[BACK]Return to errata31.html CVS log [TXT][DIR] Up to [local] / www

Diff for /www/errata31.html between version 1.88 and 1.89

version 1.88, 2019/05/27 22:55:19 version 1.89, 2019/05/28 16:32:41
Line 84 
Line 84 
 <hr>  <hr>
   
 <ul>  <ul>
 <li id="sendmail2">  
 <strong>027: SECURITY FIX: March 31, 2003</strong>  <li id="sshafs">
   <strong>001: SECURITY FIX: April 22, 2002</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 A buffer overflow in the address parsing in  A local user can gain super-user privileges due to a buffer overflow
 <a href="https://man.openbsd.org/OpenBSD-3.1/sendmail.8">sendmail(8)</a>  in <a href="https://man.openbsd.org/OpenBSD-3.1/sshd.8">sshd(8)</a>
 may allow an attacker to gain root privileges.<br>  if AFS has been configured on the system or if
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.1/common/027_sendmail.patch">  KerberosTgtPassing or AFSTokenPassing has been enabled
   in the sshd_config file.  Ticket and token passing is not enabled
   by default.<br>
   <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.1/common/001_sshafs.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
 <li id="kerberos">  
 <strong>026: SECURITY FIX: March 24, 2003</strong>  <li id="sudo">
   <strong>002: SECURITY FIX: April 25, 2002</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 The cryptographic weaknesses in the Kerberos v4 protocol can be exploited  A bug in <a href="https://man.openbsd.org/OpenBSD-3.1/sudo.8">sudo(8)</a> may allow an attacker to corrupt the heap by specifying a custom prompt.<br>
 on Kerberos v5 as well.  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.1/common/002_sudo.patch">
 <br>  
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.1/common/026_kerberos.patch">  
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
 <li id="kpr">  
 <strong>025: SECURITY FIX: March 19, 2003</strong>  <li id="fdalloc2">
   <strong>003: SECURITY FIX: May 8, 2002</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 OpenSSL is vulnerable to an extension of the "Bleichenbacher" attack designed  A race condition exists where an attacker could fill the file descriptor
 by Czech researchers Klima, Pokorny and Rosa.  table and defeat the kernel's protection of fd slots 0, 1, and 2 for a
 <br>  setuid or setgid process.<br>
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.1/common/025_kpr.patch">  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.1/common/003_fdalloc2.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
 <li id="blinding">  
 <strong>024: SECURITY FIX: March 18, 2003</strong>  <li id="sshbsdauth">
   <strong>004: SECURITY FIX: May 22, 2002</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 Various SSL and TLS operations in OpenSSL are vulnerable to timing attacks.  Under certain conditions, on systems using YP with netgroups in the
 <br>  password database, it is possible that
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.1/common/024_blinding.patch">  <a href="https://man.openbsd.org/OpenBSD-3.1/sshd.8">sshd(8)</a>
   does ACL checks for the requested user name but uses the password
   database entry of a different user for authentication.  This means
   that denied users might authenticate successfully while permitted
   users could be locked out.<br>
   <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.1/common/004_sshbsdauth.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
 <li id="lprm">  
 <strong>023: SECURITY FIX: March 5, 2003</strong>  <li id="httpd">
   <strong>005: SECURITY FIX: June 19, 2002</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 A fix for an  A buffer overflow can occur during the interpretation of chunked
 <a href="https://man.openbsd.org/OpenBSD-3.1/lprm.1">lprm(1)</a>  encoding in the http daemon, leading to possible remote crash or exploit.<br>
 bug made in 1996 contains an error that could lead to privilege escalation.  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.1/common/005_httpd.patch">
 <br>  
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.1/common/023_lprm.patch">  
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
 <li id="sendmail">  
 <strong>022: SECURITY FIX: March 3, 2003</strong>  <li id="sshd">
   <strong>006: SECURITY FIX: June 24, 2002</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 A buffer overflow in the envelope comments processing in  All versions of OpenSSH's sshd between 2.3.1 and 3.3 contain an input validation
 <a href="https://man.openbsd.org/OpenBSD-3.1/sendmail.8">sendmail(8)</a>  error that can result in an integer overflow and privilege escalation.
 may allow an attacker to gain root privileges.<br>  This problem is fixed in <a href="https://www.openssh.com/openbsd.html">OpenSSH
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.1/common/022_sendmail.patch">  3.4</a>, and a patch for the vulnerable releases is available as part of the
 A source code patch exists which remedies this problem.</a>  <a href="https://www.openssh.com/txt/preauth.adv">security advisory</a>.
