[BACK]Return to errata36.html CVS log [TXT][DIR] Up to [local] / www

Diff for /www/errata36.html between version 1.61 and 1.62

version 1.61, 2019/05/27 22:55:19 version 1.62, 2019/05/28 16:32:42
Line 85 
Line 85 
   
 <ul>  <ul>
   
 <li id="libz2">  <li id="st">
 <strong>020: SECURITY FIX: July 21, 2005</strong>  <strong>001: RELIABILITY FIX: November 10, 2004</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 A buffer overflow has been found in  Fix detection of tape blocksize during device open. Corrects problem with
 <a href="https://man.openbsd.org/OpenBSD-3.6/compress.3">compress(3)</a>  <a href="https://man.openbsd.org/OpenBSD-3.6/restore.8">restore(8)</a>.
 which may be exploitable.<br>  
 Please note that this fixes a different buffer overflow than the <a href="#libz">previous</a> zlib patch.  
 <br>  <br>
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.6/common/020_libz.patch">  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.6/common/001_st.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
   
 <li id="libz">  <li id="bind">
 <strong>019: SECURITY FIX: July 6, 2005</strong>  <strong>002: RELIABILITY FIX: November 10, 2004</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 A buffer overflow has been found in  BIND contains a bug which results in BIND trying to contact nameservers via IPv6, even in
 <a href="https://man.openbsd.org/OpenBSD-3.6/compress.3">compress(3)</a>  cases where IPv6 connectivity is non-existent. This results in unnecessary timeouts and
 which may be exploitable.  thus slow DNS queries.
 <br>  <br>
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.6/common/019_libz.patch">  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.6/common/002_bind.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
   
 <li id="sudo">  <li id="pppd">
 <strong>018: SECURITY FIX: June 20, 2005</strong>  <strong>003: RELIABILITY FIX: November 10, 2004</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 Due to a race condition in its command pathname handling, a user with  <a href="https://man.openbsd.org/OpenBSD-3.6/pppd.8">pppd(8)</a>
 <a href="https://man.openbsd.org/OpenBSD-3.6/sudo.8">sudo(8)</a>  contains a bug that allows an attacker to crash his own connection, but it cannot
 privileges may be able to run arbitrary commands if the user's entry  be used to deny service to other users.
 is followed by an entry that grants <code>sudo ALL</code> privileges to  
 another user.  
 <br>  <br>
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.6/common/018_sudo.patch">  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.6/common/003_pppd.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
   
 <li id="getsockopt">  <li id="lynx">
 <strong>017: RELIABILITY FIX: June 15, 2005</strong>  <strong>004: RELIABILITY FIX: November 10, 2004</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 As discovered by Stefan Miltchev calling  Due to a bug in
 <a href="https://man.openbsd.org/OpenBSD-3.6/getsockopt.2">getsockopt(2)</a>  <a href="https://man.openbsd.org/OpenBSD-3.6/lynx.1">lynx(1)</a>
 to get  it is possible for pages such as
 <a href="https://man.openbsd.org/OpenBSD-3.6/ipsec.4">ipsec(4)</a>  <a href="http://lcamtuf.coredump.cx/mangleme/gallery/lynx_die1.html">this</a>
 credentials for a socket can result in a kernel panic.  to cause
   <a href="https://man.openbsd.org/OpenBSD-3.6/lynx.1">lynx(1)</a>
   to exhaust memory and then crash when parsing such pages.
 <br>  <br>
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.6/common/017_getsockopt.patch">  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.6/common/004_lynx.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
   
 <li id="cvs">  <li id="isakmpd">
 <strong>016: SECURITY FIX: April 28, 2005</strong>  <strong>005: RELIABILITY FIX: November 21, 2004</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 Fix a buffer overflow, memory leaks, and NULL pointer dereference in  Wrong calculation of NAT-D payloads may cause interoperability problems between
 <a href="https://man.openbsd.org/OpenBSD-3.6/cvs.1">cvs(1)</a>  <a href="https://man.openbsd.org/OpenBSD-3.6/isakmpd.8">isakmpd(8)</a>
 . None of these issues are known to be exploitable.  and other ISAKMP/IKE implementations.
 <a href="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0753">CAN-2005-0753</a>  
 .  
 <br>  <br>
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.6/common/016_cvs.patch">  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.6/common/005_isakmpd.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
   
