[BACK]Return to errata42.html CVS log [TXT][DIR] Up to [local] / www

Diff for /www/errata42.html between version 1.66 and 1.67

version 1.66, 2019/05/27 22:55:20 version 1.67, 2019/05/28 16:32:42
Line 85 
Line 85 
   
 <ul>  <ul>
   
 <li id="p015_ndp">  <li id="p001_dhcpd">
 <strong>015: SECURITY FIX: October 2, 2008</strong>  <strong>001: SECURITY FIX: October 8, 2007</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 The Neighbor Discovery Protocol (ndp) did not correctly verify neighbor  Malicious DHCP clients could cause dhcpd(8) to corrupt its stack<br>
 solicitation requests maybe allowing a nearby attacker to intercept traffic.  A DHCP client that claimed to require a maximum message size less than
 The attacker must have IPv6 connectivity to the same router as their target for  the minimum IP MTU could cause dhcpd(8) to overwrite stack memory.
 this vulnerability to be exploited.  
 <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2476">CVE-2008-2476</a>.  
 <br>  <br>
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/4.2/common/015_ndp.patch">  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/4.2/common/001_dhcpd.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
   <li id="p002_openssl">
 <li id="p014_pcb">  <strong>002: SECURITY FIX: October 10, 2007</strong>
 <strong>014: RELIABILITY FIX: July 29, 2008</strong>  
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 Some kinds of IPv6 usage would leak kernel memory (in particular, this path  The SSL_get_shared_ciphers() function in OpenSSL contains an off-by-one overflow.<br>
 was exercised by the named(8) patch for port randomization).  Since INET6 is  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/4.2/common/002_openssl.patch">
 enabled by default, this condition affects all systems.  
 <br>  
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/4.2/common/014_pcb.patch">  
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
   
 <li id="p013_bind">  <li id="p003_i386_boot">
 <strong>013: SECURITY FIX: July 23, 2008</strong>  <strong>003: CD BOOT FAILURE ON OLDER COMPUTERS : October 30, 2007</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>i386 only</i><br>
 <b>2nd revision, July 23, 2008</b><br>  Some older BIOSes are unable to boot CD1 (ie. the commercial release sold
 A vulnerability has been found with BIND. An attacker could use this vulnerability  by the project, not the CD images available on the net).
 to poison the cache of a recursive resolving name server.  A workaround using CD2 (amd64 architecture) is as follows.
 <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1447">CVE-2008-1447</a>.  (An amd64 machine is <i>NOT</i> required for this to work.)<br>
 <br>  <br>
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/4.2/common/013_bind.patch">  
 A source code patch exists which remedies this problem.</a>  
 <p>  
   
 <li id="p012_xorg2">  <ol>
 <strong>012: SECURITY FIX: July 15, 2008</strong>  <li>Insert CD2 and tell your computer to boot it;<br>
 &nbsp; <i>All architectures</i><br>  <li>When the <code>boot></code> prompt appears, stop the automatic boot
 Multiple vulnerabilities have been discovered in X.Org.<br>  by pressing the space bar;<br>
 RENDER Extension heap buffer overflow,  <li>Remove CD2 and insert CD1;<br>
 RENDER Extension crash,  <li>Erase the character you typed to stop the boot, type<br>
 RENDER Extension memory corruption,  <code><b>boot /4.2/i386/bsd.rd</b></code><br>
 MIT-SHM arbitrary memory read,  then press <i>Enter</i>.
 RECORD and Security extensions memory corruption.  </ol>
 <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2360">CVE-2008-2360</a>,  
 <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2361">CVE-2008-2361</a>,  
 <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2362">CVE-2008-2362</a>,  
 <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1379">CVE-2008-1379</a>,  
 <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1377">CVE-2008-1377</a>.  
 <br>  
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/4.2/common/012_xorg2.patch">  
 A source code patch exists which remedies this problem.</a>  
 <p>  <p>
   
