[BACK]Return to errata34.html CVS log [TXT][DIR] Up to [local] / www

Diff for /www/errata34.html between version 1.90 and 1.91

version 1.90, 2019/05/27 22:55:19 version 1.91, 2019/05/28 16:32:42
Line 83 
Line 83 
 <hr>  <hr>
   
 <ul>  <ul>
 <li id="pfkey">  
 <strong>035: SECURITY FIX: December 13, 2004</strong>  <li id="cd_booklet">
   <strong>001: DOCUMENTATION FIX: November 1, 2003</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 On systems running  The CD insert documentation has an incorrect example for package installation.<br>
 <a href="https://man.openbsd.org/OpenBSD-3.4/isakmpd.8">isakmpd(8)</a>  Where it is written:<p>
 it is possible for a local user to cause kernel memory corruption  <b>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
 and system panic by setting  # pkg_add https://ftp.openbsd.org/pub/OpenBSD/3.4/packages/i386</b><p>
 <a href="https://man.openbsd.org/OpenBSD-3.4/ipsec.4">ipsec(4)</a>  It should instead read:<p>
 credentials on a socket.  <b>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
 <br>  # pkg_add https://ftp.openbsd.org/pub/OpenBSD/3.4/packages/i386/</b><p>
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.4/common/035_pfkey.patch">  The extra <b>/</b> at the end is important.  We do not make
 A source code patch exists which remedies this problem.</a>  patch files available for things printed on paper.
 <p>  <p>
 <li id="lynx">  
 <strong>034: RELIABILITY FIX: November 10, 2004</strong>  <li id="asn1">
   <strong>002: SECURITY FIX: November 1, 2003</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 Due to a bug in  The use of certain ASN.1 encodings or malformed public keys may allow an
 <a href="https://man.openbsd.org/OpenBSD-3.4/lynx.1">lynx(1)</a>  attacker to mount a denial of service attack against applications linked with
 it is possible for pages such as  <a href="https://man.openbsd.org/OpenBSD-3.4/ssl.3">ssl(3)</a>.
 <a href="http://lcamtuf.coredump.cx/mangleme/gallery/lynx_die1.html">this</a>  This does not affect OpenSSH.<br>
 to cause  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.4/common/002_asn1.patch">
 <a href="https://man.openbsd.org/OpenBSD-3.4/lynx.1">lynx(1)</a>  
 to exhaust memory and then crash when parsing such pages.  
 <br>  
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.4/common/034_lynx.patch">  
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
 <li id="pppd">  
 <strong>033: RELIABILITY FIX: November 10, 2004</strong>  <li id="arp">
   <strong>003: RELIABILITY FIX: November 1, 2003</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 <a href="https://man.openbsd.org/OpenBSD-3.4/pppd.8">pppd(8)</a>  It is possible for a local user to cause a system panic by flooding it with spoofed ARP
 contains a bug that allows an attacker to crash his own connection, but it cannot  requests.<br>
 be used to deny service to other users.  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.4/common/003_arp.patch">
 <br>  
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.4/common/033_pppd.patch">  
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
 <li id="bind">  
 <strong>032: RELIABILITY FIX: November 10, 2004</strong>  <li id="httpd">
   <strong>004: RELIABILITY FIX: November 1, 2003</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 BIND contains a bug which results in BIND trying to contact nameservers via IPv6, even in  A user with write permission to <code>httpd.conf</code> or a <code>.htaccess</code>
 cases where IPv6 connectivity is non-existent. This results in unnecessary timeouts and  file can crash
 thus slow DNS queries.  <a href="https://man.openbsd.org/OpenBSD-3.4/httpd.8">httpd(8)</a>
   or potentially run arbitrary code as the user <code>www</code> (although it
   is believed that ProPolice will prevent code execution).
 <br>  <br>
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.4/common/032_bind.patch">  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.4/common/004_httpd.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
 <li id="radius">  
 <strong>031: SECURITY FIX: September 20, 2004</strong>  <li id="exec">
   <strong>005: RELIABILITY FIX: November 4, 2003</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 Eilko Bos reported that radius authentication, as implemented by  It is possible for a local user to cause a system panic by executing a specially crafted binary with an invalid header.
