File: [local] / www / errata33.html (download) (as text)
Revision 1.26, Fri Oct 29 17:22:16 2004 UTC (19 years, 7 months ago) by miod
Branch: MAIN
Changes since 1.25: +5 -3 lines
Rotate for 3.6.
|
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<title>OpenBSD 3.3 errata</title>
<link rev=made href="mailto:www@openbsd.org">
<meta name="resource-type" content="document">
<meta name="description" content="the OpenBSD CD errata page">
<meta name="keywords" content="openbsd,cd,errata">
<meta name="distribution" content="global">
<meta name="copyright" content="This document copyright 1997-2004 by OpenBSD.">
<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
</head>
<body bgcolor="#ffffff" text="#000000" link="#23238E">
<a href="index.html"><img alt="[OpenBSD]" height="30" width="141" src="images/smalltitle.gif" border="0"></a>
<h2><font color="#0000e0">
This is the OpenBSD 3.3 release errata & patch list:
</font></h2>
<hr>
<a href=stable.html>For OpenBSD patch branch information, please refer here.</a><br>
<a href=pkg-stable33.html>For important packages updates, please refer here.</a><br>
<br>
For errata on a certain release, click below:<br>
<a href="errata21.html">2.1</a>,
<a href="errata22.html">2.2</a>,
<a href="errata23.html">2.3</a>,
<a href="errata24.html">2.4</a>,
<a href="errata25.html">2.5</a>,
<a href="errata26.html">2.6</a>,
<a href="errata27.html">2.7</a>,
<a href="errata28.html">2.8</a>,
<a href="errata29.html">2.9</a>,
<a href="errata30.html">3.0</a>,
<a href="errata31.html">3.1</a>,
<a href="errata32.html">3.2</a>,
<a href="errata34.html">3.4</a>,
<a href="errata35.html">3.5</a>,
<a href="errata.html">3.6</a>.
<br>
<hr>
<a href="ftp://ftp.openbsd.org/pub/OpenBSD/patches/3.3.tar.gz">
You can also fetch a tar.gz file containing all the following patches</a>.
This file is updated once a day.
<p> The patches below are available in CVS via the
<code>OPENBSD_3_3</code> <a href="stable.html">patch branch</a>.
<p>
For more detailed information on how to install patches to OpenBSD, please
consult the <a href="./faq/faq10.html#Patches">OpenBSD FAQ</a>.
<hr>
<a name="all"></a>
<h3><font color="#e00000">All architectures</font></h3>
<ul>
<li><a name="cvs"></a>
<font color="#009000"><strong>022: SECURITY FIX: May 5,
2004</strong></font><br>
Pathname validation problems have been found in
<a href="http://www.openbsd.org/cgi-bin/man.cgi?query=cvs&apropos=0&sektion=1&manpath=OpenBSD+Current&arch=i386&format=html">cvs(1)</a>,
allowing malicious clients to create files outside the repository, allowing
malicious servers to overwrite files outside the local CVS tree on
the client and allowing clients to check out files outside the CVS
repository.
<br>
<a href="ftp://ftp.openbsd.org/pub/OpenBSD/patches/3.3/common/022_cvs.patch">
A source code patch exists which remedies this problem</a>.<br>
<p>
<li><a name="openssl"></a>
<font color="#009000"><strong>021: RELIABILITY FIX: March 17,
2004</strong></font><br>
A missing check for a NULL-pointer dereference has been found in
<a href="http://www.openbsd.org/cgi-bin/man.cgi?query=ssl&apropos=0&sektion=3&manpath=OpenBSD+Current&arch=i386&format=html">ssl(3)</a>.
A remote attacker can use the bug to cause an OpenSSL application to crash;
this may lead to a denial of service.
<br>
<a href="ftp://ftp.openbsd.org/pub/OpenBSD/patches/3.3/common/021_openssl.patch">
A source code patch exists which remedies this problem</a>.<br>
<p>
<li><a name="isakmpd2"></a>
<font color="#009000"><strong>020: RELIABILITY FIX: March 17,
2004</strong></font><br>
Defects in the payload validation and processing functions of
<a href="http://www.openbsd.org/cgi-bin/man.cgi?query=isakmpd&apropos=0&sektion=8&manpath=OpenBSD+Current&arch=i386&format=html">isakmpd(8)</a>
have been discovered. An attacker could send malformed ISAKMP messages and
cause isakmpd to crash or to loop endlessly. This patch fixes these problems
and removes some memory leaks.
