[BACK]Return to errata37.html CVS log [TXT][DIR] Up to [local] / www

Diff for /www/errata37.html between version 1.67 and 1.68

version 1.67, 2019/05/27 22:55:19 version 1.68, 2019/05/28 16:32:42
Line 85 
Line 85 
   
 <ul>  <ul>
   
 <li id="xorg">  <li id="cvs">
 <strong>013: SECURITY FIX: May 2, 2006</strong>  <strong>001: SECURITY FIX: June 7, 2005</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 A security vulnerability has been found in the X.Org server &ndash;  
 <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1526">CVE-2006-1526</a>.  Fix a buffer overflow, memory leaks, and NULL pointer dereference in
 Clients authorized to connect to the X server are able to crash it and to execute  <a href="https://man.openbsd.org/OpenBSD-3.7/cvs.1">cvs(1)</a>
 malicious code within the X server.  . None of these issues are known to be exploitable.
   <a href="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0753">CAN-2005-0753</a>
   .
 <br>  <br>
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.7/common/013_xorg.patch">  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.7/common/001_cvs.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
   
 <li id="sendmail">  <li id="getsockopt">
 <strong>012: SECURITY FIX: March 25, 2006</strong>  <strong>002: RELIABILITY FIX: June 15, 2005</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 A race condition has been reported to exist in the handling by sendmail of  As discovered by Stefan Miltchev calling
 asynchronous signals. A remote attacker may be able to execute arbitrary code with the  <a href="https://man.openbsd.org/OpenBSD-3.7/getsockopt.2">getsockopt(2)</a>
 privileges of the user running sendmail, typically root.  to get
   <a href="https://man.openbsd.org/OpenBSD-3.7/ipsec.4">ipsec(4)</a>
   credentials for a socket can result in a kernel panic.
 <br>  <br>
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.7/common/012_sendmail.patch">  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.7/common/002_getsockopt.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
   
 <li id="ssh">  <li id="sudo">
 <strong>011: SECURITY FIX: February 12, 2006</strong>  <strong>003: SECURITY FIX: June 20, 2005</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 Josh Bressers has reported a weakness in OpenSSH caused due to the insecure use of the  Due to a race condition in its command pathname handling, a user with
 <a href="https://man.openbsd.org/OpenBSD-3.7/system.3">system(3)</a>  <a href="https://man.openbsd.org/OpenBSD-3.7/sudo.8">sudo(8)</a>
 function in  privileges may be able to run arbitrary commands if the user's entry
 <a href="https://man.openbsd.org/OpenBSD-3.7/scp.1">scp(1)</a>  is followed by an entry that grants <code>sudo ALL</code> privileges to
 when performing copy operations using filenames that are supplied by the user from the command line.  another user.
 This can be exploited to execute shell commands with privileges of the user running  
 <a href="https://man.openbsd.org/OpenBSD-3.7/scp.1">scp(1)</a>.  
 <br>  <br>
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.7/common/011_ssh.patch">  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.7/common/003_sudo.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
   
 <li id="i386machdep">  <li id="libz">
 <strong>010: RELIABILITY FIX: January 13, 2006</strong>  <strong>004: SECURITY FIX: July 6, 2005</strong>
 &nbsp; <i>i386 architecture</i><br>  &nbsp; <i>All architectures</i><br>
 Constrain  A buffer overflow has been found in
 <a href="https://man.openbsd.org/OpenBSD-3.7/i386/i386_set_ioperm.2">i386_set_ioperm(2)</a>  <a href="https://man.openbsd.org/OpenBSD-3.7/compress.3">compress(3)</a>
 so even root is blocked from accessing the ioports  which may be exploitable.
 unless the machine is running at lower securelevels or with an open X11 aperture.  
 <br>  <br>
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.7/i386/010_i386machdep.patch">  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.7/common/004_libz.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
   
 <li id="i386pmap">  <li id="libz2">
 <strong>009: RELIABILITY FIX: January 13, 2006</strong>  <strong>005: SECURITY FIX: July 21, 2005</strong>
 &nbsp; <i>i386 architecture</i><br>  &nbsp; <i>All architectures</i><br>
 Change the implementation of i386 W^X so that the "execute line" can move around.  A buffer overflow has been found in
 Before it was limited to being either at 512MB (below which all code normally  <a href="https://man.openbsd.org/OpenBSD-3.7/compress.3">compress(3)</a>
 lands) or at the top of the stack. Now the line can float as  which may be exploitable.<br>
 <a href="https://man.openbsd.org/OpenBSD-3.7/mprotect.2">mprotect(2)</a>  Please note that this fixes a different buffer overflow than the <a href="#libz">previous</a> zlib patch.
 and  
 <a href="https://man.openbsd.org/OpenBSD-3.7/mmap.2">mmap(2)</a>  
 requests need it to. This is now implemented using only GDT selectors  
 instead of the LDT so that it is more robust as well.  
 <br>  <br>
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.7/i386/009_i386pmap.patch">  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.7/common/005_libz.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
   
 <li id="fd">  <li id="nat-t">
 <strong>008: SECURITY FIX: January 5, 2006</strong>  <strong>006: RELIABILITY FIX: November 5, 2005</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 Do not allow users to trick suid programs into re-opening files via /dev/fd.  Due to wrong advertisement of RFC 3947 compliance interoperability problems with
   <a href="https://man.openbsd.org/OpenBSD-3.7/isakmpd.8">isakmpd(8)</a>
   may occur.
 <br>  <br>
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.7/common/008_fd.patch">  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.7/common/006_nat-t.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
   