 <a href="https://man.openbsd.org/OpenBSD-3.4/login_radius.8">login_radius(8)</a>,  
 was not checking the shared secret used for replies sent by the radius server.  
 This could allow an attacker to spoof a reply granting access to the  
 attacker.  Note that OpenBSD does not ship with radius authentication enabled.  
 <br>  <br>
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.4/common/031_radius.patch">  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.4/common/005_exec.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
 <li id="xpm">  
 <strong>030: SECURITY FIX: September 16, 2004</strong>  <li id="ibcs2">
 &nbsp; <i>All architectures</i><br>  <strong>006: SECURITY FIX: November 17, 2003</strong>
 Chris Evans reported several flaws (stack and integer overflows) in the  &nbsp; <i>i386 only</i><br>
 <a href="http://www.inria.fr/koala/lehors/xpm.html">Xpm</a>  It may be possible for a local user to overrun the stack in
 library code that parses image files  <a href="https://man.openbsd.org/OpenBSD-3.4/compat_ibcs2.8">compat_ibcs2(8)</a>.<br>
 (<a href="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0687">CAN-2004-0687</a>,  ProPolice catches this, turning a potential privilege escalation into a denial
 <a href="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0688">CAN-2004-0688</a>).  of service. iBCS2 emulation does not need to be enabled via
 Some of these would be exploitable when parsing malicious image files in  <a href="https://man.openbsd.org/OpenBSD-3.4/sysctl.8">sysctl(8)</a>
 an application that handles XPM images, if they could escape ProPolice.  for this to happen.
 <br>  <br>
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.4/common/030_xpm.patch">  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.4/i386/006_ibcs2.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
 <li id="httpd4">  
 <strong>029: SECURITY FIX: September 10, 2004</strong>  <li id="uvm">
   <strong>007: RELIABILITY FIX: November 20, 2003</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 <a href="https://man.openbsd.org/OpenBSD-3.4/httpd.8">httpd(8)</a>  It is possible for a local user to cause a crash via
 's mod_rewrite module can be made to write one zero byte in an arbitrary memory  <a href="https://man.openbsd.org/OpenBSD-3.4/sysctl.3">sysctl(3)</a> with certain arguments.
 position outside of a char array, causing a DoS or possibly buffer overflows.  
 This would require enabling dbm for mod_rewrite and making use of a malicious  
 dbm file.  
 <br>  <br>
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.4/common/029_httpd4.patch">  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.4/common/007_uvm.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
   
 <li id="bridge">  <li id="sem">
 <strong>028: RELIABILITY FIX: August 26, 2004</strong>  <strong>008: RELIABILITY FIX: November 20, 2003</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 As  An improper bounds check makes it possible for a local user to cause a crash
 <a href="https://marc.info/?l=bugtraq&amp;m=109345131508824&amp;w=2">reported</a>  by passing the
 by Vafa Izadinia  <a href="https://man.openbsd.org/OpenBSD-3.4/semctl.2">semctl(2)</a> and
 <a href="https://man.openbsd.org/OpenBSD-3.4/bridge.4">bridge(4)</a>  <a href="https://man.openbsd.org/OpenBSD-3.4/semop.2">semop(2)</a> functions
 with IPsec processing enabled can be crashed remotely by a single ICMP echo traversing the bridge.  certain arguments.
 <br>  <br>
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.4/common/028_bridge.patch">  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.4/common/008_sem.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
 <li id="icmp">  
 <strong>027: RELIABILITY FIX: August 25, 2004</strong>  <li id="isakmpd">
   <strong>009: SECURITY FIX: January 13, 2004</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 Improved verification of ICMP errors in order to minimize the impact of ICMP attacks  Several message handling flaws in
 against TCP.  <a href="https://man.openbsd.org/OpenBSD-3.4/isakmpd.8">isakmpd(8)</a>
   have been reported by Thomas Walpuski. These allow an attacker to delete arbitrary SAs. The patch also
   includes a reliability fix for a filedescriptor leak that causes problems when a crypto card is
   installed.
