| version 1.83, 2017/03/28 06:41:18 |
version 1.84, 2017/06/26 17:18:57 |
|
|
| <font color="#009000"><strong>035: SECURITY FIX: December 13, 2004</strong></font> |
<font color="#009000"><strong>035: SECURITY FIX: December 13, 2004</strong></font> |
| <i>All architectures</i><br> |
<i>All architectures</i><br> |
| On systems running |
On systems running |
| <a href="http://man.openbsd.org/OpenBSD-3.4/isakmpd.8">isakmpd(8)</a> |
<a href="https://man.openbsd.org/OpenBSD-3.4/isakmpd.8">isakmpd(8)</a> |
| it is possible for a local user to cause kernel memory corruption |
it is possible for a local user to cause kernel memory corruption |
| and system panic by setting |
and system panic by setting |
| <a href="http://man.openbsd.org/OpenBSD-3.4/ipsec.4">ipsec(4)</a> |
<a href="https://man.openbsd.org/OpenBSD-3.4/ipsec.4">ipsec(4)</a> |
| credentials on a socket. |
credentials on a socket. |
| <br> |
<br> |
| <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.4/common/035_pfkey.patch"> |
<a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.4/common/035_pfkey.patch"> |
|
|
| <font color="#009000"><strong>034: RELIABILITY FIX: November 10, 2004</strong></font> |
<font color="#009000"><strong>034: RELIABILITY FIX: November 10, 2004</strong></font> |
| <i>All architectures</i><br> |
<i>All architectures</i><br> |
| Due to a bug in |
Due to a bug in |
| <a href="http://man.openbsd.org/OpenBSD-3.4/lynx.1">lynx(1)</a> |
<a href="https://man.openbsd.org/OpenBSD-3.4/lynx.1">lynx(1)</a> |
| it is possible for pages such as |
it is possible for pages such as |
| <a href="http://lcamtuf.coredump.cx/mangleme/gallery/lynx_die1.html">this</a> |
<a href="http://lcamtuf.coredump.cx/mangleme/gallery/lynx_die1.html">this</a> |
| to cause |
to cause |
| <a href="http://man.openbsd.org/OpenBSD-3.4/lynx.1">lynx(1)</a> |
<a href="https://man.openbsd.org/OpenBSD-3.4/lynx.1">lynx(1)</a> |
| to exhaust memory and then crash when parsing such pages. |
to exhaust memory and then crash when parsing such pages. |
| <br> |
<br> |
| <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.4/common/034_lynx.patch"> |
<a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.4/common/034_lynx.patch"> |
|
|
| <li id="pppd"> |
<li id="pppd"> |
| <font color="#009000"><strong>033: RELIABILITY FIX: November 10, 2004</strong></font> |
<font color="#009000"><strong>033: RELIABILITY FIX: November 10, 2004</strong></font> |
| <i>All architectures</i><br> |
<i>All architectures</i><br> |
| <a href="http://man.openbsd.org/OpenBSD-3.4/pppd.8">pppd(8)</a> |
<a href="https://man.openbsd.org/OpenBSD-3.4/pppd.8">pppd(8)</a> |
| contains a bug that allows an attacker to crash his own connection, but it cannot |
contains a bug that allows an attacker to crash his own connection, but it cannot |
| be used to deny service to other users. |
be used to deny service to other users. |
| <br> |
<br> |
|
|
| <font color="#009000"><strong>031: SECURITY FIX: September 20, 2004</strong></font> |
<font color="#009000"><strong>031: SECURITY FIX: September 20, 2004</strong></font> |
| <i>All architectures</i><br> |
<i>All architectures</i><br> |
| Eilko Bos reported that radius authentication, as implemented by |
Eilko Bos reported that radius authentication, as implemented by |
| <a href="http://man.openbsd.org/OpenBSD-3.4/login_radius.8">login_radius(8)</a>, |
<a href="https://man.openbsd.org/OpenBSD-3.4/login_radius.8">login_radius(8)</a>, |
| was not checking the shared secret used for replies sent by the radius server. |
was not checking the shared secret used for replies sent by the radius server. |
| This could allow an attacker to spoof a reply granting access to the |
This could allow an attacker to spoof a reply granting access to the |
| attacker. Note that OpenBSD does not ship with radius authentication enabled. |
attacker. Note that OpenBSD does not ship with radius authentication enabled. |
|
|