<br>
<a href="ftp://ftp.openbsd.org/pub/OpenBSD/patches/3.3/common/020_isakmpd2.patch">
A source code patch exists which remedies this problem</a>.<br>
<p>
<li><a name="httpd2"></a>
<font color="#009000"><strong>019: SECURITY FIX: March 13,
2004</strong></font><br>
Due to a bug in the parsing of Allow/Deny rules for
<a href="http://www.openbsd.org/cgi-bin/man.cgi?query=httpd&sektion=8">httpd(8)'s</a>
access module, using IP addresses without a netmask on big endian 64-bit
platforms causes the rules to fail to match. This only affects sparc64.
<br>
<a href="ftp://ftp.openbsd.org/pub/OpenBSD/patches/3.3/common/019_httpd2.patch">
A source code patch exists which remedies the problem</a>.<br>
<p>
<li><a name="tcp"></a>
<font color="#009000"><strong>018: RELIABILITY FIX: March 8,
2004</strong></font><br>
OpenBSD's TCP/IP stack did not impose limits on how many out-of-order
TCP segments are queued in the system. An attacker could
send out-of-order TCP segments and trick the system into using all
available memory buffers.
<br>
<a href="ftp://ftp.openbsd.org/pub/OpenBSD/patches/3.3/common/018_tcp.patch">
A source code patch exists which remedies the problem</a>.<br>
<p>
<li><a name="font"></a>
<font color="#009000"><strong>017: RELIABILITY FIX: February 14,
2004</strong></font><br>
Several buffer overflows exist in the code parsing
font.aliases files in XFree86. Thanks to ProPolice, these cannot be
exploited to gain privileges, but they can cause the X server to abort.
<br>
<a href="ftp://ftp.openbsd.org/pub/OpenBSD/patches/3.3/common/017_font.patch">
A source code patch exists which remedies the problem</a>.<br>
<p>
<li><a name="ip6"></a>
<font color="#009000"><strong>016: SECURITY FIX: February 8, 2004</strong></font><br>
An IPv6 MTU handling problem exists that could be used by an attacker
to cause a denial of service attack against hosts with reachable IPv6
TCP ports.
<br>
<a href="ftp://ftp.openbsd.org/pub/OpenBSD/patches/3.3/common/016_ip6.patch">
A source code patch exists which remedies the problem</a>.<br>
<p>
<li><a name="sysvshm"></a>
<font color="#009000"><strong>015: SECURITY FIX: February 5, 2004</strong></font><br>
A reference counting bug exists in the
<a href="http://www.openbsd.org/cgi-bin/man.cgi?query=shmat&apropos=0&sektion=2&manpath=OpenBSD+Current&format=html">shmat(2)</a>
system call that could be used by an attacker to write to kernel memory
under certain circumstances.
<br>
<a href="ftp://ftp.openbsd.org/pub/OpenBSD/patches/3.3/common/015_sysvshm.patch">
A source code patch exists which remedies the problem</a>.<br>
<p>
<li><a name="isakmpd"></a>
<font color="#009000"><strong>014: SECURITY FIX: January 15, 2004</strong></font><br>
Several message handling flaws in
<a href="http://www.openbsd.org/cgi-bin/man.cgi?query=isakmpd&apropos=0&sektion=8&manpath=OpenBSD+Current&arch=i386&format=html">isakmpd(8)</a>
have been reported by Thomas Walpuski. These allow an attacker to delete arbitrary SAs.
<br>
<a href="ftp://ftp.openbsd.org/pub/OpenBSD/patches/3.3/common/014_isakmpd.patch">
A source code patch exists which remedies these problems</a>.<br>
<p>
<li><a name="sem"></a>
<font color="#009000"><strong>013: RELIABILITY FIX: November 20, 2003</strong></font><br>
An improper bounds check makes it possible for a local user to cause a crash
by passing the
<a href="http://www.openbsd.org/cgi-bin/man.cgi?query=semctl&apropos=0&sektion=2&manpath=OpenBSD+Current&arch=i386&format=html">semctl(2)</a> and
<a href="http://www.openbsd.org/cgi-bin/man.cgi?query=semop&apropos=0&sektion=2&manpath=OpenBSD+Current&arch=i386&format=html">semop(2)</a> functions
certain arguments.
<br>
<a href="ftp://ftp.openbsd.org/pub/OpenBSD/patches/3.3/common/013_sem.patch">
A source code patch exists which remedies the problem</a>.<br>
<p>
<li><a name="uvm"></a>
<font color="#009000"><strong>012: RELIABILITY FIX: November 20, 2003</strong></font><br>
It is possible for a local user to cause a crash via
<a href="http://www.openbsd.org/cgi-bin/man.cgi?query=sysctl&apropos=0&sektion=3&manpath=OpenBSD+Current&arch=i386&format=html">sysctl(3)</a> with certain arguments.<br>
<a href="ftp://ftp.openbsd.org/pub/OpenBSD/patches/3.3/common/012_uvm.patch">
A source code patch exists which remedies the problem</a>.<br>
<p>
<li><a name="exec"></a>
<font color="#009000"><strong>010: RELIABILITY FIX: November 4, 2003</strong></font><br>
It is possible for a local user to cause a system panic by executing a specially crafted binary with an invalid header.