 <br>  <br>
 <a href="http://www.gont.com.ar/drafts/icmp-attacks-against-tcp.html">http://www.gont.com.ar/drafts/icmp-attacks-against-tcp.html</a>  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.4/common/009_isakmpd.patch">
 <br>  
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.4/common/027_icmp.patch">  
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
 <li id="rnd">  
 <strong>026: RELIABILITY FIX: Jul 25, 2004</strong>  <li id="sysvshm">
   <strong>010: SECURITY FIX: February 5, 2004</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 Under a certain network load the kernel can run out of stack space.  This was  A reference counting bug exists in the
 encountered in an environment using CARP on a VLAN interface.  This issue initially  <a href="https://man.openbsd.org/OpenBSD-3.4/shmat.2">shmat(2)</a>
 manifested itself as a FPU related crash on boot up.  system call that could be used by an attacker to write to kernel memory
   under certain circumstances.
 <br>  <br>
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.4/common/026_rnd.patch">  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.4/common/010_sysvshm.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
 <li id="httpd3">  
 <strong>025: SECURITY FIX: June 12, 2004</strong>  <li id="ip6">
   <strong>011: SECURITY FIX: February 8, 2004</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 Multiple vulnerabilities have been found in  An IPv6 MTU handling problem exists that could be used by an attacker
 <a href="https://man.openbsd.org/OpenBSD-3.4/httpd.8">httpd(8)</a>  to cause a denial of service attack against hosts with reachable IPv6
 / mod_ssl.  TCP ports.
 <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0020">CAN-2003-0020</a>,  
 <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0987">CAN-2003-0987</a>,  
 <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0488">CAN-2004-0488</a>,  
 <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0492">CAN-2004-0492</a>.  
 <br>  <br>
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.4/common/025_httpd3.patch">  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.4/common/011_ip6.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
 <li id="isakmpd3">  
 <strong>024: SECURITY FIX: June 10, 2004</strong>  <li id="font">
   <strong>012: RELIABILITY FIX: February 14, 2004</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 As  Several buffer overflows exist in the code parsing
 <a href="http://seclists.org/lists/fulldisclosure/2004/Jun/0191.html">disclosed</a>  font.aliases files in XFree86. Thanks to ProPolice, these cannot be
 by Thomas Walpuski  exploited to gain privileges, but they can cause the X server to abort.
 <a href="https://man.openbsd.org/OpenBSD-3.4/isakmpd.8">isakmpd(8)</a>  
 is still vulnerable to unauthorized SA deletion.  An attacker can delete IPsec  
 tunnels at will.  
 <br>  <br>
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.4/common/024_isakmpd3.patch">  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.4/common/012_font.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
 <li id="cvs3">  
 <strong>023: SECURITY FIX: June 9, 2004</strong>  <li id="tcp">
   <strong>013: RELIABILITY FIX: March 8, 2004</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 Multiple remote vulnerabilities have been found in the  OpenBSD's TCP/IP stack did not impose limits on how many out-of-order
 <a href="https://man.openbsd.org/OpenBSD-3.4/cvs.1">cvs(1)</a>  TCP segments are queued in the system.  An attacker could
 server that allow an attacker to crash the server or possibly execute arbitrary  send out-of-order TCP segments and trick the system into using all
 code with the same privileges as the CVS server program.  available memory buffers.
 <br>  <br>
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.4/common/023_cvs3.patch">  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.4/common/013_tcp.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
 <li id="kerberos">  
 <strong>022: SECURITY FIX: May 30, 2004</strong>  <li id="httpd2">
   <strong>014: SECURITY FIX: March 13, 2004</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 A flaw in the Kerberos V  Due to a bug in the parsing of Allow/Deny rules for
 <a href="https://man.openbsd.org/OpenBSD-3.4/kdc.8">kdc(8)</a>  <a href="https://man.openbsd.org/OpenBSD-3.4/httpd.8">httpd(8)'s</a>
 server could result in the administrator of a Kerberos realm having  access module, using IP addresses without a netmask on big endian 64-bit
 the ability to impersonate any principal in any other realm which  platforms causes the rules to fail to match. This only affects sparc64.
 has established a cross-realm trust with their realm. The flaw is due to  
 inadequate checking of the "transited" field in a Kerberos request. For  
 more details see <a href="http://www.pdc.kth.se/heimdal/advisory/2004-04-01/">  
 Heimdal's announcement</a>.  