| <li id="httpd4"> |
<li id="httpd4"> |
| <font color="#009000"><strong>029: SECURITY FIX: September 10, 2004</strong></font> |
<font color="#009000"><strong>029: SECURITY FIX: September 10, 2004</strong></font> |
| <i>All architectures</i><br> |
<i>All architectures</i><br> |
| <a href="http://man.openbsd.org/OpenBSD-3.4/httpd.8">httpd(8)</a> |
<a href="https://man.openbsd.org/OpenBSD-3.4/httpd.8">httpd(8)</a> |
| 's mod_rewrite module can be made to write one zero byte in an arbitrary memory |
's mod_rewrite module can be made to write one zero byte in an arbitrary memory |
| position outside of a char array, causing a DoS or possibly buffer overflows. |
position outside of a char array, causing a DoS or possibly buffer overflows. |
| This would require enabling dbm for mod_rewrite and making use of a malicious |
This would require enabling dbm for mod_rewrite and making use of a malicious |
|
|
| As |
As |
| <a href="http://marc.info/?l=bugtraq&m=109345131508824&w=2">reported</a> |
<a href="http://marc.info/?l=bugtraq&m=109345131508824&w=2">reported</a> |
| by Vafa Izadinia |
by Vafa Izadinia |
| <a href="http://man.openbsd.org/OpenBSD-3.4/bridge.4">bridge(4)</a> |
<a href="https://man.openbsd.org/OpenBSD-3.4/bridge.4">bridge(4)</a> |
| with IPsec processing enabled can be crashed remotely by a single ICMP echo traversing the bridge. |
with IPsec processing enabled can be crashed remotely by a single ICMP echo traversing the bridge. |
| <br> |
<br> |
| <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.4/common/028_bridge.patch"> |
<a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.4/common/028_bridge.patch"> |
|
|
| <font color="#009000"><strong>025: SECURITY FIX: June 12, 2004</strong></font> |
<font color="#009000"><strong>025: SECURITY FIX: June 12, 2004</strong></font> |
| <i>All architectures</i><br> |
<i>All architectures</i><br> |
| Multiple vulnerabilities have been found in |
Multiple vulnerabilities have been found in |
| <a href="http://man.openbsd.org/OpenBSD-3.4/httpd.8">httpd(8)</a> |
<a href="https://man.openbsd.org/OpenBSD-3.4/httpd.8">httpd(8)</a> |
| / mod_ssl. |
/ mod_ssl. |
| <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0020">CAN-2003-0020</a>, |
<a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0020">CAN-2003-0020</a>, |
| <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0987">CAN-2003-0987</a>, |
<a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0987">CAN-2003-0987</a>, |
|
|
| As |
As |
| <a href="http://seclists.org/lists/fulldisclosure/2004/Jun/0191.html">disclosed</a> |
<a href="http://seclists.org/lists/fulldisclosure/2004/Jun/0191.html">disclosed</a> |
| by Thomas Walpuski |
by Thomas Walpuski |
| <a href="http://man.openbsd.org/OpenBSD-3.4/isakmpd.8">isakmpd(8)</a> |
<a href="https://man.openbsd.org/OpenBSD-3.4/isakmpd.8">isakmpd(8)</a> |
| is still vulnerable to unauthorized SA deletion. An attacker can delete IPsec |
is still vulnerable to unauthorized SA deletion. An attacker can delete IPsec |
| tunnels at will. |
tunnels at will. |
| <br> |
<br> |
|
|
| <font color="#009000"><strong>023: SECURITY FIX: June 9, 2004</strong></font> |
<font color="#009000"><strong>023: SECURITY FIX: June 9, 2004</strong></font> |
| <i>All architectures</i><br> |
<i>All architectures</i><br> |
| Multiple remote vulnerabilities have been found in the |
Multiple remote vulnerabilities have been found in the |
| <a href="http://man.openbsd.org/OpenBSD-3.4/cvs.1">cvs(1)</a> |
<a href="https://man.openbsd.org/OpenBSD-3.4/cvs.1">cvs(1)</a> |
| server that allow an attacker to crash the server or possibly execute arbitrary |
server that allow an attacker to crash the server or possibly execute arbitrary |
| code with the same privileges as the CVS server program. |
code with the same privileges as the CVS server program. |
| <br> |
<br> |
|
|
| <font color="#00900"><strong>022: SECURITY FIX: May 30, 2004</strong></font> |
