| version 1.54, 2016/02/20 14:18:42 |
version 1.55, 2016/03/21 05:46:20 |
|
|
| <i>All architectures</i><br> |
<i>All architectures</i><br> |
| Fix 2 security bugs found in OpenSSH. A pre-authentication denial of service (found |
Fix 2 security bugs found in OpenSSH. A pre-authentication denial of service (found |
| by Tavis Ormandy) that would cause |
by Tavis Ormandy) that would cause |
| <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=sshd&sektion=8">sshd(8)</a> |
<a href="http://man.openbsd.org?query=sshd&sektion=8">sshd(8)</a> |
| to spin until the login grace time expired. |
to spin until the login grace time expired. |
| An unsafe signal handler (found by Mark Dowd) that is vulnerable to a race condition |
An unsafe signal handler (found by Mark Dowd) that is vulnerable to a race condition |
| that could be exploited to perform a pre-authentication denial of service. |
that could be exploited to perform a pre-authentication denial of service. |
|
|
| <font color="#009000"><strong>019: SECURITY FIX: October 7, 2006</strong></font> |
<font color="#009000"><strong>019: SECURITY FIX: October 7, 2006</strong></font> |
| <i>All architectures</i><br> |
<i>All architectures</i><br> |
| Fix for an integer overflow in |
Fix for an integer overflow in |
| <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=systrace&sektion=4">systrace(4)</a>'s |
<a href="http://man.openbsd.org?query=systrace&sektion=4">systrace(4)</a>'s |
| STRIOCREPLACE support, found by |
STRIOCREPLACE support, found by |
| Chris Evans. This could be exploited for DoS, limited kmem reads or local |
Chris Evans. This could be exploited for DoS, limited kmem reads or local |
| privilege escalation. |
privilege escalation. |
|
|
| <li id="httpd2"> |
<li id="httpd2"> |
| <font color="#009000"><strong>017: SECURITY FIX: October 7, 2006</strong></font> |
<font color="#009000"><strong>017: SECURITY FIX: October 7, 2006</strong></font> |
| <i>All architectures</i><br> |
<i>All architectures</i><br> |
| <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=httpd&sektion=8">httpd(8)</a> |
<a href="http://man.openbsd.org?query=httpd&sektion=8">httpd(8)</a> |
| does not sanitize the Expect header from an HTTP request when it is |
does not sanitize the Expect header from an HTTP request when it is |
| reflected back in an error message, which might allow cross-site scripting (XSS) |
reflected back in an error message, which might allow cross-site scripting (XSS) |
| style attacks. |
style attacks. |
|
|
| <i>All architectures</i><br> |
<i>All architectures</i><br> |
| Due to the failure to correctly validate LCP configuration option lengths, |
Due to the failure to correctly validate LCP configuration option lengths, |
| it is possible for an attacker to send LCP packets via an |
it is possible for an attacker to send LCP packets via an |
| <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=sppp&sektion=4">sppp(4)</a> |
<a href="http://man.openbsd.org?query=sppp&sektion=4">sppp(4)</a> |
| connection causing the kernel to panic. |
connection causing the kernel to panic. |
| <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4304">CVE-2006-4304</a> |
<a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4304">CVE-2006-4304</a> |
| <br> |
<br> |
|
|
| <font color="#009000"><strong>013: SECURITY FIX: August 25, 2006</strong></font> |
<font color="#009000"><strong>013: SECURITY FIX: August 25, 2006</strong></font> |
| <i>All architectures</i><br> |
<i>All architectures</i><br> |
| A problem in |
A problem in |
| <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=isakmpd&sektion=8">isakmpd(8)</a> |
<a href="http://man.openbsd.org?query=isakmpd&sektion=8">isakmpd(8)</a> |
| caused IPsec to run partly without replay protection. If |
caused IPsec to run partly without replay protection. If |
| <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=isakmpd&sektion=8">isakmpd(8)</a> |
<a href="http://man.openbsd.org?query=isakmpd&sektion=8">isakmpd(8)</a> |
| was acting as responder during SA negotiation, SA's with a replay window of size 0 were created. |
was acting as responder during SA negotiation, SA's with a replay window of size 0 were created. |
| An attacker could reinject sniffed IPsec packets, which will be accepted without checking the |
An attacker could reinject sniffed IPsec packets, which will be accepted without checking the |
| replay counter. |
replay counter. |
|
|
| <font color="#009000"><strong>011: SECURITY FIX: August 25, 2006</strong></font> |
<font color="#009000"><strong>011: SECURITY FIX: August 25, 2006</strong></font> |
| <i>All architectures</i><br> |
<i>All architectures</i><br> |
| Due to an off-by-one error in |
Due to an off-by-one error in |
| <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=dhcpd&sektion=8">dhcpd(8)</a>, |
<a href="http://man.openbsd.org?query=dhcpd&sektion=8">dhcpd(8)</a>, |
| it is possible to cause |
it is possible to cause |