 <br>  <br>
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.4/common/022_kerberos.patch">  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.4/common/014_httpd2.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
 <li id="cvs2">  
 <strong>021: SECURITY FIX: May 20, 2004</strong>  <li id="isakmpd2">
   <strong>015: RELIABILITY FIX: March 17, 2004</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 A heap overflow in the  Defects in the payload validation and processing functions of
 <a href="https://man.openbsd.org/OpenBSD-3.4/cvs.1">cvs(1)</a>  <a href="https://man.openbsd.org/OpenBSD-3.4/isakmpd.8">isakmpd(8)</a>
 server has been discovered that can be exploited by clients sending  have been discovered.  An attacker could send malformed ISAKMP messages and
 malformed requests, enabling these clients to run arbitrary code  cause isakmpd to crash or to loop endlessly.  This patch fixes these problems
 with the same privileges as the CVS server program.  and removes some memory leaks.
 <br>  <br>
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.4/common/021_cvs2.patch">  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.4/common/015_isakmpd2.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
 <li id="procfs">  
 <strong>020: SECURITY FIX: May 13, 2004</strong>  <li id="openssl">
   <strong>016: RELIABILITY FIX: March 17, 2004</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 Check for integer overflow in procfs.  Use of procfs is not recommended.  A missing check for a NULL-pointer dereference has been found in
   <a href="https://man.openbsd.org/OpenBSD-3.4/ssl.3">ssl(3)</a>.
   A remote attacker can use the bug to cause an OpenSSL application to crash;
   this may lead to a denial of service.
 <br>  <br>
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.4/common/020_procfs.patch">  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.4/common/016_openssl.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
 <li id="tcp2">  
 <strong>019: RELIABILITY FIX: May 6, 2004</strong>  <li id="cvs">
   <strong>017: SECURITY FIX: May 5, 2004</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 Reply to in-window SYN with a rate-limited ACK.  Pathname validation problems have been found in
   <a href="https://man.openbsd.org/OpenBSD-3.4/cvs.1">cvs(1)</a>,
   allowing malicious clients to create files outside the repository, allowing
   malicious servers to overwrite files outside the local CVS tree on
   the client and allowing clients to check out files outside the CVS
   repository.
 <br>  <br>
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.4/common/019_tcp2.patch">  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.4/common/017_cvs.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
   
 <li id="gdt">  <li id="gdt">
 <strong>018: RELIABILITY FIX: May 5, 2004</strong>  <strong>018: RELIABILITY FIX: May 5, 2004</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
Line 293 
Line 297 
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.4/common/018_gdt.patch">  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.4/common/018_gdt.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
 <li id="cvs">  
 <strong>017: SECURITY FIX: May 5, 2004</strong>  <li id="tcp2">
   <strong>019: RELIABILITY FIX: May 6, 2004</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 Pathname validation problems have been found in  Reply to in-window SYN with a rate-limited ACK.
 <a href="https://man.openbsd.org/OpenBSD-3.4/cvs.1">cvs(1)</a>,  
 allowing malicious clients to create files outside the repository, allowing  
 malicious servers to overwrite files outside the local CVS tree on  
 the client and allowing clients to check out files outside the CVS  
 repository.  
 <br>  <br>
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.4/common/017_cvs.patch">  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.4/common/019_tcp2.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
 <li id="openssl">  
 <strong>016: RELIABILITY FIX: March 17, 2004</strong>  <li id="procfs">
   <strong>020: SECURITY FIX: May 13, 2004</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 A missing check for a NULL-pointer dereference has been found in  Check for integer overflow in procfs.  Use of procfs is not recommended.
 <a href="https://man.openbsd.org/OpenBSD-3.4/ssl.3">ssl(3)</a>.  
 A remote attacker can use the bug to cause an OpenSSL application to crash;  
 this may lead to a denial of service.  
 <br>  <br>
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.4/common/016_openssl.patch">  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.4/common/020_procfs.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
 <li id="isakmpd2">  
 <strong>015: RELIABILITY FIX: March 17, 2004</strong>  <li id="cvs2">
   <strong>021: SECURITY FIX: May 20, 2004</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 Defects in the payload validation and processing functions of  A heap overflow in the
 <a href="https://man.openbsd.org/OpenBSD-3.4/isakmpd.8">isakmpd(8)</a>  <a href="https://man.openbsd.org/OpenBSD-3.4/cvs.1">cvs(1)</a>
 have been discovered.  An attacker could send malformed ISAKMP messages and  server has been discovered that can be exploited by clients sending
 cause isakmpd to crash or to loop endlessly.  This patch fixes these problems  malformed requests, enabling these clients to run arbitrary code
 and removes some memory leaks.  with the same privileges as the CVS server program.