 <li id="tcp">  <li id="xl">
 <strong>015: RELIABILITY FIX: April 4, 2005</strong>  <strong>006: RELIABILITY FIX: November 21, 2004</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 Handle an edge condition in  Fix for transmit side breakage on macppc and mbuf leaks with
 <a href="https://man.openbsd.org/OpenBSD-3.6/tcp.4">tcp(4)</a>  <a href="https://man.openbsd.org/OpenBSD-3.6/xl.4">xl(4)</a>.
 timestamps.  
 <br>  <br>
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.6/common/015_tcp.patch">  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.6/common/006_xl.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
   
 <li id="telnet">  <li id="pfkey">
 <strong>014: SECURITY FIX: March 30, 2005</strong>  <strong>007: SECURITY FIX: December 14, 2004</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 Due to buffer overflows in  On systems running
 <a href="https://man.openbsd.org/OpenBSD-3.6/telnet.1">telnet(1)</a>,  <a href="https://man.openbsd.org/OpenBSD-3.6/isakmpd.8">isakmpd(8)</a>
 a malicious server or man-in-the-middle attack could allow execution of  it is possible for a local user to cause kernel memory corruption
 arbitrary code with the privileges of the user invoking  and system panic by setting
 <a href="https://man.openbsd.org/OpenBSD-3.6/telnet.1">telnet(1)</a>.  <a href="https://man.openbsd.org/OpenBSD-3.6/ipsec.4">ipsec(4)</a>
 Noone should use telnet anymore.  Please use  credentials on a socket.
 <a href="https://man.openbsd.org/OpenBSD-3.6/ssh.1">ssh(1)</a>.  
 <br>  <br>
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.6/common/014_telnet.patch">  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.6/common/007_pfkey.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
   
 <li id="sack">  <li id="getcwd">
 <strong>013: RELIABILITY FIX: March 30, 2005</strong>  <strong>008: RELIABILITY FIX: January 6, 2005</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 Bugs in the  The
 <a href="https://man.openbsd.org/OpenBSD-3.6/tcp.4">tcp(4)</a>  <a href="https://man.openbsd.org/OpenBSD-3.6/getcwd.3">getcwd(3)</a>
 stack can lead to memory exhaustion or processing of TCP segments with  library function contains a memory management error, which causes failure
 invalid SACK options and cause a system crash.  to retrieve the current working directory if the path is very long.
 <br>  <br>
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.6/common/013_sack.patch">  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.6/common/008_getcwd.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
   
 <li id="copy">  <li id="httpd">
 <strong>012: SECURITY FIX: March 16, 2005</strong>  <strong>009: SECURITY FIX: January 12, 2005</strong>
 &nbsp; <i>amd64 only</i><br>  &nbsp; <i>All architectures</i><br>
 More stringent checking should be done in the  <a href="https://man.openbsd.org/OpenBSD-3.6/httpd.8">httpd(8)</a>
 <a href="https://man.openbsd.org/OpenBSD-3.6/copy.9">copy(9)</a>  's mod_include module fails to properly validate the length of
 functions to prevent their misuse.  user supplied tag strings prior to copying them to a local buffer,
   causing a buffer overflow.
 <br>  <br>
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.6/amd64/012_copy.patch">  This would require enabling the XBitHack directive or server-side
 A source code patch exists which remedies this problem.</a>  includes and making use of a malicious document.
 <p>  
   
 <li id="locore">  
 <strong>011: SECURITY FIX: February 28, 2005</strong>  
 &nbsp; <i>i386 only</i><br>  
 More stringent checking should be done in the  
 <a href="https://man.openbsd.org/OpenBSD-3.6/copy.9">copy(9)</a>  
 functions to prevent their misuse.  
 <br>  <br>
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.6/i386/011_locore.patch">  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.6/common/009_httpd.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
   
