| version 1.53, 2016/02/20 14:18:42 |
version 1.54, 2016/03/21 05:46:20 |
|
|
| <strong>2nd revision, March 17, 2007</strong><br> |
<strong>2nd revision, March 17, 2007</strong><br> |
| Incorrect mbuf handling for ICMP6 packets.<br> |
Incorrect mbuf handling for ICMP6 packets.<br> |
| Using |
Using |
| <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=pf&sektion=4">pf(4)</a> |
<a href="http://man.openbsd.org?query=pf&sektion=4">pf(4)</a> |
| to avoid the problem packets is an effective workaround until the patch |
to avoid the problem packets is an effective workaround until the patch |
| can be installed.<br> |
can be installed.<br> |
| Use "block in inet6" in /etc/pf.conf |
Use "block in inet6" in /etc/pf.conf |
|
|
| <font color="#009000"><strong>017: SECURITY FIX: January 3, 2007</strong></font> |
<font color="#009000"><strong>017: SECURITY FIX: January 3, 2007</strong></font> |
| <i>i386 only</i><br> |
<i>i386 only</i><br> |
| Insufficient validation in |
Insufficient validation in |
| <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=vga&sektion=4">vga(4)</a> |
<a href="http://man.openbsd.org?query=vga&sektion=4">vga(4)</a> |
| may allow an attacker to gain root privileges if the kernel is compiled with |
may allow an attacker to gain root privileges if the kernel is compiled with |
| <tt>option PCIAGP</tt> |
<tt>option PCIAGP</tt> |
| and the actual device is not an AGP device. |
and the actual device is not an AGP device. |
|
|
| <font color="#009000"><strong>016: SECURITY FIX: November 19, 2006</strong></font> |
<font color="#009000"><strong>016: SECURITY FIX: November 19, 2006</strong></font> |
| <i>All architectures</i><br> |
<i>All architectures</i><br> |
| The ELF |
The ELF |
| <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=ld.so&sektion=1">ld.so(1)</a> |
<a href="http://man.openbsd.org?query=ld.so&sektion=1">ld.so(1)</a> |
| fails to properly sanitize the environment. There is a potential localhost security |
fails to properly sanitize the environment. There is a potential localhost security |
| problem in cases we have not found yet. This patch applies to all ELF-based |
problem in cases we have not found yet. This patch applies to all ELF-based |
| systems (m68k, m88k, and vax are a.out-based systems). |
systems (m68k, m88k, and vax are a.out-based systems). |
|
|
| <i>All architectures</i><br> |
<i>All architectures</i><br> |
| Fix 2 security bugs found in OpenSSH. A pre-authentication denial of service (found |
Fix 2 security bugs found in OpenSSH. A pre-authentication denial of service (found |
| by Tavis Ormandy) that would cause |
by Tavis Ormandy) that would cause |
| <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=sshd&sektion=8">sshd(8)</a> |
<a href="http://man.openbsd.org?query=sshd&sektion=8">sshd(8)</a> |
| to spin until the login grace time expired. |
to spin until the login grace time expired. |
| An unsafe signal handler (found by Mark Dowd) that is vulnerable to a race condition |
An unsafe signal handler (found by Mark Dowd) that is vulnerable to a race condition |
| that could be exploited to perform a pre-authentication denial of service. |
that could be exploited to perform a pre-authentication denial of service. |
|
|
| <font color="#009000"><strong>014: SECURITY FIX: October 7, 2006</strong></font> |
<font color="#009000"><strong>014: SECURITY FIX: October 7, 2006</strong></font> |
| <i>All architectures</i><br> |
<i>All architectures</i><br> |
| Fix for an integer overflow in |
Fix for an integer overflow in |
| <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=systrace&sektion=4">systrace(4)</a>'s |
<a href="http://man.openbsd.org?query=systrace&sektion=4">systrace(4)</a>'s |
| STRIOCREPLACE support, found by |
STRIOCREPLACE support, found by |
| Chris Evans. This could be exploited for DoS, limited kmem reads or local |
Chris Evans. This could be exploited for DoS, limited kmem reads or local |
| privilege escalation. |
privilege escalation. |
|
|
| <li id="httpd2"> |
<li id="httpd2"> |
| <font color="#009000"><strong>012: SECURITY FIX: October 7, 2006</strong></font> |
<font color="#009000"><strong>012: SECURITY FIX: October 7, 2006</strong></font> |
| <i>All architectures</i><br> |
<i>All architectures</i><br> |
| <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=httpd&sektion=8">httpd(8)</a> |
