li>025: SECURITY FIX: June 25, 2002

025: SECURITY FIX: June 25, 2002

A potential buffer overflow in the DNS resolver has been found.

<a href="ftp://ftp.openbsd.org/pub/OpenBSD/patches/3.0/common/025_resolver.patch">A source code patch exists which remedies the problem</a>.

<li>024: SECURITY FIX: June 24, 2002

024: SECURITY FIX: June 24, 2002

All versions of OpenSSH's sshd between 2.3.1 and 3.3 contain an input validation

error that can result in an integer overflow and privilege escalation.

This problem is fixed in <a href="http://www.openssh.com/openbsd.html">OpenSSH

3.4</a>, and a patch for the vulnerable releases is available as part of the

<a href="http://www.openssh.com/txt/preauth.adv">security advisory</a>.

<li>023: SECURITY FIX: June 24, 2002

023: SECURITY FIX: June 24, 2002

A buffer overflow can occur in the .htaccess parsing code in mod_ssl httpd

module, leading to possible remote crash or exploit.

<a href="ftp://ftp.openbsd.org/pub/OpenBSD/patches/3.0/common/023_mod_ssl.patch">A source code patch exists which remedies the problem</a>.

<li>022: SECURITY FIX: June 19, 2002

022: SECURITY FIX: June 19, 2002

A buffer overflow can occur during the interpretation of chunked

encoding in the http daemon, leading to possible remote crash or exploit.

<a href="ftp://ftp.openbsd.org/pub/OpenBSD/patches/3.0/common/022_httpd.patch">A source code patch exists which remedies the problem</a>.

<li>021: SECURITY FIX: May 8, 2002

021: SECURITY FIX: May 8, 2002

A race condition exists where an attacker could fill the file descriptor

table and defeat the kernel's protection of fd slots 0, 1, and 2 for a

setuid or setgid process.

<a href="ftp://ftp.openbsd.org/pub/OpenBSD/patches/3.0/common/021_fdalloc2.patch">A source code patch exists which remedies the problem</a>.

<li>020: SECURITY FIX: April 25, 2002

020: SECURITY FIX: April 25, 2002

A bug in <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=sudo&sektion=8">sudo(8)</a> may allow an attacker to corrupt the heap by specifying a custom prompt.

<a href="ftp://ftp.openbsd.org/pub/OpenBSD/patches/3.0/common/020_sudo.patch">A source code patch exists which remedies the problem</a>.

<li>019: SECURITY FIX: April 22, 2002

019: SECURITY FIX: April 22, 2002

A local user can gain super-user privileges due to a buffer overflow

in <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=sshd&sektion=8">sshd(8)</a>

if AFS has been configured on the system or if

Line 189

by default.

<a href="ftp://ftp.openbsd.org/pub/OpenBSD/patches/3.0/common/019_sshafs.patch">A source code patch exists which remedies the problem</a>.

<li>018: SECURITY FIX: April 11, 2002

018: SECURITY FIX: April 11, 2002

will process tilde escapes even in non-interactive mode.

This can lead to a local root compromise.

<a href="ftp://ftp.openbsd.org/pub/OpenBSD/patches/3.0/common/018_mail.patch">A source code patch exists which remedies the problem</a>.

<li>017: RELIABILITY FIX: March 26, 2002

017: RELIABILITY FIX: March 26, 2002

<a href="http://www.openbsd.org/cgi-bin/man.cgi?query=isakmpd&sektion=8">isakmpd(8)</a>

will crash when receiving a zero length IKE packet due to a too-late length check.

<a href="ftp://ftp.openbsd.org/pub/OpenBSD/patches/3.0/common/017_isakmpd.patch">A source code patch exists which remedies the problem</a>.

<li>016: SECURITY FIX: March 19, 2002

016: SECURITY FIX: March 19, 2002

Under certain conditions, on systems using YP with netgroups in the password

database, it is possible for the

<a href="http://www.openbsd.org/cgi-bin/man.cgi?query=rexecd&sektion=8">rexecd(8)</a>

Line 219

jobs.

<a href="ftp://ftp.openbsd.org/pub/OpenBSD/patches/3.0/common/016_approval.patch">A source code patch exists which remedies the problem</a>.

<li>015: RELIABILITY FIX: March 13, 2002

015: RELIABILITY FIX: March 13, 2002

Under some circumstances the zlib compression library can free dynamically

allocated memory twice. This is not a security issue on OpenBSD since the BSD

Line 229

The feasibility of attacking the kernel this way is currently unknown.

<a href="ftp://ftp.openbsd.org/pub/OpenBSD/patches/3.0/common/015_zlib.patch">A source code patch exists which remedies the problem</a>.

<li>014: SECURITY FIX: March 8, 2002

014: SECURITY FIX: March 8, 2002

A local user can gain super-user privileges due to an off-by-one check

in the channel forwarding code of OpenSSH.

<a href="ftp://ftp.openbsd.org/pub/OpenBSD/patches/3.0/common/014_openssh.patch">A source code patch exists which remedies the problem</a>.

<li>013: RELIABILITY FIX: February 4, 2002

013: RELIABILITY FIX: February 4, 2002

The wrong filedescriptors are released when pipe(2) failed.

