version 1.55, 2016/03/21 05:46:20 |
version 1.56, 2016/03/22 10:54:42 |
|
|
<i>All architectures</i><br> |
<i>All architectures</i><br> |
Fix 2 security bugs found in OpenSSH. A pre-authentication denial of service (found |
Fix 2 security bugs found in OpenSSH. A pre-authentication denial of service (found |
by Tavis Ormandy) that would cause |
by Tavis Ormandy) that would cause |
<a href="http://man.openbsd.org?query=sshd&sektion=8">sshd(8)</a> |
<a href="http://man.openbsd.org/?query=sshd&sektion=8">sshd(8)</a> |
to spin until the login grace time expired. |
to spin until the login grace time expired. |
An unsafe signal handler (found by Mark Dowd) that is vulnerable to a race condition |
An unsafe signal handler (found by Mark Dowd) that is vulnerable to a race condition |
that could be exploited to perform a pre-authentication denial of service. |
that could be exploited to perform a pre-authentication denial of service. |
|
|
<font color="#009000"><strong>019: SECURITY FIX: October 7, 2006</strong></font> |
<font color="#009000"><strong>019: SECURITY FIX: October 7, 2006</strong></font> |
<i>All architectures</i><br> |
<i>All architectures</i><br> |
Fix for an integer overflow in |
Fix for an integer overflow in |
<a href="http://man.openbsd.org?query=systrace&sektion=4">systrace(4)</a>'s |
<a href="http://man.openbsd.org/?query=systrace&sektion=4">systrace(4)</a>'s |
STRIOCREPLACE support, found by |
STRIOCREPLACE support, found by |
Chris Evans. This could be exploited for DoS, limited kmem reads or local |
Chris Evans. This could be exploited for DoS, limited kmem reads or local |
privilege escalation. |
privilege escalation. |
|
|
<li id="httpd2"> |
<li id="httpd2"> |
<font color="#009000"><strong>017: SECURITY FIX: October 7, 2006</strong></font> |
<font color="#009000"><strong>017: SECURITY FIX: October 7, 2006</strong></font> |
<i>All architectures</i><br> |
<i>All architectures</i><br> |
<a href="http://man.openbsd.org?query=httpd&sektion=8">httpd(8)</a> |
<a href="http://man.openbsd.org/?query=httpd&sektion=8">httpd(8)</a> |
does not sanitize the Expect header from an HTTP request when it is |
does not sanitize the Expect header from an HTTP request when it is |
reflected back in an error message, which might allow cross-site scripting (XSS) |
reflected back in an error message, which might allow cross-site scripting (XSS) |
style attacks. |
style attacks. |
|
|
<i>All architectures</i><br> |
<i>All architectures</i><br> |
Due to the failure to correctly validate LCP configuration option lengths, |
Due to the failure to correctly validate LCP configuration option lengths, |
it is possible for an attacker to send LCP packets via an |
it is possible for an attacker to send LCP packets via an |
<a href="http://man.openbsd.org?query=sppp&sektion=4">sppp(4)</a> |
<a href="http://man.openbsd.org/?query=sppp&sektion=4">sppp(4)</a> |
connection causing the kernel to panic. |
connection causing the kernel to panic. |
<a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4304">CVE-2006-4304</a> |
<a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4304">CVE-2006-4304</a> |
<br> |
<br> |
|
|
<font color="#009000"><strong>013: SECURITY FIX: August 25, 2006</strong></font> |
<font color="#009000"><strong>013: SECURITY FIX: August 25, 2006</strong></font> |
<i>All architectures</i><br> |
<i>All architectures</i><br> |
A problem in |
A problem in |
<a href="http://man.openbsd.org?query=isakmpd&sektion=8">isakmpd(8)</a> |
<a href="http://man.openbsd.org/?query=isakmpd&sektion=8">isakmpd(8)</a> |
caused IPsec to run partly without replay protection. If |
caused IPsec to run partly without replay protection. If |
<a href="http://man.openbsd.org?query=isakmpd&sektion=8">isakmpd(8)</a> |
<a href="http://man.openbsd.org/?query=isakmpd&sektion=8">isakmpd(8)</a> |
was acting as responder during SA negotiation, SA's with a replay window of size 0 were created. |
was acting as responder during SA negotiation, SA's with a replay window of size 0 were created. |
An attacker could reinject sniffed IPsec packets, which will be accepted without checking the |
An attacker could reinject sniffed IPsec packets, which will be accepted without checking the |
replay counter. |
replay counter. |
|
|
<font color="#009000"><strong>011: SECURITY FIX: August 25, 2006</strong></font> |
<font color="#009000"><strong>011: SECURITY FIX: August 25, 2006</strong></font> |
<i>All architectures</i><br> |
<i>All architectures</i><br> |
Due to an off-by-one error in |
Due to an off-by-one error in |
<a href="http://man.openbsd.org?query=dhcpd&sektion=8">dhcpd(8)</a>, |
<a href="http://man.openbsd.org/?query=dhcpd&sektion=8">dhcpd(8)</a>, |