 <li id="p011_openssh2">  <li id="p004_pf">
 <strong>011: SECURITY FIX: April 3, 2008</strong>  <strong>004: RELIABILITY FIX: November 27, 2007</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 Avoid possible hijacking of X11-forwarded connections with sshd(8)  A memory leak in pf can lead to machine lockups.<br>
 by refusing to listen on a port unless all address families bind  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/4.2/common/004_pf.patch">
 successfully.<br>  
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/4.2/common/011_openssh2.patch">  
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
   
 <li id="p010_openssh">  <li id="p005_ifrtlabel">
 <strong>010: SECURITY FIX: March 30, 2008</strong>  <strong>005: RELIABILITY FIX: January 11, 2008</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 sshd(8) would execute ~/.ssh/rc even when a sshd_config(5) <em>ForceCommand</em>  A missing NULL pointer check can lead to a kernel panic.<br>
 directive was in effect, allowing users with write access to this file to  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/4.2/common/005_ifrtlabel.patch">
 execute arbitrary commands. This behaviour was documented, but was an unsafe  
 default and an extra hassle for administrators.<br>  
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/4.2/common/010_openssh.patch">  
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
   
 <li id="p009_ppp">  
 <strong>009: SECURITY FIX: March 7, 2008</strong>  
 &nbsp; <i>All architectures</i><br>  
 Buffer overflow in ppp command prompt parsing.<br>  
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/4.2/common/009_ppp.patch">  
 A source code patch exists which remedies this problem.</a>  
 <p>  
   
 <li id="p008_ip6rthdr">  
 <strong>008: RELIABILITY FIX: February 25, 2008</strong>  
 &nbsp; <i>All architectures</i><br>  
 Malformed IPv6 routing headers can cause a kernel panic.<br>  
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/4.2/common/008_ip6rthdr.patch">  
 A source code patch exists which remedies this problem.</a>  
 <p>  
   
 <li id="p007_tcprespond">  
 <strong>007: RELIABILITY FIX: February 22, 2008</strong>  
 &nbsp; <i>All architectures</i><br>  
 Incorrect assumptions in tcp_respond can lead to a kernel panic.<br>  
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/4.2/common/007_tcprespond.patch">  
 A source code patch exists which remedies this problem.</a>  
 <p>  
   
 <li id="p006_xorg">  <li id="p006_xorg">
 <strong>006: SECURITY FIX: February 8, 2008</strong>  <strong>006: SECURITY FIX: February 8, 2008</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
Line 207 
Line 161 
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
   
 <li id="p005_ifrtlabel">  <li id="p007_tcprespond">
 <strong>005: RELIABILITY FIX: January 11, 2008</strong>  <strong>007: RELIABILITY FIX: February 22, 2008</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 A missing NULL pointer check can lead to a kernel panic.<br>  Incorrect assumptions in tcp_respond can lead to a kernel panic.<br>
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/4.2/common/005_ifrtlabel.patch">  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/4.2/common/007_tcprespond.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
   
 <li id="p004_pf">  <li id="p008_ip6rthdr">
 <strong>004: RELIABILITY FIX: November 27, 2007</strong>  <strong>008: RELIABILITY FIX: February 25, 2008</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 A memory leak in pf can lead to machine lockups.<br>  Malformed IPv6 routing headers can cause a kernel panic.<br>
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/4.2/common/004_pf.patch">  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/4.2/common/008_ip6rthdr.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
   
 <li id="p003_i386_boot">  <li id="p009_ppp">
 <strong>003: CD BOOT FAILURE ON OLDER COMPUTERS : October 30, 2007</strong>  <strong>009: SECURITY FIX: March 7, 2008</strong>
 &nbsp; <i>i386 only</i><br>  &nbsp; <i>All architectures</i><br>
 Some older BIOSes are unable to boot CD1 (ie. the commercial release sold  Buffer overflow in ppp command prompt parsing.<br>
 by the project, not the CD images available on the net).  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/4.2/common/009_ppp.patch">
 A workaround using CD2 (amd64 architecture) is as follows.  A source code patch exists which remedies this problem.</a>
 (An amd64 machine is <i>NOT</i> required for this to work.)<br>  <p>
 <br>  
   