Line 220 
Line 207 
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
   
 <li id="httpd">  <li id="locore">
 <strong>009: SECURITY FIX: January 12, 2005</strong>  <strong>011: SECURITY FIX: February 28, 2005</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>i386 only</i><br>
 <a href="https://man.openbsd.org/OpenBSD-3.6/httpd.8">httpd(8)</a>  More stringent checking should be done in the
 's mod_include module fails to properly validate the length of  <a href="https://man.openbsd.org/OpenBSD-3.6/copy.9">copy(9)</a>
 user supplied tag strings prior to copying them to a local buffer,  functions to prevent their misuse.
 causing a buffer overflow.  
 <br>  <br>
 This would require enabling the XBitHack directive or server-side  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.6/i386/011_locore.patch">
 includes and making use of a malicious document.  A source code patch exists which remedies this problem.</a>
   <p>
   
   <li id="copy">
   <strong>012: SECURITY FIX: March 16, 2005</strong>
   &nbsp; <i>amd64 only</i><br>
   More stringent checking should be done in the
   <a href="https://man.openbsd.org/OpenBSD-3.6/copy.9">copy(9)</a>
   functions to prevent their misuse.
 <br>  <br>
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.6/common/009_httpd.patch">  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.6/amd64/012_copy.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
   
 <li id="getcwd">  <li id="sack">
 <strong>008: RELIABILITY FIX: January 6, 2005</strong>  <strong>013: RELIABILITY FIX: March 30, 2005</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 The  Bugs in the
 <a href="https://man.openbsd.org/OpenBSD-3.6/getcwd.3">getcwd(3)</a>  <a href="https://man.openbsd.org/OpenBSD-3.6/tcp.4">tcp(4)</a>
 library function contains a memory management error, which causes failure  stack can lead to memory exhaustion or processing of TCP segments with
 to retrieve the current working directory if the path is very long.  invalid SACK options and cause a system crash.
 <br>  <br>
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.6/common/008_getcwd.patch">  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.6/common/013_sack.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
   
 <li id="pfkey">  <li id="telnet">
 <strong>007: SECURITY FIX: December 14, 2004</strong>  <strong>014: SECURITY FIX: March 30, 2005</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 On systems running  Due to buffer overflows in
 <a href="https://man.openbsd.org/OpenBSD-3.6/isakmpd.8">isakmpd(8)</a>  <a href="https://man.openbsd.org/OpenBSD-3.6/telnet.1">telnet(1)</a>,
 it is possible for a local user to cause kernel memory corruption  a malicious server or man-in-the-middle attack could allow execution of
 and system panic by setting  arbitrary code with the privileges of the user invoking
 <a href="https://man.openbsd.org/OpenBSD-3.6/ipsec.4">ipsec(4)</a>  <a href="https://man.openbsd.org/OpenBSD-3.6/telnet.1">telnet(1)</a>.
 credentials on a socket.  Noone should use telnet anymore.  Please use
   <a href="https://man.openbsd.org/OpenBSD-3.6/ssh.1">ssh(1)</a>.
 <br>  <br>
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.6/common/007_pfkey.patch">  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.6/common/014_telnet.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
   
 <li id="xl">  <li id="tcp">
 <strong>006: RELIABILITY FIX: November 21, 2004</strong>  <strong>015: RELIABILITY FIX: April 4, 2005</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 Fix for transmit side breakage on macppc and mbuf leaks with  Handle an edge condition in
 <a href="https://man.openbsd.org/OpenBSD-3.6/xl.4">xl(4)</a>.  <a href="https://man.openbsd.org/OpenBSD-3.6/tcp.4">tcp(4)</a>
   timestamps.
 <br>  <br>
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.6/common/006_xl.patch">  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.6/common/015_tcp.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
   