<br>
<a href="ftp://ftp.openbsd.org/pub/OpenBSD/patches/3.3/common/010_exec.patch">
A source code patch exists which remedies the problem</a>.<br>
<p>
<li><a name="httpd"></a>
<font color="#009000"><strong>009: RELIABILITY FIX: October 29, 2003</strong></font><br>
A user with write permission to <tt>httpd.conf</tt> or a <tt>.htaccess</tt>
file can crash
<a href="http://www.openbsd.org/cgi-bin/man.cgi?query=httpd&sektion=8">httpd(8)</a>
or potentially run arbitrary code as the user <tt>www</tt> (although it
is believed that ProPolice will prevent code execution).
<br>
<a href="ftp://ftp.openbsd.org/pub/OpenBSD/patches/3.3/common/009_httpd.patch">
A source code patch exists which remedies the problem</a>.<br>
<p>
<li><a name="arp"></a>
<font color="#009000"><strong>008: RELIABILITY FIX: October 1, 2003</strong></font><br>
It is possible for a local user to cause a system panic by flooding it with spoofed ARP
requests.<br>
<a href="ftp://ftp.openbsd.org/pub/OpenBSD/patches/3.3/common/008_arp.patch">
A source code patch exists which remedies the problem</a>.<br>
<p>
<li><a name="asn1"></a>
<font color="#009000"><strong>007: SECURITY FIX: October 1, 2003</strong></font><br>
The use of certain ASN.1 encodings or malformed public keys may allow an
attacker to mount a denial of service attack against applications linked with
<a href="http://www.openbsd.org/cgi-bin/man.cgi?query=ssl&sektion=3">ssl(3)</a>.
This does not affect OpenSSH.<br>
<a href="ftp://ftp.openbsd.org/pub/OpenBSD/patches/3.3/common/007_asn1.patch">
A source code patch exists which remedies the problem</a>.<br>
<p>
<li><a name="pfnorm"></a>
<font color="#009000"><strong>006: SECURITY FIX: September 24, 2003</strong></font><br>
Three cases of potential access to freed memory have been found in
<a href="http://www.openbsd.org/cgi-bin/man.cgi?query=pf&sektion=4">pf(4)</a>.
At least one of them could be used to panic pf with active scrub rules remotely.<br>
<a href="ftp://ftp.openbsd.org/pub/OpenBSD/patches/3.3/common/006_pfnorm.patch">
A source code patch exists which remedies the problem</a>.<br>
<p>
<li><a name="sendmail"></a>
<font color="#009000"><strong>005: SECURITY FIX: September 17, 2003</strong></font><br>
A buffer overflow in the address parsing in
<a href="http://www.openbsd.org/cgi-bin/man.cgi?query=sendmail&sektion=8">sendmail(8)</a>
may allow an attacker to gain root privileges.<br>
<a href="ftp://ftp.openbsd.org/pub/OpenBSD/patches/3.3/common/005_sendmail.patch">
A source code patch exists which remedies the problem</a>.<br>
NOTE: this is the <em>second</em> revision of the patch that fixes an additional
problem.
<p>
<li><a name="sshbuffer"></a>
<font color="#009000"><strong>004: SECURITY FIX: September 16, 2003</strong></font><br>
All versions of OpenSSH's sshd prior to 3.7 contain a buffer management error.
It is unclear whether or not this bug is exploitable.<br>
<a href="ftp://ftp.openbsd.org/pub/OpenBSD/patches/3.3/common/004_sshbuffer.patch">A
source code patch exists which remedies the problem</a>.<br>
NOTE: this is the <em>second</em> revision of the patch that fixes an additional
problem.
<p>
<li><a name="sysvsem"></a>
<font color="#009000"><strong>003: SECURITY FIX: September 10, 2003</strong></font><br>
Root may be able to reduce the security level by taking advantage of
an integer overflow when the semaphore limits are made very large.<br>
<a href="ftp://ftp.openbsd.org/pub/OpenBSD/patches/3.3/common/003_sysvsem.patch">
A source code patch exists which remedies the problem</a>.