it is possible to cause |
it is possible to cause |
<a href="http://man.openbsd.org?query=dhcpd&sektion=8">dhcpd(8)</a> |
<a href="http://man.openbsd.org/?query=dhcpd&sektion=8">dhcpd(8)</a> |
to exit by sending a DHCPDISCOVER packet with a 32-byte client identifier option. |
to exit by sending a DHCPDISCOVER packet with a 32-byte client identifier option. |
<a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3122">CVE-2006-3122</a> |
<a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3122">CVE-2006-3122</a> |
<br> |
<br> |
|
|
<li id="httpd"> |
<li id="httpd"> |
<font color="#009000"><strong>009: SECURITY FIX: July 30, 2006</strong></font> |
<font color="#009000"><strong>009: SECURITY FIX: July 30, 2006</strong></font> |
<i>All architectures</i><br> |
<i>All architectures</i><br> |
<a href="http://man.openbsd.org?query=httpd&sektion=8">httpd(8)</a>'s |
<a href="http://man.openbsd.org/?query=httpd&sektion=8">httpd(8)</a>'s |
mod_rewrite has a potentially exploitable off-by-one buffer overflow. |
mod_rewrite has a potentially exploitable off-by-one buffer overflow. |
The buffer overflow may result in a vulnerability which, in combination |
The buffer overflow may result in a vulnerability which, in combination |
with certain types of Rewrite rules in the web server configuration files, |
with certain types of Rewrite rules in the web server configuration files, |
|
|
<font color="#009000"><strong>005: SECURITY FIX: February 12, 2006</strong></font> |
<font color="#009000"><strong>005: SECURITY FIX: February 12, 2006</strong></font> |
<i>All architectures</i><br> |
<i>All architectures</i><br> |
Josh Bressers has reported a weakness in OpenSSH caused due to the insecure use of the |
Josh Bressers has reported a weakness in OpenSSH caused due to the insecure use of the |
<a href="http://man.openbsd.org?query=system&sektion=3">system(3)</a> |
<a href="http://man.openbsd.org/?query=system&sektion=3">system(3)</a> |
function in |
function in |
<a href="http://man.openbsd.org?query=scp&sektion=1">scp(1)</a> |
<a href="http://man.openbsd.org/?query=scp&sektion=1">scp(1)</a> |
when performing copy operations using filenames that are supplied by the user from the command line. |
when performing copy operations using filenames that are supplied by the user from the command line. |
This can be exploited to execute shell commands with privileges of the user running |
This can be exploited to execute shell commands with privileges of the user running |
<a href="http://man.openbsd.org?query=scp&sektion=1">scp(1)</a>. |
<a href="http://man.openbsd.org/?query=scp&sektion=1">scp(1)</a>. |
<br> |
<br> |
<a href="http://ftp.openbsd.org/pub/OpenBSD/patches/3.8/common/005_ssh.patch"> |
<a href="http://ftp.openbsd.org/pub/OpenBSD/patches/3.8/common/005_ssh.patch"> |
A source code patch exists which remedies this problem.</a> |
A source code patch exists which remedies this problem.</a> |
|
|
<font color="#009000"><strong>004: RELIABILITY FIX: January 13, 2006</strong></font> |
<font color="#009000"><strong>004: RELIABILITY FIX: January 13, 2006</strong></font> |
<i>i386 architecture</i><br> |
<i>i386 architecture</i><br> |
Constrain |
Constrain |
<a href="http://man.openbsd.org?query=i386_set_ioperm&arch=i386&sektion=2">i386_set_ioperm(2)</a> |
<a href="http://man.openbsd.org/?query=i386_set_ioperm&arch=i386&sektion=2">i386_set_ioperm(2)</a> |
so even root is blocked from accessing the ioports |
so even root is blocked from accessing the ioports |
unless the machine is running at lower securelevels or with an open X11 aperture. |
unless the machine is running at lower securelevels or with an open X11 aperture. |
<br> |
<br> |
|
|
Change the implementation of i386 W^X so that the "execute line" can move around. |
Change the implementation of i386 W^X so that the "execute line" can move around. |
Before it was limited to being either at 512MB (below which all code normally |
Before it was limited to being either at 512MB (below which all code normally |
lands) or at the top of the stack. Now the line can float as |
lands) or at the top of the stack. Now the line can float as |
<a href="http://man.openbsd.org?query=mprotect&sektion=2">mprotect(2)</a> |
<a href="http://man.openbsd.org/?query=mprotect&sektion=2">mprotect(2)</a> |
and |
and |
<a href="http://man.openbsd.org?query=mmap&sektion=2">mmap(2)</a> |
<a href="http://man.openbsd.org/?query=mmap&sektion=2">mmap(2)</a> |
requests need it to. This is now implemented using only GDT selectors |
requests need it to. This is now implemented using only GDT selectors |
instead of the LDT so that it is more robust as well. |
instead of the LDT so that it is more robust as well. |
<br> |
<br> |