 <p>  <p>
 <li id="ssl2">  
 <strong>021: SECURITY FIX: February 23, 2003</strong>  <li id="resolver">
   <strong>007: SECURITY FIX: June 25, 2002</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 In  A potential buffer overflow in the DNS resolver has been found.<br>
 <a href="https://man.openbsd.org/OpenBSD-3.1/ssl.8">ssl(8)</a> an information leak can occur via timing by performing a MAC computation  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.1/common/007_resolver.patch">
 even if incorrect block cipher padding has been found, this is a  A source code patch exists which remedies this problem.</a>
 countermeasure. Also, check for negative sizes in memory allocation routines.<br>  
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.1/common/021_ssl.patch">  
 A source code patch exists which fixes these two issues</a>.  
 <p>  <p>
 <li id="cvs">  
 <strong>020: SECURITY FIX: January 20, 2003</strong>  <li id="modssl">
   <strong>008: SECURITY FIX: June 26, 2002</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 A double free in  A buffer overflow can occur in the .htaccess parsing code in mod_ssl httpd
 <a href="https://man.openbsd.org/OpenBSD-3.1/cvs.1">cvs(1)</a>  module, leading to possible remote crash or exploit.<br>
 could allow an attacker to execute code with the privileges of the  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.1/common/008_mod_ssl.patch">
 user running cvs.  This is only an issue when the cvs command is  
 being run on a user's behalf as a different user.  This means that,  
 in most cases, the issue only exists for cvs configurations that use  
 the <em>pserver</em> client/server connection method.<br>  
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.1/common/020_cvs.patch">  
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
 <li id="named">  
 <strong>019: SECURITY FIX: November 14, 2002</strong>  <li id="ktrace">
   <strong>009: SECURITY FIX: June 27, 2002</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 A buffer overflow in  The kernel would let any user <a href="https://man.openbsd.org/OpenBSD-3.1/ktrace.2">ktrace(2)</a> set[ug]id processes.<br>
 <a href="https://man.openbsd.org/OpenBSD-3.1/named.8">named(8)</a>  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.1/common/009_ktrace.patch">
 could allow an attacker to execute code with the privileges of named.  
 On OpenBSD, named runs as a non-root user in a chrooted environment  
 which mitigates the effects of this bug.<br>  
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.1/common/019_named.patch">  
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
 <li id="kernresource">  
 <strong>018: SECURITY FIX: November 6, 2002</strong>  <li id="isakmpd">
   <strong>010: RELIABILITY FIX: July 5, 2002</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 Incorrect argument checking in the  Receiving IKE payloads out of sequence can cause
 <a href="https://man.openbsd.org/OpenBSD-3.1/getrlimit.2">getrlimit(2)</a>  <a href="https://man.openbsd.org/OpenBSD-3.1/isakmpd.8">isakmpd(8)</a> to crash.<br>
 system call may allow an attacker to crash the kernel.<br>  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.1/common/010_isakmpd.patch">
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.1/common/018_kernresource.patch">  
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
   <br>
   This is the second version of the patch.