 <br>  <br>
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.4/common/015_isakmpd2.patch">  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.4/common/021_cvs2.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
 <li id="httpd2">  
 <strong>014: SECURITY FIX: March 13, 2004</strong>  <li id="kerberos">
   <strong>022: SECURITY FIX: May 30, 2004</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 Due to a bug in the parsing of Allow/Deny rules for  A flaw in the Kerberos V
 <a href="https://man.openbsd.org/OpenBSD-3.4/httpd.8">httpd(8)'s</a>  <a href="https://man.openbsd.org/OpenBSD-3.4/kdc.8">kdc(8)</a>
 access module, using IP addresses without a netmask on big endian 64-bit  server could result in the administrator of a Kerberos realm having
 platforms causes the rules to fail to match. This only affects sparc64.  the ability to impersonate any principal in any other realm which
   has established a cross-realm trust with their realm. The flaw is due to
   inadequate checking of the "transited" field in a Kerberos request. For
   more details see <a href="http://www.pdc.kth.se/heimdal/advisory/2004-04-01/">
   Heimdal's announcement</a>.
 <br>  <br>
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.4/common/014_httpd2.patch">  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.4/common/022_kerberos.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
 <li id="tcp">  
 <strong>013: RELIABILITY FIX: March 8, 2004</strong>  <li id="cvs3">
   <strong>023: SECURITY FIX: June 9, 2004</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 OpenBSD's TCP/IP stack did not impose limits on how many out-of-order  Multiple remote vulnerabilities have been found in the
 TCP segments are queued in the system.  An attacker could  <a href="https://man.openbsd.org/OpenBSD-3.4/cvs.1">cvs(1)</a>
 send out-of-order TCP segments and trick the system into using all  server that allow an attacker to crash the server or possibly execute arbitrary
 available memory buffers.  code with the same privileges as the CVS server program.
 <br>  <br>
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.4/common/013_tcp.patch">  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.4/common/023_cvs3.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
 <li id="font">  
 <strong>012: RELIABILITY FIX: February 14, 2004</strong>  <li id="isakmpd3">
   <strong>024: SECURITY FIX: June 10, 2004</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 Several buffer overflows exist in the code parsing  As
 font.aliases files in XFree86. Thanks to ProPolice, these cannot be  <a href="http://seclists.org/lists/fulldisclosure/2004/Jun/0191.html">disclosed</a>
 exploited to gain privileges, but they can cause the X server to abort.  by Thomas Walpuski
   <a href="https://man.openbsd.org/OpenBSD-3.4/isakmpd.8">isakmpd(8)</a>
   is still vulnerable to unauthorized SA deletion.  An attacker can delete IPsec
   tunnels at will.
 <br>  <br>
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.4/common/012_font.patch">  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.4/common/024_isakmpd3.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
 <li id="ip6">  
 <strong>011: SECURITY FIX: February 8, 2004</strong>  <li id="httpd3">
   <strong>025: SECURITY FIX: June 12, 2004</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 An IPv6 MTU handling problem exists that could be used by an attacker  Multiple vulnerabilities have been found in
 to cause a denial of service attack against hosts with reachable IPv6  <a href="https://man.openbsd.org/OpenBSD-3.4/httpd.8">httpd(8)</a>
 TCP ports.  / mod_ssl.
   <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0020">CAN-2003-0020</a>,
   <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0987">CAN-2003-0987</a>,
   <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0488">CAN-2004-0488</a>,
   <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0492">CAN-2004-0492</a>.
 <br>  <br>
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.4/common/011_ip6.patch">  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.4/common/025_httpd3.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
 <li id="sysvshm">  
 <strong>010: SECURITY FIX: February 5, 2004</strong>  <li id="rnd">
   <strong>026: RELIABILITY FIX: Jul 25, 2004</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 A reference counting bug exists in the  Under a certain network load the kernel can run out of stack space.  This was
 <a href="https://man.openbsd.org/OpenBSD-3.4/shmat.2">shmat(2)</a>  encountered in an environment using CARP on a VLAN interface.  This issue initially
 system call that could be used by an attacker to write to kernel memory  manifested itself as a FPU related crash on boot up.
 under certain circumstances.  
