=================================================================== RCS file: /cvsrepo/anoncvs/cvs/www/errata31.html,v retrieving revision 1.28 retrieving revision 1.29 diff -c -r1.28 -r1.29 *** www/errata31.html 2003/10/24 22:12:40 1.28 --- www/errata31.html 2003/11/21 16:55:16 1.29 *************** *** 8,13 **** --- 8,14 ---- + *************** *** 51,93 **** consult the OpenBSD FAQ.

! !

All architectures

027: SECURITY FIX: March 31, 2003
A buffer overflow in the address parsing in sendmail(8) may allow an attacker to gain root privileges.
A source code patch exists which remedies the problem.
! !
026: SECURITY FIX: March 24, 2003
The cryptographic weaknesses in the Kerberos v4 protocol can be exploited on Kerberos v5 as well.
A source code patch exists which remedies the problem.
! !
025: SECURITY FIX: March 19, 2003
OpenSSL is vulnerable to an extension of the ``Bleichenbacher'' attack designed by Czech researchers Klima, Pokorny and Rosa.
A source code patch exists which remedies the problem.
! !
024: SECURITY FIX: March 18, 2003
Various SSL and TLS operations in OpenSSL are vulnerable to timing attacks.
An ``RSA blinding'' source code patch exists which remedies the problem.
! !
023: SECURITY FIX: March 5, 2003
A fix for an lprm(1) bug made in 1996 contains an error that could lead to privilege escalation. --- 52,93 ---- consult the OpenBSD FAQ.
! !
All architectures
- ! 027: SECURITY FIX: March 31, 2003
  A buffer overflow in the address parsing in sendmail(8) may allow an attacker to gain root privileges.
  A source code patch exists which remedies the problem.
  !
- ! 026: SECURITY FIX: March 24, 2003
  The cryptographic weaknesses in the Kerberos v4 protocol can be exploited on Kerberos v5 as well.
  A source code patch exists which remedies the problem.
  !
- ! 025: SECURITY FIX: March 19, 2003
  OpenSSL is vulnerable to an extension of the ``Bleichenbacher'' attack designed by Czech researchers Klima, Pokorny and Rosa.
  A source code patch exists which remedies the problem.
  !
- ! 024: SECURITY FIX: March 18, 2003
  Various SSL and TLS operations in OpenSSL are vulnerable to timing attacks.
  An ``RSA blinding'' source code patch exists which remedies the problem.
  !
- ! 023: SECURITY FIX: March 5, 2003
  A fix for an lprm(1) bug made in 1996 contains an error that could lead to privilege escalation. *************** *** 95,110 **** A source code patch exists which remedies the problem.
  ! !
- 022: SECURITY FIX: March 3, 2003
  A buffer overflow in the envelope comments processing in sendmail(8) may allow an attacker to gain root privileges.
  A source code patch exists which remedies the problem.
  ! !
- 021: SECURITY FIX: February 23, 2003
  In ssl(8) an information leak can occur via timing by performing a MAC computation even if incorrect block cipher padding has been found, this is a --- 95,110 ---- A source code patch exists which remedies the problem.
  !
- ! 022: SECURITY FIX: March 3, 2003
  A buffer overflow in the envelope comments processing in sendmail(8) may allow an attacker to gain root privileges.
  A source code patch exists which remedies the problem.
  !
- ! 021: SECURITY FIX: February 23, 2003
  In ssl(8) an information leak can occur via timing by performing a MAC computation even if incorrect block cipher padding has been found, this is a *************** *** 112,119 **** A source code patch exists which fixes these two issues.
  ! !
- 020: SECURITY FIX: January 20, 2003
  A double free in cvs(1) could allow an attacker to execute code with the privileges of the --- 112,119 ---- A source code patch exists which fixes these two issues.
  !
- ! 020: SECURITY FIX: January 20, 2003
  A double free in cvs(1) could allow an attacker to execute code with the privileges of the *************** *** 124,131 **** A source code patch exists which remedies the problem.
  ! !
- 019: SECURITY FIX: November 14, 2002
  A buffer overflow in named(8) could allow an attacker to execute code with the privileges of named. --- 124,131 ---- A source code patch exists which remedies the problem.
  !
- ! 019: SECURITY FIX: November 14, 2002
  A buffer overflow in named(8) could allow an attacker to execute code with the privileges of named. *************** *** 134,170 **** A source code patch exists which remedies the problem.
  ! !
- 018: SECURITY FIX: November 6, 2002
  Incorrect argument checking in the getrlimit(2) system call may allow an attacker to crash the kernel.
  A source code patch exists which remedies the problem.