<a href="ftp://ftp.openbsd.org/pub/OpenBSD/patches/3.0/common/013_syspipe.patch">A source code patch exists which remedies the problem</a>.

<li>012: SECURITY FIX: January 21, 2002

012: SECURITY FIX: January 21, 2002

A race condition between the ptrace(2) and execve(2) system calls allows

an attacker to modify the memory contents of suid/sgid processes which

could lead to compromise of the super-user account.

<a href="ftp://ftp.openbsd.org/pub/OpenBSD/patches/3.0/common/012_ptrace.patch">A source code patch exists which remedies the problem</a>.

<li>011: SECURITY FIX: January 17, 2002

011: SECURITY FIX: January 17, 2002

If the Postfix sendmail replacement is installed on a system an

attacker may be able to gain root privileges on the local host via

sudo(8) which runs the mailer as root with an environment inherited

Line 259

invoking user.

<a href="ftp://ftp.openbsd.org/pub/OpenBSD/patches/3.0/common/011_sudo.patch">A source code patch exists which remedies the problem</a>.

<li>010: RELIABILITY FIX: December 13, 2001

010: RELIABILITY FIX: December 13, 2001

Systems running with IP-in-IP encapsulation can be made to crash by

malformed packets.

<a href="ftp://ftp.openbsd.org/pub/OpenBSD/patches/3.0/common/010_ipip.patch">A source code patch exists which remedies the problem</a>.

<li>008: SECURITY FIX: November 28, 2001

008: SECURITY FIX: November 28, 2001

A security issue exists in the lpd daemon that may allow an attacker

to create arbitrary new files in the root directory. Only machines

with line printer access (ie: listed in either /etc/hosts.lpd or

Line 275

in the default installation.

<a href="ftp://ftp.openbsd.org/pub/OpenBSD/patches/3.0/common/008_lpd.patch">A source code patch exists which remedies the problem</a>.

<li>007: SECURITY FIX: November 13, 2001

007: SECURITY FIX: November 13, 2001

A security issue exists in the vi.recover script that may allow an attacker

to remove arbitrary zero-length files, regardless of ownership.

<a href="ftp://ftp.openbsd.org/pub/OpenBSD/patches/3.0/common/007_recover.patch">A source code patch exists which remedies the problem</a>.

<li>006: SECURITY FIX: November 13, 2001

006: SECURITY FIX: November 13, 2001

was incapable of dealing with certain ipv6 icmp packets, resulting in a crash.

<a href="ftp://ftp.openbsd.org/pub/OpenBSD/patches/3.0/common/006_pf.patch">A source code patch exists which remedies the problem</a>.

<li>002: SECURITY FIX: November 12, 2001

002: SECURITY FIX: November 12, 2001

is being upgraded from OpenSSH 3.0 to OpenSSH 3.0.2 to fix a few problems:

Line 316

<a href="ftp://ftp.openbsd.org/pub/OpenBSD/patches/3.0/common/002_ssh2.patch">a source code patch exists which remedies these problems</a>.

This is the second version of this patch.

<li>001: INSTALL ISSUE: November 12, 2001

001: INSTALL ISSUE: November 12, 2001

A small bug in the installation script causes the <tt>/etc/hosts</tt> file to

be incorrectly formed.

The resulting file contains a line which reads like:

Line 335

</ul>

<ul>

<li>004: RELIABILITY FIX: November 12, 2001

004: RELIABILITY FIX: November 12, 2001

Hifn7751 based cards may stop working on certain motherboards due to

DMA errors.

Line 348

</ul>

<li><h3>alpha</h3>

<h3>alpha</h3>

<ul>

<li>No problems identified yet.

</ul>

<ul>

<li>No problems identified yet.

</ul>

<li><h3>sparc</h3>

<h3>sparc</h3>

<ul>

<li>No problems identified yet.

</ul>

<li><h3>sparc64</h3>

<h3>sparc64</h3>

<ul>

<li>003: RELIABILITY FIX: November 12, 2001

003: RELIABILITY FIX: November 12, 2001

Access to a CD drive on the PCI ultrasparc machines results in a continuous stream

of bogus interrupt messages, causing great user anguish.

Line 379

</ul>

<li><h3>amiga</h3>

<h3>amiga</h3>

<ul>

<li>No problems identified yet.

</ul>

<ul>

<li>No problems identified yet.

</ul>

<ul>

<li>No problems identified yet.

</ul>

<li><h3>macppc</h3>

<h3>macppc</h3>

<ul>

<li>009: INSTALLATION FIX: December 11, 2001

009: INSTALLATION FIX: December 11, 2001

The 3.0 CD2 was created with an error which means that the instructions

for booting this architecture will not work. Instead, to boot the

Line 410

<code>boot cd:,OFWBOOT /3.0/macppc/bsd.rd</code>

<li>005: RELIABILITY FIX: November 12, 2001

005: RELIABILITY FIX: November 12, 2001

Execution of Altivec instructions will crash the kernel.

Line 419

</ul>

<ul>

<li>No problems identified yet.

</ul>

</dl>

<hr>