 <br>  <br>
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.4/common/010_sysvshm.patch">  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.4/common/026_rnd.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
 <li id="isakmpd">  
 <strong>009: SECURITY FIX: January 13, 2004</strong>  <li id="icmp">
   <strong>027: RELIABILITY FIX: August 25, 2004</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 Several message handling flaws in  Improved verification of ICMP errors in order to minimize the impact of ICMP attacks
 <a href="https://man.openbsd.org/OpenBSD-3.4/isakmpd.8">isakmpd(8)</a>  against TCP.
 have been reported by Thomas Walpuski. These allow an attacker to delete arbitrary SAs. The patch also  
 includes a reliability fix for a filedescriptor leak that causes problems when a crypto card is  
 installed.  
 <br>  <br>
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.4/common/009_isakmpd.patch">  <a href="http://www.gont.com.ar/drafts/icmp-attacks-against-tcp.html">http://www.gont.com.ar/drafts/icmp-attacks-against-tcp.html</a>
   <br>
   <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.4/common/027_icmp.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
 <li id="sem">  
 <strong>008: RELIABILITY FIX: November 20, 2003</strong>  
   
   
   
   <li id="pfkey">
   <strong>035: SECURITY FIX: December 13, 2004</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 An improper bounds check makes it possible for a local user to cause a crash  On systems running
 by passing the  <a href="https://man.openbsd.org/OpenBSD-3.4/isakmpd.8">isakmpd(8)</a>
 <a href="https://man.openbsd.org/OpenBSD-3.4/semctl.2">semctl(2)</a> and  it is possible for a local user to cause kernel memory corruption
 <a href="https://man.openbsd.org/OpenBSD-3.4/semop.2">semop(2)</a> functions  and system panic by setting
 certain arguments.  <a href="https://man.openbsd.org/OpenBSD-3.4/ipsec.4">ipsec(4)</a>
   credentials on a socket.
 <br>  <br>
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.4/common/008_sem.patch">  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.4/common/035_pfkey.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
 <li id="uvm">  
 <strong>007: RELIABILITY FIX: November 20, 2003</strong>  <li id="lynx">
   <strong>034: RELIABILITY FIX: November 10, 2004</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 It is possible for a local user to cause a crash via  Due to a bug in
 <a href="https://man.openbsd.org/OpenBSD-3.4/sysctl.3">sysctl(3)</a> with certain arguments.  <a href="https://man.openbsd.org/OpenBSD-3.4/lynx.1">lynx(1)</a>
   it is possible for pages such as
   <a href="http://lcamtuf.coredump.cx/mangleme/gallery/lynx_die1.html">this</a>
   to cause
   <a href="https://man.openbsd.org/OpenBSD-3.4/lynx.1">lynx(1)</a>
   to exhaust memory and then crash when parsing such pages.
 <br>  <br>
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.4/common/007_uvm.patch">  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.4/common/034_lynx.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
 <li id="ibcs2">  
 <strong>006: SECURITY FIX: November 17, 2003</strong>  <li id="pppd">
 &nbsp; <i>i386 only</i><br>  <strong>033: RELIABILITY FIX: November 10, 2004</strong>
 It may be possible for a local user to overrun the stack in  &nbsp; <i>All architectures</i><br>
 <a href="https://man.openbsd.org/OpenBSD-3.4/compat_ibcs2.8">compat_ibcs2(8)</a>.<br>  <a href="https://man.openbsd.org/OpenBSD-3.4/pppd.8">pppd(8)</a>
 ProPolice catches this, turning a potential privilege escalation into a denial  contains a bug that allows an attacker to crash his own connection, but it cannot
 of service. iBCS2 emulation does not need to be enabled via  be used to deny service to other users.
 <a href="https://man.openbsd.org/OpenBSD-3.4/sysctl.8">sysctl(8)</a>  
 for this to happen.  