<a href="http://man.openbsd.org?query=httpd&sektion=8">httpd(8)</a> |
| does not sanitize the Expect header from an HTTP request when it is |
does not sanitize the Expect header from an HTTP request when it is |
| reflected back in an error message, which might allow cross-site scripting (XSS) |
reflected back in an error message, which might allow cross-site scripting (XSS) |
| style attacks. |
style attacks. |
|
|
| <i>All architectures</i><br> |
<i>All architectures</i><br> |
| Due to the failure to correctly validate LCP configuration option lengths, |
Due to the failure to correctly validate LCP configuration option lengths, |
| it is possible for an attacker to send LCP packets via an |
it is possible for an attacker to send LCP packets via an |
| <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=sppp&sektion=4">sppp(4)</a> |
<a href="http://man.openbsd.org?query=sppp&sektion=4">sppp(4)</a> |
| connection causing the kernel to panic. |
connection causing the kernel to panic. |
| <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4304">CVE-2006-4304</a> |
<a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4304">CVE-2006-4304</a> |
| <br> |
<br> |
|
|
| <font color="#009000"><strong>008: SECURITY FIX: August 25, 2006</strong></font> |
<font color="#009000"><strong>008: SECURITY FIX: August 25, 2006</strong></font> |
| <i>All architectures</i><br> |
<i>All architectures</i><br> |
| A problem in |
A problem in |
| <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=isakmpd&sektion=8">isakmpd(8)</a> |
<a href="http://man.openbsd.org?query=isakmpd&sektion=8">isakmpd(8)</a> |
| caused IPsec to run partly without replay protection. If |
caused IPsec to run partly without replay protection. If |
| <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=isakmpd&sektion=8">isakmpd(8)</a> |
<a href="http://man.openbsd.org?query=isakmpd&sektion=8">isakmpd(8)</a> |
| was acting as responder during SA negotiation, SA's with a replay window of size 0 were created. |
was acting as responder during SA negotiation, SA's with a replay window of size 0 were created. |
| An attacker could reinject sniffed IPsec packets, which will be accepted without checking the |
An attacker could reinject sniffed IPsec packets, which will be accepted without checking the |
| replay counter. |
replay counter. |
|
|
| <font color="#009000"><strong>006: SECURITY FIX: August 25, 2006</strong></font> |
<font color="#009000"><strong>006: SECURITY FIX: August 25, 2006</strong></font> |
| <i>All architectures</i><br> |
<i>All architectures</i><br> |
| Due to an off-by-one error in |
Due to an off-by-one error in |
| <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=dhcpd&sektion=8">dhcpd(8)</a>, |
<a href="http://man.openbsd.org?query=dhcpd&sektion=8">dhcpd(8)</a>, |
| it is possible to cause |
it is possible to cause |
| <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=dhcpd&sektion=8">dhcpd(8)</a> |
<a href="http://man.openbsd.org?query=dhcpd&sektion=8">dhcpd(8)</a> |
| to exit by sending a DHCPDISCOVER packet with a 32-byte client identifier option. |
to exit by sending a DHCPDISCOVER packet with a 32-byte client identifier option. |
| <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3122">CVE-2006-3122</a> |
<a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3122">CVE-2006-3122</a> |
| <br> |
<br> |
|
|
| <li id="httpd"> |
<li id="httpd"> |
| <font color="#009000"><strong>004: SECURITY FIX: July 30, 2006</strong></font> |
<font color="#009000"><strong>004: SECURITY FIX: July 30, 2006</strong></font> |
| <i>All architectures</i><br> |
<i>All architectures</i><br> |
| <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=httpd&sektion=8">httpd(8)</a>'s |
<a href="http://man.openbsd.org?query=httpd&sektion=8">httpd(8)</a>'s |
| mod_rewrite has a potentially exploitable off-by-one buffer overflow. |
mod_rewrite has a potentially exploitable off-by-one buffer overflow. |
| The buffer overflow may result in a vulnerability which, in combination |
The buffer overflow may result in a vulnerability which, in combination |
| with certain types of Rewrite rules in the web server configuration files, |
with certain types of Rewrite rules in the web server configuration files, |
![[BACK]](/icons/back.gif){kind=icon}
Return to errata39.html CVS log ![[TXT]](/icons/text.gif){kind=icon}
![[DIR]](/icons/dir.gif){kind=icon}
Up to [local] / www