 <p>  <p>
 <li id="smrsh">  
 <strong>017: SECURITY FIX: November 6, 2002</strong>  <li id="pppd">
   <strong>011: SECURITY FIX: July 29, 2002</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 An attacker can bypass the restrictions imposed by sendmail's restricted shell,  A race condition exists in the
 <a href="https://man.openbsd.org/OpenBSD-3.1/smrsh.8">smrsh(8)</a>,  <a href="https://man.openbsd.org/OpenBSD-3.1/pppd.8">pppd(8)</a>
 and execute arbitrary commands with the privileges of his own account.<br>  daemon which may cause it to alter the file permissions of an arbitrary file.<br>
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.1/common/017_smrsh.patch">  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.1/common/011_pppd.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
 <li id="kadmin">  
 <strong>016: SECURITY FIX: October 21, 2002</strong>  <li id="xdr">
   <strong>012: SECURITY FIX: July 29, 2002</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 A buffer overflow can occur in the  A buffer overflow can occur in the
 <a href="https://man.openbsd.org/OpenBSD-3.1/kadmind.8">kadmind(8)</a>  <a href="https://man.openbsd.org/OpenBSD-3.1/xdr_array.3">xdr_array(3)</a>
 daemon, leading to possible remote crash or exploit.<br>  RPC code, leading to possible remote crash.<br>
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.1/common/016_kadmin.patch">  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.1/common/012_xdr.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
   <br>
   This is the second version of the patch.
 <p>  <p>
 <li id="kerntime">  
 <strong>015: SECURITY FIX: October 2, 2002</strong>  <li id="ssl">
   <strong>013: SECURITY FIX: July 30, 2002</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 Incorrect argument checking in the  Several remote buffer overflows can occur in the SSL2 server and SSL3 client of the
 <a href="https://man.openbsd.org/OpenBSD-3.1/setitimer.2">setitimer(2)</a> system call may allow an attacker to write to kernel memory.<br>  <a href="https://man.openbsd.org/OpenBSD-3.1/ssl.8">ssl(8)</a>
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.1/common/015_kerntime.patch">  library, as in the ASN.1 parser code in the
   <a href="https://man.openbsd.org/OpenBSD-3.1/crypto.3">crypto(3)</a>
   library, all of them being potentially remotely exploitable.<br>
   <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.1/common/013_ssl.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
   <br>
   This is the second version of the patch.
 <p>  <p>
   
 <li id="scarg">  <li id="scarg">
 <strong>014: SECURITY FIX: August 11, 2002</strong>  <strong>014: SECURITY FIX: August 11, 2002</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
Line 217 
Line 231 
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.1/common/014_scarg.patch">  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.1/common/014_scarg.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
 <li id="ssl">  
 <strong>013: SECURITY FIX: July 30, 2002</strong>  <li id="kerntime">
   <strong>015: SECURITY FIX: October 2, 2002</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 Several remote buffer overflows can occur in the SSL2 server and SSL3 client of the  Incorrect argument checking in the
 <a href="https://man.openbsd.org/OpenBSD-3.1/ssl.8">ssl(8)</a>  <a href="https://man.openbsd.org/OpenBSD-3.1/setitimer.2">setitimer(2)</a> system call may allow an attacker to write to kernel memory.<br>
 library, as in the ASN.1 parser code in the  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.1/common/015_kerntime.patch">
 <a href="https://man.openbsd.org/OpenBSD-3.1/crypto.3">crypto(3)</a>  
 library, all of them being potentially remotely exploitable.<br>  
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.1/common/013_ssl.patch">  
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <br>  
 This is the second version of the patch.  
 <p>  <p>
 <li id="xdr">  
 <strong>012: SECURITY FIX: July 29, 2002</strong>  <li id="kadmin">
   <strong>016: SECURITY FIX: October 21, 2002</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 A buffer overflow can occur in the  A buffer overflow can occur in the
 <a href="https://man.openbsd.org/OpenBSD-3.1/xdr_array.3">xdr_array(3)</a>  <a href="https://man.openbsd.org/OpenBSD-3.1/kadmind.8">kadmind(8)</a>
 RPC code, leading to possible remote crash.<br>  daemon, leading to possible remote crash or exploit.<br>
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.1/common/012_xdr.patch">  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.1/common/016_kadmin.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <br>  
 This is the second version of the patch.  