  ! !
- 017: SECURITY FIX: November 6, 2002
  An attacker can bypass the restrictions imposed by sendmail's restricted shell, smrsh(8), and execute arbitrary commands with the privileges of his own account.
  A source code patch exists which remedies the problem.
  ! !
- 016: SECURITY FIX: October 21, 2002
  A buffer overflow can occur in the kadmind(8) daemon, leading to possible remote crash or exploit.
  A source code patch exists which remedies the problem.
  ! !
- 015: SECURITY FIX: October 2, 2002
  Incorrect argument checking in the setitimer(2) system call may allow an attacker to write to kernel memory.
  A source code patch exists which remedies the problem.
  ! !
- 014: SECURITY FIX: August 11, 2002
  An insufficient boundary check in the select(2) system call allows an attacker to overwrite kernel memory and execute arbitrary --- 134,170 ---- A source code patch exists which remedies the problem.
  !
- ! 018: SECURITY FIX: November 6, 2002
  Incorrect argument checking in the getrlimit(2) system call may allow an attacker to crash the kernel.
  A source code patch exists which remedies the problem.
  !
- ! 017: SECURITY FIX: November 6, 2002
  An attacker can bypass the restrictions imposed by sendmail's restricted shell, smrsh(8), and execute arbitrary commands with the privileges of his own account.
  A source code patch exists which remedies the problem.
  !
- ! 016: SECURITY FIX: October 21, 2002
  A buffer overflow can occur in the kadmind(8) daemon, leading to possible remote crash or exploit.
  A source code patch exists which remedies the problem.
  !
- ! 015: SECURITY FIX: October 2, 2002
  Incorrect argument checking in the setitimer(2) system call may allow an attacker to write to kernel memory.
  A source code patch exists which remedies the problem.
  !
- ! 014: SECURITY FIX: August 11, 2002
  An insufficient boundary check in the select(2) system call allows an attacker to overwrite kernel memory and execute arbitrary *************** *** 172,179 **** A source code patch exists which remedies the problem.
  ! !
- 013: SECURITY FIX: July 30, 2002
  Several remote buffer overflows can occur in the SSL2 server and SSL3 client of the ssl(8) library, as in the ASN.1 parser code in the --- 172,179 ---- A source code patch exists which remedies the problem.
  !
- ! 013: SECURITY FIX: July 30, 2002
  Several remote buffer overflows can occur in the SSL2 server and SSL3 client of the ssl(8) library, as in the ASN.1 parser code in the *************** *** 183,190 ****
  This is the second version of the patch.
  ! !
- 012: SECURITY FIX: July 29, 2002
  A buffer overflow can occur in the xdr_array(3) RPC code, leading to possible remote crash.
  --- 183,190 ----
  This is the second version of the patch.
  !
- ! 012: SECURITY FIX: July 29, 2002
  A buffer overflow can occur in the xdr_array(3) RPC code, leading to possible remote crash.
  *************** *** 192,244 ****
  This is the second version of the patch.
  ! !
- 011: SECURITY FIX: July 29, 2002
  A race condition exists in the pppd(8) daemon which may cause it to alter the file permissions of an arbitrary file.
  A source code patch exists which remedies the problem.
  ! !
- 010: RELIABILITY FIX: July 5, 2002
  Receiving IKE payloads out of sequence can cause isakmpd(8) to crash.
  A source code patch exists which remedies the problem.
  This is the second version of the patch.
  ! !
- 009: SECURITY FIX: June 27, 2002
  The kernel would let any user ktrace(2) set[ug]id processes.
  A source code patch exists which remedies the problem.
  ! !
- 008: SECURITY FIX: June 26, 2002
  A buffer overflow can occur in the .htaccess parsing code in mod_ssl httpd module, leading to possible remote crash or exploit.
  A source code patch exists which remedies the problem.
  ! !
- 007: SECURITY FIX: June 25, 2002
  A potential buffer overflow in the DNS resolver has been found.
  A source code patch exists which remedies the problem.
  ! !
- 006: SECURITY FIX: June 24, 2002
  All versions of OpenSSH's sshd between 2.3.1 and 3.3 contain an input validation error that can result in an integer overflow and privilege escalation. This problem is fixed in OpenSSH 3.4, and a patch for the vulnerable releases is available as part of the security advisory.
  ! !
- 005: SECURITY FIX: June 19, 2002
  A buffer overflow can occur during the interpretation of chunked encoding in the http daemon, leading to possible remote crash or exploit.