<font color="#00900"><strong>022: SECURITY FIX: May 30, 2004</strong></font> |
| <i>All architectures</i><br> |
<i>All architectures</i><br> |
| A flaw in the Kerberos V |
A flaw in the Kerberos V |
| <a href="http://man.openbsd.org/OpenBSD-3.4/kdc.8">kdc(8)</a> |
<a href="https://man.openbsd.org/OpenBSD-3.4/kdc.8">kdc(8)</a> |
| server could result in the administrator of a Kerberos realm having |
server could result in the administrator of a Kerberos realm having |
| the ability to impersonate any principal in any other realm which |
the ability to impersonate any principal in any other realm which |
| has established a cross-realm trust with their realm. The flaw is due to |
has established a cross-realm trust with their realm. The flaw is due to |
|
|
| <font color="#009000"><strong>021: SECURITY FIX: May 20, 2004</strong></font> |
<font color="#009000"><strong>021: SECURITY FIX: May 20, 2004</strong></font> |
| <i>All architectures</i><br> |
<i>All architectures</i><br> |
| A heap overflow in the |
A heap overflow in the |
| <a href="http://man.openbsd.org/OpenBSD-3.4/cvs.1">cvs(1)</a> |
<a href="https://man.openbsd.org/OpenBSD-3.4/cvs.1">cvs(1)</a> |
| server has been discovered that can be exploited by clients sending |
server has been discovered that can be exploited by clients sending |
| malformed requests, enabling these clients to run arbitrary code |
malformed requests, enabling these clients to run arbitrary code |
| with the same privileges as the CVS server program. |
with the same privileges as the CVS server program. |
|
|
| <font color="#009000"><strong>018: RELIABILITY FIX: May 5, 2004</strong></font> |
<font color="#009000"><strong>018: RELIABILITY FIX: May 5, 2004</strong></font> |
| <i>All architectures</i><br> |
<i>All architectures</i><br> |
| Under load "recent model" |
Under load "recent model" |
| <a href="http://man.openbsd.org/OpenBSD-3.4/gdt.4">gdt(4)</a> |
<a href="https://man.openbsd.org/OpenBSD-3.4/gdt.4">gdt(4)</a> |
| controllers will lock up. |
controllers will lock up. |
| <br> |
<br> |
| <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.4/common/018_gdt.patch"> |
<a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.4/common/018_gdt.patch"> |
|
|
| <font color="#009000"><strong>017: SECURITY FIX: May 5, 2004</strong></font> |
<font color="#009000"><strong>017: SECURITY FIX: May 5, 2004</strong></font> |
| <i>All architectures</i><br> |
<i>All architectures</i><br> |
| Pathname validation problems have been found in |
Pathname validation problems have been found in |
| <a href="http://man.openbsd.org/OpenBSD-3.4/cvs.1">cvs(1)</a>, |
<a href="https://man.openbsd.org/OpenBSD-3.4/cvs.1">cvs(1)</a>, |
| allowing malicious clients to create files outside the repository, allowing |
allowing malicious clients to create files outside the repository, allowing |
| malicious servers to overwrite files outside the local CVS tree on |
malicious servers to overwrite files outside the local CVS tree on |
| the client and allowing clients to check out files outside the CVS |
the client and allowing clients to check out files outside the CVS |
|
|
| <font color="#009000"><strong>016: RELIABILITY FIX: March 17, 2004</strong></font> |
<font color="#009000"><strong>016: RELIABILITY FIX: March 17, 2004</strong></font> |
| <i>All architectures</i><br> |
<i>All architectures</i><br> |
| A missing check for a NULL-pointer dereference has been found in |
A missing check for a NULL-pointer dereference has been found in |
| <a href="http://man.openbsd.org/OpenBSD-3.4/ssl.3">ssl(3)</a>. |
<a href="https://man.openbsd.org/OpenBSD-3.4/ssl.3">ssl(3)</a>. |
| A remote attacker can use the bug to cause an OpenSSL application to crash; |
A remote attacker can use the bug to cause an OpenSSL application to crash; |
| this may lead to a denial of service. |
this may lead to a denial of service. |
| <br> |
<br> |
|
|