 <li id="isakmpd">  <li id="cvs">
 <strong>005: RELIABILITY FIX: November 21, 2004</strong>  <strong>016: SECURITY FIX: April 28, 2005</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 Wrong calculation of NAT-D payloads may cause interoperability problems between  Fix a buffer overflow, memory leaks, and NULL pointer dereference in
 <a href="https://man.openbsd.org/OpenBSD-3.6/isakmpd.8">isakmpd(8)</a>  <a href="https://man.openbsd.org/OpenBSD-3.6/cvs.1">cvs(1)</a>
 and other ISAKMP/IKE implementations.  . None of these issues are known to be exploitable.
   <a href="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0753">CAN-2005-0753</a>
   .
 <br>  <br>
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.6/common/005_isakmpd.patch">  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.6/common/016_cvs.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
   
 <p>  <p>
 <li id="lynx">  
 <strong>004: RELIABILITY FIX: November 10, 2004</strong>  <li id="getsockopt">
   <strong>017: RELIABILITY FIX: June 15, 2005</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 Due to a bug in  As discovered by Stefan Miltchev calling
 <a href="https://man.openbsd.org/OpenBSD-3.6/lynx.1">lynx(1)</a>  <a href="https://man.openbsd.org/OpenBSD-3.6/getsockopt.2">getsockopt(2)</a>
 it is possible for pages such as  to get
 <a href="http://lcamtuf.coredump.cx/mangleme/gallery/lynx_die1.html">this</a>  <a href="https://man.openbsd.org/OpenBSD-3.6/ipsec.4">ipsec(4)</a>
 to cause  credentials for a socket can result in a kernel panic.
 <a href="https://man.openbsd.org/OpenBSD-3.6/lynx.1">lynx(1)</a>  
 to exhaust memory and then crash when parsing such pages.  
 <br>  <br>
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.6/common/004_lynx.patch">  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.6/common/017_getsockopt.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
   
 <li id="pppd">  <li id="sudo">
 <strong>003: RELIABILITY FIX: November 10, 2004</strong>  <strong>018: SECURITY FIX: June 20, 2005</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 <a href="https://man.openbsd.org/OpenBSD-3.6/pppd.8">pppd(8)</a>  Due to a race condition in its command pathname handling, a user with
 contains a bug that allows an attacker to crash his own connection, but it cannot  <a href="https://man.openbsd.org/OpenBSD-3.6/sudo.8">sudo(8)</a>
 be used to deny service to other users.  privileges may be able to run arbitrary commands if the user's entry
   is followed by an entry that grants <code>sudo ALL</code> privileges to
   another user.
 <br>  <br>
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.6/common/003_pppd.patch">  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.6/common/018_sudo.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
   
 <li id="bind">  <li id="libz">
 <strong>002: RELIABILITY FIX: November 10, 2004</strong>  <strong>019: SECURITY FIX: July 6, 2005</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 BIND contains a bug which results in BIND trying to contact nameservers via IPv6, even in  A buffer overflow has been found in
 cases where IPv6 connectivity is non-existent. This results in unnecessary timeouts and  <a href="https://man.openbsd.org/OpenBSD-3.6/compress.3">compress(3)</a>
 thus slow DNS queries.  which may be exploitable.
 <br>  <br>
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.6/common/002_bind.patch">  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.6/common/019_libz.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
   
 <li id="st">  <li id="libz2">
 <strong>001: RELIABILITY FIX: November 10, 2004</strong>  <strong>020: SECURITY FIX: July 21, 2005</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 Fix detection of tape blocksize during device open. Corrects problem with  A buffer overflow has been found in
 <a href="https://man.openbsd.org/OpenBSD-3.6/restore.8">restore(8)</a>.  <a href="https://man.openbsd.org/OpenBSD-3.6/compress.3">compress(3)</a>
   which may be exploitable.<br>
   Please note that this fixes a different buffer overflow than the <a href="#libz">previous</a> zlib patch.
 <br>  <br>
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.6/common/001_st.patch">  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.6/common/020_libz.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
   
Legend:
Removed from v.1.61  
changed lines
  Added in v.1.62