  A source code patch exists which remedies the problem.
  ! !
- 004: SECURITY FIX: May 22, 2002
  Under certain conditions, on systems using YP with netgroups in the password database, it is possible that sshd(8) --- 192,244 ----
  This is the second version of the patch.
  !
- ! 011: SECURITY FIX: July 29, 2002
  A race condition exists in the pppd(8) daemon which may cause it to alter the file permissions of an arbitrary file.
  A source code patch exists which remedies the problem.
  !
- ! 010: RELIABILITY FIX: July 5, 2002
  Receiving IKE payloads out of sequence can cause isakmpd(8) to crash.
  A source code patch exists which remedies the problem.
  This is the second version of the patch.
  !
- ! 009: SECURITY FIX: June 27, 2002
  The kernel would let any user ktrace(2) set[ug]id processes.
  A source code patch exists which remedies the problem.
  !
- ! 008: SECURITY FIX: June 26, 2002
  A buffer overflow can occur in the .htaccess parsing code in mod_ssl httpd module, leading to possible remote crash or exploit.
  A source code patch exists which remedies the problem.
  !
- ! 007: SECURITY FIX: June 25, 2002
  A potential buffer overflow in the DNS resolver has been found.
  A source code patch exists which remedies the problem.
  !
- ! 006: SECURITY FIX: June 24, 2002
  All versions of OpenSSH's sshd between 2.3.1 and 3.3 contain an input validation error that can result in an integer overflow and privilege escalation. This problem is fixed in OpenSSH 3.4, and a patch for the vulnerable releases is available as part of the security advisory.
  !
- ! 005: SECURITY FIX: June 19, 2002
  A buffer overflow can occur during the interpretation of chunked encoding in the http daemon, leading to possible remote crash or exploit.
  A source code patch exists which remedies the problem.
  !
- ! 004: SECURITY FIX: May 22, 2002
  Under certain conditions, on systems using YP with netgroups in the password database, it is possible that sshd(8) *************** *** 248,267 **** users could be locked out.
  A source code patch exists which remedies the problem.
  ! !
- 003: SECURITY FIX: May 8, 2002
  A race condition exists where an attacker could fill the file descriptor table and defeat the kernel's protection of fd slots 0, 1, and 2 for a setuid or setgid process.
  A source code patch exists which remedies the problem.
  ! !
- 002: SECURITY FIX: April 25, 2002
  A bug in sudo(8) may allow an attacker to corrupt the heap by specifying a custom prompt.
  A source code patch exists which remedies the problem.
  ! !
- 001: SECURITY FIX: April 22, 2002
  A local user can gain super-user privileges due to a buffer overflow in sshd(8) if AFS has been configured on the system or if --- 248,267 ---- users could be locked out.
  A source code patch exists which remedies the problem.
  !
- ! 003: SECURITY FIX: May 8, 2002
  A race condition exists where an attacker could fill the file descriptor table and defeat the kernel's protection of fd slots 0, 1, and 2 for a setuid or setgid process.
  A source code patch exists which remedies the problem.
  !
- ! 002: SECURITY FIX: April 25, 2002
  A bug in sudo(8) may allow an attacker to corrupt the heap by specifying a custom prompt.
  A source code patch exists which remedies the problem.
  !
- ! 001: SECURITY FIX: April 22, 2002
  A local user can gain super-user privileges due to a buffer overflow in sshd(8) if AFS has been configured on the system or if *************** *** 272,338 ****
! !
i386
- No problems identified yet.
! !
alpha
- No problems identified yet.
! !
mac68k
- No problems identified yet.
! !
sparc
- No problems identified yet.
! !
sparc64
- No problems identified yet.
! !
amiga
- No problems identified yet.
! !
hp300
- No problems identified yet.
! !
mvme68k
- No problems identified yet.
! !
macppc
- No problems identified yet.
! !
vax
- No problems identified yet.
-

--- 272,337 ----

! !

i386

No problems identified yet.

! !

alpha

No problems identified yet.

! !

mac68k

No problems identified yet.

! !

sparc

No problems identified yet.

! !

sparc64

No problems identified yet.

! !

amiga

No problems identified yet.

! !

hp300

No problems identified yet.

! !

mvme68k

No problems identified yet.

! !

macppc

No problems identified yet.

! !

vax

No problems identified yet.

*************** *** 358,364 ****

www@openbsd.org !
$OpenBSD: errata31.html,v 1.28 2003/10/24 22:12:40 david Exp $ --- 357,363 ----

www@openbsd.org !
$OpenBSD: errata31.html,v 1.29 2003/11/21 16:55:16 henning Exp $