| <font color="#009000"><strong>015: RELIABILITY FIX: March 17, 2004</strong></font> |
<font color="#009000"><strong>015: RELIABILITY FIX: March 17, 2004</strong></font> |
| <i>All architectures</i><br> |
<i>All architectures</i><br> |
| Defects in the payload validation and processing functions of |
Defects in the payload validation and processing functions of |
| <a href="http://man.openbsd.org/OpenBSD-3.4/isakmpd.8">isakmpd(8)</a> |
<a href="https://man.openbsd.org/OpenBSD-3.4/isakmpd.8">isakmpd(8)</a> |
| have been discovered. An attacker could send malformed ISAKMP messages and |
have been discovered. An attacker could send malformed ISAKMP messages and |
| cause isakmpd to crash or to loop endlessly. This patch fixes these problems |
cause isakmpd to crash or to loop endlessly. This patch fixes these problems |
| and removes some memory leaks. |
and removes some memory leaks. |
|
|
| <font color="#009000"><strong>014: SECURITY FIX: March 13, 2004</strong></font> |
<font color="#009000"><strong>014: SECURITY FIX: March 13, 2004</strong></font> |
| <i>All architectures</i><br> |
<i>All architectures</i><br> |
| Due to a bug in the parsing of Allow/Deny rules for |
Due to a bug in the parsing of Allow/Deny rules for |
| <a href="http://man.openbsd.org/OpenBSD-3.4/httpd.8">httpd(8)'s</a> |
<a href="https://man.openbsd.org/OpenBSD-3.4/httpd.8">httpd(8)'s</a> |
| access module, using IP addresses without a netmask on big endian 64-bit |
access module, using IP addresses without a netmask on big endian 64-bit |
| platforms causes the rules to fail to match. This only affects sparc64. |
platforms causes the rules to fail to match. This only affects sparc64. |
| <br> |
<br> |
|
|
| <font color="#009000"><strong>010: SECURITY FIX: February 5, 2004</strong></font> |
<font color="#009000"><strong>010: SECURITY FIX: February 5, 2004</strong></font> |
| <i>All architectures</i><br> |
<i>All architectures</i><br> |
| A reference counting bug exists in the |
A reference counting bug exists in the |
| <a href="http://man.openbsd.org/OpenBSD-3.4/shmat.2">shmat(2)</a> |
<a href="https://man.openbsd.org/OpenBSD-3.4/shmat.2">shmat(2)</a> |
| system call that could be used by an attacker to write to kernel memory |
system call that could be used by an attacker to write to kernel memory |
| under certain circumstances. |
under certain circumstances. |
| <br> |
<br> |
|
|
| <font color="#009000"><strong>009: SECURITY FIX: January 13, 2004</strong></font> |
<font color="#009000"><strong>009: SECURITY FIX: January 13, 2004</strong></font> |
| <i>All architectures</i><br> |
<i>All architectures</i><br> |
| Several message handling flaws in |
Several message handling flaws in |
| <a href="http://man.openbsd.org/OpenBSD-3.4/isakmpd.8">isakmpd(8)</a> |
<a href="https://man.openbsd.org/OpenBSD-3.4/isakmpd.8">isakmpd(8)</a> |
| have been reported by Thomas Walpuski. These allow an attacker to delete arbitrary SAs. The patch also |
have been reported by Thomas Walpuski. These allow an attacker to delete arbitrary SAs. The patch also |
| includes a reliability fix for a filedescriptor leak that causes problems when a crypto card is |
includes a reliability fix for a filedescriptor leak that causes problems when a crypto card is |
| installed. |
installed. |
|
|
| <i>All architectures</i><br> |
<i>All architectures</i><br> |
| An improper bounds check makes it possible for a local user to cause a crash |
An improper bounds check makes it possible for a local user to cause a crash |
| by passing the |
by passing the |
| <a href="http://man.openbsd.org/OpenBSD-3.4/semctl.2">semctl(2)</a> and |
<a href="https://man.openbsd.org/OpenBSD-3.4/semctl.2">semctl(2)</a> and |
| <a href="http://man.openbsd.org/OpenBSD-3.4/semop.2">semop(2)</a> functions |
<a href="https://man.openbsd.org/OpenBSD-3.4/semop.2">semop(2)</a> functions |
| certain arguments. |
certain arguments. |
| <br> |
<br> |