 <ol>  <li id="p010_openssh">
 <li>Insert CD2 and tell your computer to boot it;<br>  <strong>010: SECURITY FIX: March 30, 2008</strong>
 <li>When the <code>boot></code> prompt appears, stop the automatic boot  &nbsp; <i>All architectures</i><br>
 by pressing the space bar;<br>  sshd(8) would execute ~/.ssh/rc even when a sshd_config(5) <em>ForceCommand</em>
 <li>Remove CD2 and insert CD1;<br>  directive was in effect, allowing users with write access to this file to
 <li>Erase the character you typed to stop the boot, type<br>  execute arbitrary commands. This behaviour was documented, but was an unsafe
 <code><b>boot /4.2/i386/bsd.rd</b></code><br>  default and an extra hassle for administrators.<br>
 then press <i>Enter</i>.  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/4.2/common/010_openssh.patch">
 </ol>  A source code patch exists which remedies this problem.</a>
   <p>
   
   <li id="p011_openssh2">
   <strong>011: SECURITY FIX: April 3, 2008</strong>
   &nbsp; <i>All architectures</i><br>
   Avoid possible hijacking of X11-forwarded connections with sshd(8)
   by refusing to listen on a port unless all address families bind
   successfully.<br>
   <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/4.2/common/011_openssh2.patch">
   A source code patch exists which remedies this problem.</a>
 <p>  <p>
   
 <li id="p002_openssl">  
 <strong>002: SECURITY FIX: October 10, 2007</strong>  <li id="p012_xorg2">
   <strong>012: SECURITY FIX: July 15, 2008</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 The SSL_get_shared_ciphers() function in OpenSSL contains an off-by-one overflow.<br>  Multiple vulnerabilities have been discovered in X.Org.<br>
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/4.2/common/002_openssl.patch">  RENDER Extension heap buffer overflow,
   RENDER Extension crash,
   RENDER Extension memory corruption,
   MIT-SHM arbitrary memory read,
   RECORD and Security extensions memory corruption.
   <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2360">CVE-2008-2360</a>,
   <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2361">CVE-2008-2361</a>,
   <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2362">CVE-2008-2362</a>,
   <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1379">CVE-2008-1379</a>,
   <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1377">CVE-2008-1377</a>.
   <br>
   <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/4.2/common/012_xorg2.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
   
 <li id="p001_dhcpd">  <li id="p013_bind">
 <strong>001: SECURITY FIX: October 8, 2007</strong>  <strong>013: SECURITY FIX: July 23, 2008</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 Malicious DHCP clients could cause dhcpd(8) to corrupt its stack<br>  <b>2nd revision, July 23, 2008</b><br>
 A DHCP client that claimed to require a maximum message size less than  A vulnerability has been found with BIND. An attacker could use this vulnerability
 the minimum IP MTU could cause dhcpd(8) to overwrite stack memory.  to poison the cache of a recursive resolving name server.
   <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1447">CVE-2008-1447</a>.
 <br>  <br>
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/4.2/common/001_dhcpd.patch">  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/4.2/common/013_bind.patch">
   A source code patch exists which remedies this problem.</a>
   <p>
   
   
   <li id="p014_pcb">
   <strong>014: RELIABILITY FIX: July 29, 2008</strong>
   &nbsp; <i>All architectures</i><br>
   Some kinds of IPv6 usage would leak kernel memory (in particular, this path
   was exercised by the named(8) patch for port randomization).  Since INET6 is
   enabled by default, this condition affects all systems.
   <br>
   <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/4.2/common/014_pcb.patch">
   A source code patch exists which remedies this problem.</a>
   <p>
   
   <li id="p015_ndp">
   <strong>015: SECURITY FIX: October 2, 2008</strong>
   &nbsp; <i>All architectures</i><br>
   The Neighbor Discovery Protocol (ndp) did not correctly verify neighbor
   solicitation requests maybe allowing a nearby attacker to intercept traffic.
   The attacker must have IPv6 connectivity to the same router as their target for
   this vulnerability to be exploited.
   <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2476">CVE-2008-2476</a>.
   <br>
   <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/4.2/common/015_ndp.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
   
Legend:
Removed from v.1.66  
changed lines
  Added in v.1.67