 <br>  <br>
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.4/i386/006_ibcs2.patch">  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.4/common/033_pppd.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
 <li id="exec">  
 <strong>005: RELIABILITY FIX: November 4, 2003</strong>  <li id="bind">
   <strong>032: RELIABILITY FIX: November 10, 2004</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 It is possible for a local user to cause a system panic by executing a specially crafted binary with an invalid header.  BIND contains a bug which results in BIND trying to contact nameservers via IPv6, even in
   cases where IPv6 connectivity is non-existent. This results in unnecessary timeouts and
   thus slow DNS queries.
 <br>  <br>
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.4/common/005_exec.patch">  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.4/common/032_bind.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
 <li id="httpd">  
 <strong>004: RELIABILITY FIX: November 1, 2003</strong>  <li id="radius">
   <strong>031: SECURITY FIX: September 20, 2004</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 A user with write permission to <code>httpd.conf</code> or a <code>.htaccess</code>  Eilko Bos reported that radius authentication, as implemented by
 file can crash  <a href="https://man.openbsd.org/OpenBSD-3.4/login_radius.8">login_radius(8)</a>,
 <a href="https://man.openbsd.org/OpenBSD-3.4/httpd.8">httpd(8)</a>  was not checking the shared secret used for replies sent by the radius server.
 or potentially run arbitrary code as the user <code>www</code> (although it  This could allow an attacker to spoof a reply granting access to the
 is believed that ProPolice will prevent code execution).  attacker.  Note that OpenBSD does not ship with radius authentication enabled.
 <br>  <br>
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.4/common/004_httpd.patch">  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.4/common/031_radius.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
 <li id="arp">  
 <strong>003: RELIABILITY FIX: November 1, 2003</strong>  <li id="xpm">
   <strong>030: SECURITY FIX: September 16, 2004</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 It is possible for a local user to cause a system panic by flooding it with spoofed ARP  Chris Evans reported several flaws (stack and integer overflows) in the
 requests.<br>  <a href="http://www.inria.fr/koala/lehors/xpm.html">Xpm</a>
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.4/common/003_arp.patch">  library code that parses image files
   (<a href="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0687">CAN-2004-0687</a>,
   <a href="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0688">CAN-2004-0688</a>).
   Some of these would be exploitable when parsing malicious image files in
   an application that handles XPM images, if they could escape ProPolice.
   <br>
   <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.4/common/030_xpm.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
 <li id="asn1">  
 <strong>002: SECURITY FIX: November 1, 2003</strong>  <li id="httpd4">
   <strong>029: SECURITY FIX: September 10, 2004</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 The use of certain ASN.1 encodings or malformed public keys may allow an  <a href="https://man.openbsd.org/OpenBSD-3.4/httpd.8">httpd(8)</a>
 attacker to mount a denial of service attack against applications linked with  's mod_rewrite module can be made to write one zero byte in an arbitrary memory
 <a href="https://man.openbsd.org/OpenBSD-3.4/ssl.3">ssl(3)</a>.  position outside of a char array, causing a DoS or possibly buffer overflows.
 This does not affect OpenSSH.<br>  This would require enabling dbm for mod_rewrite and making use of a malicious
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.4/common/002_asn1.patch">  dbm file.
   <br>
   <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.4/common/029_httpd4.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
 <li id="cd_booklet">  
 <strong>001: DOCUMENTATION FIX: November 1, 2003</strong>  <li id="bridge">
   <strong>028: RELIABILITY FIX: August 26, 2004</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 The CD insert documentation has an incorrect example for package installation.<br>  As
 Where it is written:<p>  <a href="https://marc.info/?l=bugtraq&amp;m=109345131508824&amp;w=2">reported</a>
 <b>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;  by Vafa Izadinia
 # pkg_add https://ftp.openbsd.org/pub/OpenBSD/3.4/packages/i386</b><p>  <a href="https://man.openbsd.org/OpenBSD-3.4/bridge.4">bridge(4)</a>
 It should instead read:<p>  with IPsec processing enabled can be crashed remotely by a single ICMP echo traversing the bridge.
 <b>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;  <br>
 # pkg_add https://ftp.openbsd.org/pub/OpenBSD/3.4/packages/i386/</b><p>  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.4/common/028_bridge.patch">
 The extra <b>/</b> at the end is important.  We do not make  A source code patch exists which remedies this problem.</a>
 patch files available for things printed on paper.  
 <p>  <p>
   
 </ul>  </ul>
Legend:
Removed from v.1.90  
changed lines
  Added in v.1.91