| <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.4/common/008_sem.patch"> |
<a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.4/common/008_sem.patch"> |
|
|
| <font color="#009000"><strong>007: RELIABILITY FIX: November 20, 2003</strong></font> |
<font color="#009000"><strong>007: RELIABILITY FIX: November 20, 2003</strong></font> |
| <i>All architectures</i><br> |
<i>All architectures</i><br> |
| It is possible for a local user to cause a crash via |
It is possible for a local user to cause a crash via |
| <a href="http://man.openbsd.org/OpenBSD-3.4/sysctl.3">sysctl(3)</a> with certain arguments. |
<a href="https://man.openbsd.org/OpenBSD-3.4/sysctl.3">sysctl(3)</a> with certain arguments. |
| <br> |
<br> |
| <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.4/common/007_uvm.patch"> |
<a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.4/common/007_uvm.patch"> |
| A source code patch exists which remedies this problem.</a> |
A source code patch exists which remedies this problem.</a> |
|
|
| <font color="#009000"><strong>006: SECURITY FIX: November 17, 2003</strong></font> |
<font color="#009000"><strong>006: SECURITY FIX: November 17, 2003</strong></font> |
| <i>i386 only</i><br> |
<i>i386 only</i><br> |
| It may be possible for a local user to overrun the stack in |
It may be possible for a local user to overrun the stack in |
| <a href="http://man.openbsd.org/OpenBSD-3.4/compat_ibcs2.8">compat_ibcs2(8)</a>.<br> |
<a href="https://man.openbsd.org/OpenBSD-3.4/compat_ibcs2.8">compat_ibcs2(8)</a>.<br> |
| ProPolice catches this, turning a potential privilege escalation into a denial |
ProPolice catches this, turning a potential privilege escalation into a denial |
| of service. iBCS2 emulation does not need to be enabled via |
of service. iBCS2 emulation does not need to be enabled via |
| <a href="http://man.openbsd.org/OpenBSD-3.4/sysctl.8">sysctl(8)</a> |
<a href="https://man.openbsd.org/OpenBSD-3.4/sysctl.8">sysctl(8)</a> |
| for this to happen. |
for this to happen. |
| <br> |
<br> |
| <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.4/i386/006_ibcs2.patch"> |
<a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.4/i386/006_ibcs2.patch"> |
|
|
| <i>All architectures</i><br> |
<i>All architectures</i><br> |
| A user with write permission to <tt>httpd.conf</tt> or a <tt>.htaccess</tt> |
A user with write permission to <tt>httpd.conf</tt> or a <tt>.htaccess</tt> |
| file can crash |
file can crash |
| <a href="http://man.openbsd.org/OpenBSD-3.4/httpd.8">httpd(8)</a> |
<a href="https://man.openbsd.org/OpenBSD-3.4/httpd.8">httpd(8)</a> |
| or potentially run arbitrary code as the user <tt>www</tt> (although it |
or potentially run arbitrary code as the user <tt>www</tt> (although it |
| is believed that ProPolice will prevent code execution). |
is believed that ProPolice will prevent code execution). |
| <br> |
<br> |
|
|
| <i>All architectures</i><br> |
<i>All architectures</i><br> |
| The use of certain ASN.1 encodings or malformed public keys may allow an |
The use of certain ASN.1 encodings or malformed public keys may allow an |
| attacker to mount a denial of service attack against applications linked with |
attacker to mount a denial of service attack against applications linked with |
| <a href="http://man.openbsd.org/OpenBSD-3.4/ssl.3">ssl(3)</a>. |
<a href="https://man.openbsd.org/OpenBSD-3.4/ssl.3">ssl(3)</a>. |
| This does not affect OpenSSH.<br> |
This does not affect OpenSSH.<br> |
| <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.4/common/002_asn1.patch"> |
<a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.4/common/002_asn1.patch"> |
| A source code patch exists which remedies this problem.</a> |
A source code patch exists which remedies this problem.</a> |
![[BACK]](/icons/back.gif){kind=icon}
Return to errata34.html CVS log ![[TXT]](/icons/text.gif){kind=icon}
![[DIR]](/icons/dir.gif){kind=icon}
Up to [local] / www