| <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=dhcpd&sektion=8">dhcpd(8)</a> |
<a href="http://man.openbsd.org?query=dhcpd&sektion=8">dhcpd(8)</a> |
| to exit by sending a DHCPDISCOVER packet with a 32-byte client identifier option. |
to exit by sending a DHCPDISCOVER packet with a 32-byte client identifier option. |
| <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3122">CVE-2006-3122</a> |
<a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3122">CVE-2006-3122</a> |
| <br> |
<br> |
|
|
| <li id="httpd"> |
<li id="httpd"> |
| <font color="#009000"><strong>009: SECURITY FIX: July 30, 2006</strong></font> |
<font color="#009000"><strong>009: SECURITY FIX: July 30, 2006</strong></font> |
| <i>All architectures</i><br> |
<i>All architectures</i><br> |
| <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=httpd&sektion=8">httpd(8)</a>'s |
<a href="http://man.openbsd.org?query=httpd&sektion=8">httpd(8)</a>'s |
| mod_rewrite has a potentially exploitable off-by-one buffer overflow. |
mod_rewrite has a potentially exploitable off-by-one buffer overflow. |
| The buffer overflow may result in a vulnerability which, in combination |
The buffer overflow may result in a vulnerability which, in combination |
| with certain types of Rewrite rules in the web server configuration files, |
with certain types of Rewrite rules in the web server configuration files, |
|
|
| <font color="#009000"><strong>005: SECURITY FIX: February 12, 2006</strong></font> |
<font color="#009000"><strong>005: SECURITY FIX: February 12, 2006</strong></font> |
| <i>All architectures</i><br> |
<i>All architectures</i><br> |
| Josh Bressers has reported a weakness in OpenSSH caused due to the insecure use of the |
Josh Bressers has reported a weakness in OpenSSH caused due to the insecure use of the |
| <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=system&sektion=3">system(3)</a> |
<a href="http://man.openbsd.org?query=system&sektion=3">system(3)</a> |
| function in |
function in |
| <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=scp&sektion=1">scp(1)</a> |
<a href="http://man.openbsd.org?query=scp&sektion=1">scp(1)</a> |
| when performing copy operations using filenames that are supplied by the user from the command line. |
when performing copy operations using filenames that are supplied by the user from the command line. |
| This can be exploited to execute shell commands with privileges of the user running |
This can be exploited to execute shell commands with privileges of the user running |
| <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=scp&sektion=1">scp(1)</a>. |
<a href="http://man.openbsd.org?query=scp&sektion=1">scp(1)</a>. |
| <br> |
<br> |
| <a href="http://ftp.openbsd.org/pub/OpenBSD/patches/3.8/common/005_ssh.patch"> |
<a href="http://ftp.openbsd.org/pub/OpenBSD/patches/3.8/common/005_ssh.patch"> |
| A source code patch exists which remedies this problem.</a> |
A source code patch exists which remedies this problem.</a> |
|
|
| <font color="#009000"><strong>004: RELIABILITY FIX: January 13, 2006</strong></font> |
<font color="#009000"><strong>004: RELIABILITY FIX: January 13, 2006</strong></font> |
| <i>i386 architecture</i><br> |
<i>i386 architecture</i><br> |
| Constrain |
Constrain |
| <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=i386_set_ioperm&arch=i386&sektion=2">i386_set_ioperm(2)</a> |
<a href="http://man.openbsd.org?query=i386_set_ioperm&arch=i386&sektion=2">i386_set_ioperm(2)</a> |
| so even root is blocked from accessing the ioports |
so even root is blocked from accessing the ioports |
| unless the machine is running at lower securelevels or with an open X11 aperture. |
unless the machine is running at lower securelevels or with an open X11 aperture. |
| <br> |
<br> |
|
|
| Change the implementation of i386 W^X so that the "execute line" can move around. |
Change the implementation of i386 W^X so that the "execute line" can move around. |
| Before it was limited to being either at 512MB (below which all code normally |
Before it was limited to being either at 512MB (below which all code normally |
| lands) or at the top of the stack. Now the line can float as |
lands) or at the top of the stack. Now the line can float as |
| <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=mprotect&sektion=2">mprotect(2)</a> |
<a href="http://man.openbsd.org?query=mprotect&sektion=2">mprotect(2)</a> |
| and |
and |
| <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=mmap&sektion=2">mmap(2)</a> |
<a href="http://man.openbsd.org?query=mmap&sektion=2">mmap(2)</a> |
| requests need it to. This is now implemented using only GDT selectors |
requests need it to. This is now implemented using only GDT selectors |
| instead of the LDT so that it is more robust as well. |
instead of the LDT so that it is more robust as well. |
| <br> |
<br> |
![[BACK]](/icons/back.gif){kind=icon}
Return to errata38.html CVS log ![[TXT]](/icons/text.gif){kind=icon}
![[DIR]](/icons/dir.gif){kind=icon}
Up to [local] / www