 <p>  <p>
 <li id="pppd">  
 <strong>011: SECURITY FIX: July 29, 2002</strong>  <li id="smrsh">
   <strong>017: SECURITY FIX: November 6, 2002</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 A race condition exists in the  An attacker can bypass the restrictions imposed by sendmail's restricted shell,
 <a href="https://man.openbsd.org/OpenBSD-3.1/pppd.8">pppd(8)</a>  <a href="https://man.openbsd.org/OpenBSD-3.1/smrsh.8">smrsh(8)</a>,
 daemon which may cause it to alter the file permissions of an arbitrary file.<br>  and execute arbitrary commands with the privileges of his own account.<br>
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.1/common/011_pppd.patch">  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.1/common/017_smrsh.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
 <li id="isakmpd">  
 <strong>010: RELIABILITY FIX: July 5, 2002</strong>  <li id="kernresource">
   <strong>018: SECURITY FIX: November 6, 2002</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 Receiving IKE payloads out of sequence can cause  Incorrect argument checking in the
 <a href="https://man.openbsd.org/OpenBSD-3.1/isakmpd.8">isakmpd(8)</a> to crash.<br>  <a href="https://man.openbsd.org/OpenBSD-3.1/getrlimit.2">getrlimit(2)</a>
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.1/common/010_isakmpd.patch">  system call may allow an attacker to crash the kernel.<br>
   <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.1/common/018_kernresource.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <br>  
 This is the second version of the patch.  
 <p>  <p>
 <li id="ktrace">  
 <strong>009: SECURITY FIX: June 27, 2002</strong>  <li id="named">
   <strong>019: SECURITY FIX: November 14, 2002</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 The kernel would let any user <a href="https://man.openbsd.org/OpenBSD-3.1/ktrace.2">ktrace(2)</a> set[ug]id processes.<br>  A buffer overflow in
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.1/common/009_ktrace.patch">  <a href="https://man.openbsd.org/OpenBSD-3.1/named.8">named(8)</a>
   could allow an attacker to execute code with the privileges of named.
   On OpenBSD, named runs as a non-root user in a chrooted environment
   which mitigates the effects of this bug.<br>
   <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.1/common/019_named.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
 <li id="modssl">  
 <strong>008: SECURITY FIX: June 26, 2002</strong>  <li id="cvs">
   <strong>020: SECURITY FIX: January 20, 2003</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 A buffer overflow can occur in the .htaccess parsing code in mod_ssl httpd  A double free in
 module, leading to possible remote crash or exploit.<br>  <a href="https://man.openbsd.org/OpenBSD-3.1/cvs.1">cvs(1)</a>
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.1/common/008_mod_ssl.patch">  could allow an attacker to execute code with the privileges of the
   user running cvs.  This is only an issue when the cvs command is
   being run on a user's behalf as a different user.  This means that,
   in most cases, the issue only exists for cvs configurations that use
   the <em>pserver</em> client/server connection method.<br>
   <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.1/common/020_cvs.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
 <li id="resolver">  
 <strong>007: SECURITY FIX: June 25, 2002</strong>  <li id="ssl2">
   <strong>021: SECURITY FIX: February 23, 2003</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 A potential buffer overflow in the DNS resolver has been found.<br>  In
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.1/common/007_resolver.patch">  <a href="https://man.openbsd.org/OpenBSD-3.1/ssl.8">ssl(8)</a> an information leak can occur via timing by performing a MAC computation
 A source code patch exists which remedies this problem.</a>  even if incorrect block cipher padding has been found, this is a
   countermeasure. Also, check for negative sizes in memory allocation routines.<br>
   <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.1/common/021_ssl.patch">
   A source code patch exists which fixes these two issues</a>.