Line 170 
Line 169 
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
   
 <li id="nat-t">  <li id="fd">
 <strong>006: RELIABILITY FIX: November 5, 2005</strong>  <strong>008: SECURITY FIX: January 5, 2006</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 Due to wrong advertisement of RFC 3947 compliance interoperability problems with  Do not allow users to trick suid programs into re-opening files via /dev/fd.
 <a href="https://man.openbsd.org/OpenBSD-3.7/isakmpd.8">isakmpd(8)</a>  
 may occur.  
 <br>  <br>
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.7/common/006_nat-t.patch">  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.7/common/008_fd.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
   
 <li id="libz2">  <li id="i386pmap">
 <strong>005: SECURITY FIX: July 21, 2005</strong>  <strong>009: RELIABILITY FIX: January 13, 2006</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>i386 architecture</i><br>
 A buffer overflow has been found in  Change the implementation of i386 W^X so that the "execute line" can move around.
 <a href="https://man.openbsd.org/OpenBSD-3.7/compress.3">compress(3)</a>  Before it was limited to being either at 512MB (below which all code normally
 which may be exploitable.<br>  lands) or at the top of the stack. Now the line can float as
 Please note that this fixes a different buffer overflow than the <a href="#libz">previous</a> zlib patch.  <a href="https://man.openbsd.org/OpenBSD-3.7/mprotect.2">mprotect(2)</a>
   and
   <a href="https://man.openbsd.org/OpenBSD-3.7/mmap.2">mmap(2)</a>
   requests need it to. This is now implemented using only GDT selectors
   instead of the LDT so that it is more robust as well.
 <br>  <br>
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.7/common/005_libz.patch">  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.7/i386/009_i386pmap.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
   
 <li id="libz">  <li id="i386machdep">
 <strong>004: SECURITY FIX: July 6, 2005</strong>  <strong>010: RELIABILITY FIX: January 13, 2006</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>i386 architecture</i><br>
 A buffer overflow has been found in  Constrain
 <a href="https://man.openbsd.org/OpenBSD-3.7/compress.3">compress(3)</a>  <a href="https://man.openbsd.org/OpenBSD-3.7/i386/i386_set_ioperm.2">i386_set_ioperm(2)</a>
 which may be exploitable.  so even root is blocked from accessing the ioports
   unless the machine is running at lower securelevels or with an open X11 aperture.
 <br>  <br>
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.7/common/004_libz.patch">  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.7/i386/010_i386machdep.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
   
 <li id="sudo">  <li id="ssh">
 <strong>003: SECURITY FIX: June 20, 2005</strong>  <strong>011: SECURITY FIX: February 12, 2006</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 Due to a race condition in its command pathname handling, a user with  Josh Bressers has reported a weakness in OpenSSH caused due to the insecure use of the
 <a href="https://man.openbsd.org/OpenBSD-3.7/sudo.8">sudo(8)</a>  <a href="https://man.openbsd.org/OpenBSD-3.7/system.3">system(3)</a>
 privileges may be able to run arbitrary commands if the user's entry  function in
 is followed by an entry that grants <code>sudo ALL</code> privileges to  <a href="https://man.openbsd.org/OpenBSD-3.7/scp.1">scp(1)</a>
 another user.  when performing copy operations using filenames that are supplied by the user from the command line.
   This can be exploited to execute shell commands with privileges of the user running
   <a href="https://man.openbsd.org/OpenBSD-3.7/scp.1">scp(1)</a>.
 <br>  <br>
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.7/common/003_sudo.patch">  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.7/common/011_ssh.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
   
 <li id="getsockopt">  <li id="sendmail">
 <strong>002: RELIABILITY FIX: June 15, 2005</strong>  <strong>012: SECURITY FIX: March 25, 2006</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 As discovered by Stefan Miltchev calling  A race condition has been reported to exist in the handling by sendmail of
 <a href="https://man.openbsd.org/OpenBSD-3.7/getsockopt.2">getsockopt(2)</a>  asynchronous signals. A remote attacker may be able to execute arbitrary code with the
 to get  privileges of the user running sendmail, typically root.
 <a href="https://man.openbsd.org/OpenBSD-3.7/ipsec.4">ipsec(4)</a>  
 credentials for a socket can result in a kernel panic.  
 <br>  <br>
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.7/common/002_getsockopt.patch">  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.7/common/012_sendmail.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
   
 <li id="cvs">  <li id="xorg">
 <strong>001: SECURITY FIX: June 7, 2005</strong>  <strong>013: SECURITY FIX: May 2, 2006</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
   A security vulnerability has been found in the X.Org server &ndash;
 Fix a buffer overflow, memory leaks, and NULL pointer dereference in  <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1526">CVE-2006-1526</a>.
 <a href="https://man.openbsd.org/OpenBSD-3.7/cvs.1">cvs(1)</a>  Clients authorized to connect to the X server are able to crash it and to execute
 . None of these issues are known to be exploitable.  malicious code within the X server.
 <a href="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0753">CAN-2005-0753</a>  
 .  
 <br>  <br>
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.7/common/001_cvs.patch">  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.7/common/013_xorg.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
   
Legend:
Removed from v.1.67  
changed lines
  Added in v.1.68