<p>
<li><a name="semget"></a>
<font color="#009000"><strong>002: RELIABILITY FIX: August 20, 2003</strong></font><br>
An improper bounds check in the
<a href="http://www.openbsd.org/cgi-bin/man.cgi?query=semget&sektion=2">semget(2)</a>
system call can allow a local user to cause a kernel panic.<br>
<a href="ftp://ftp.openbsd.org/pub/OpenBSD/patches/3.3/common/002_semget.patch">
A source code patch exists which remedies the problem</a>.
<p>
<li><a name="realpath"></a>
<font color="#009000"><strong>001: SECURITY FIX: August 4, 2003</strong></font><br>
An off-by-one error exists in the C library function
<a href="http://www.openbsd.org/cgi-bin/man.cgi?query=realpath&sektion=3">realpath(3)</a>.
Since this same bug resulted in a root compromise in the wu-ftpd ftp server
it is possible that this bug may allow an attacker to gain escalated privileges
on OpenBSD.<br>
<a href="ftp://ftp.openbsd.org/pub/OpenBSD/patches/3.3/common/001_realpath.patch">
A source code patch exists which remedies the problem</a>.
<p>
</ul>
<p>
<a name="i386"></a>
<h3><font color="#e00000">i386</font></h3>
<ul>
<li><a name="ibcs2"></a>
<font color="#009000"><strong>011: SECURITY FIX: November 17, 2003</strong></font><br>
It is possible for a local user to execute arbitrary code resulting in escalation of
privileges due to a stack overrun in
<a href="http://www.openbsd.org/cgi-bin/man.cgi?query=compat_ibcs2&sektion=8&apropos=0&manpath=OpenBSD+Current&arch=i386">compat_ibcs2(8)</a>.<br>
<a href="ftp://ftp.openbsd.org/pub/OpenBSD/patches/3.3/i386/011_ibcs2.patch">
A source code patch exists which remedies the problem</a>.<br>
<p>
</ul>
<p>
<a name="alpha"></a>
<h3><font color="#e00000">alpha</font></h3>
<ul>
<li>No problems identified yet.
</ul>
<p>
<a name="mac68k"></a>
<h3><font color="#e00000">mac68k</font></h3>
<ul>
<li>No problems identified yet.
</ul>
<p>
<a name="sparc"></a>
<h3><font color="#e00000">sparc</font></h3>
<ul>
<li>No problems identified yet.
</ul>
<p>
<a name="sparc64"></a>
<h3><font color="#e00000">sparc64</font></h3>
<ul>
<li>No problems identified yet.
</ul>
<p>
<a name="hppa"></a>
<h3><font color="#e00000">hppa</font></h3>
<ul>
<li>No problems identified yet.
</ul>
<p>
<a name="hp300"></a>
<h3><font color="#e00000">hp300</font></h3>
<ul>
<li>No problems identified yet.
</ul>
<p>
<a name="mvme68k"></a>
<h3><font color="#e00000">mvme68k</font></h3>
<ul>
<li>No problems identified yet.
</ul>
<p>
<a name="macppc"></a>
<h3><font color="#e00000">macppc</font></h3>
<ul>
<li>No problems identified yet.
</ul>
<p>
<a name="vax"></a>
<h3><font color="#e00000">vax</font></h3>
<ul>
<li>No problems identified yet.
</ul>
<br>
<hr>
<a href=stable.html>For OpenBSD patch branch information, please refer here.</a><br>
<a href=pkg-stable33.html>For important packages updates, please refer here.</a><br>
<br>
For errata on a certain release, click below:<br>
<a href="errata21.html">2.1</a>,
<a href="errata22.html">2.2</a>,
<a href="errata23.html">2.3</a>,
<a href="errata24.html">2.4</a>,
<a href="errata25.html">2.5</a>,
<a href="errata26.html">2.6</a>,
<a href="errata27.html">2.7</a>,
<a href="errata28.html">2.8</a>,
<a href="errata29.html">2.9</a>,
<a href="errata30.html">3.0</a>,
<a href="errata31.html">3.1</a>,
<a href="errata32.html">3.2</a>,
<a href="errata34.html">3.4</a>,
<a href="errata35.html">3.5</a>,
<a href="errata.html">3.6</a>.
<br>
<hr>
<a href=index.html><img height=24 width=24 src=back.gif border=0 alt=OpenBSD></a>
<a href="mailto:www@openbsd.org">www@openbsd.org</a>
<br><small>$OpenBSD: errata33.html,v 1.26 2004/10/29 17:22:16 miod Exp $</small>
</body>
</html>
![[BACK]](/icons/back.gif){kind=icon}
Return to errata33.html CVS log ![[TXT]](/icons/text.gif){kind=icon}
![[DIR]](/icons/dir.gif){kind=icon}
Up to [local] / www