 <p>  <p>
 <li id="sshd">  
 <strong>006: SECURITY FIX: June 24, 2002</strong>  <li id="sendmail">
   <strong>022: SECURITY FIX: March 3, 2003</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 All versions of OpenSSH's sshd between 2.3.1 and 3.3 contain an input validation  A buffer overflow in the envelope comments processing in
 error that can result in an integer overflow and privilege escalation.  <a href="https://man.openbsd.org/OpenBSD-3.1/sendmail.8">sendmail(8)</a>
 This problem is fixed in <a href="https://www.openssh.com/openbsd.html">OpenSSH  may allow an attacker to gain root privileges.<br>
 3.4</a>, and a patch for the vulnerable releases is available as part of the  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.1/common/022_sendmail.patch">
 <a href="https://www.openssh.com/txt/preauth.adv">security advisory</a>.  A source code patch exists which remedies this problem.</a>
 <p>  <p>
 <li id="httpd">  
 <strong>005: SECURITY FIX: June 19, 2002</strong>  <li id="lprm">
   <strong>023: SECURITY FIX: March 5, 2003</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 A buffer overflow can occur during the interpretation of chunked  A fix for an
 encoding in the http daemon, leading to possible remote crash or exploit.<br>  <a href="https://man.openbsd.org/OpenBSD-3.1/lprm.1">lprm(1)</a>
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.1/common/005_httpd.patch">  bug made in 1996 contains an error that could lead to privilege escalation.
   <br>
   <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.1/common/023_lprm.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
 <li id="sshbsdauth">  
 <strong>004: SECURITY FIX: May 22, 2002</strong>  <li id="blinding">
   <strong>024: SECURITY FIX: March 18, 2003</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 Under certain conditions, on systems using YP with netgroups in the  Various SSL and TLS operations in OpenSSL are vulnerable to timing attacks.
 password database, it is possible that  <br>
 <a href="https://man.openbsd.org/OpenBSD-3.1/sshd.8">sshd(8)</a>  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.1/common/024_blinding.patch">
 does ACL checks for the requested user name but uses the password  
 database entry of a different user for authentication.  This means  
 that denied users might authenticate successfully while permitted  
 users could be locked out.<br>  
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.1/common/004_sshbsdauth.patch">  
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
 <li id="fdalloc2">  
 <strong>003: SECURITY FIX: May 8, 2002</strong>  <li id="kpr">
   <strong>025: SECURITY FIX: March 19, 2003</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 A race condition exists where an attacker could fill the file descriptor  OpenSSL is vulnerable to an extension of the "Bleichenbacher" attack designed
 table and defeat the kernel's protection of fd slots 0, 1, and 2 for a  by Czech researchers Klima, Pokorny and Rosa.
 setuid or setgid process.<br>  <br>
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.1/common/003_fdalloc2.patch">  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.1/common/025_kpr.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
 <li id="sudo">  
 <strong>002: SECURITY FIX: April 25, 2002</strong>  <li id="kerberos">
   <strong>026: SECURITY FIX: March 24, 2003</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 A bug in <a href="https://man.openbsd.org/OpenBSD-3.1/sudo.8">sudo(8)</a> may allow an attacker to corrupt the heap by specifying a custom prompt.<br>  The cryptographic weaknesses in the Kerberos v4 protocol can be exploited
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.1/common/002_sudo.patch">  on Kerberos v5 as well.
   <br>
   <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.1/common/026_kerberos.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
 <li id="sshafs">  
 <strong>001: SECURITY FIX: April 22, 2002</strong>  <li id="sendmail2">
   <strong>027: SECURITY FIX: March 31, 2003</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 A local user can gain super-user privileges due to a buffer overflow  A buffer overflow in the address parsing in
 in <a href="https://man.openbsd.org/OpenBSD-3.1/sshd.8">sshd(8)</a>  <a href="https://man.openbsd.org/OpenBSD-3.1/sendmail.8">sendmail(8)</a>
 if AFS has been configured on the system or if  may allow an attacker to gain root privileges.<br>
 KerberosTgtPassing or AFSTokenPassing has been enabled  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.1/common/027_sendmail.patch">
 in the sshd_config file.  Ticket and token passing is not enabled  
 by default.<br>  
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.1/common/001_sshafs.patch">  
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
   
Legend:
Removed from v.1.88  
changed lines
  Added in v.1.89