[BACK]Return to errata43.html CVS log [TXT][DIR] Up to [local] / www

Diff for /www/errata43.html between version 1.63 and 1.64

version 1.63, 2019/05/27 22:55:20 version 1.64, 2019/05/28 16:32:42
Line 85 
Line 85 
   
 <ul>  <ul>
   
 <li id="p013_pf">  <li id="p001_openssh">
 <strong>013: RELIABILITY FIX: April 11, 2009</strong>  <strong>001: SECURITY FIX: March 30, 2008</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 When pf attempts to perform translation on a specially crafted IP datagram,  sshd(8) would execute ~/.ssh/rc even when a sshd_config(5) <em>ForceCommand</em>
 a null pointer dereference will occur, resulting in a kernel panic.  directive was in effect, allowing users with write access to this file to
 In certain configurations this may be triggered by a remote attacker.  execute arbitrary commands. This behaviour was documented, but was an unsafe
 <br>  default and an extra hassle for administrators.<br>
 Restricting translation rules to protocols that are specific to the IP version  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/4.3/common/001_openssh.patch">
 in use, is an effective workaround until the patch can be installed. As an  
 example, for IPv4 nat/binat/rdr rules you can use:  
 <pre>  
     nat/rdr ... inet proto { tcp udp icmp } ...  
 </pre>  
 Or for IPv6 nat/binat/rdr rules you can use:  
 <pre>  
     nat/rdr ... inet6 proto { tcp udp icmp6 } ...  
 </pre>  
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/4.3/common/013_pf.patch">  
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
   
 <li id="p012_openssl">  <li id="p002_openssh2">
 <strong>012: RELIABILITY FIX: April 8, 2009</strong>  <strong>002: SECURITY FIX: April 3, 2008</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 The OpenSSL ASN.1 handling code could be forced to perform invalid memory  Avoid possible hijacking of X11-forwarded connections with sshd(8)
 accesses through the use of certain invalid strings  by refusing to listen on a port unless all address families bind
 (<a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0590">CVE-2009-0590</a>)  successfully.<br>
 or under certain error conditions triggerable by invalid ASN.1 structures  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/4.3/common/002_openssh2.patch">
 (<a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0789">CVE-2009-0789</a>).  
 These vulnerabilities could be exploited to achieve a  
 denial-of-service. A more detailed description of these problems is available  
 in the  
 <a href="http://www.openssl.org/news/secadv_20090325.txt">OpenSSL security advisory</a>, but note that the other issue described there "Incorrect Error  
 Checking During CMS verification" relates to code not enabled in OpenBSD.  
 <br>  
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/4.3/common/012_openssl.patch">  
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
   
 <li id="p011_sudo">  <li id="p003_xorg">
 <strong>011: SECURITY FIX: February 22, 2009</strong>  <strong>003: SECURITY FIX: July 15, 2008</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 sudo(8) may allow a user listed in the sudoers file to run a command  Multiple vulnerabilities have been discovered in X.Org.<br>
 as a different user than their access rule specifies when a Unix  RENDER Extension heap buffer overflow,
 group is used in the RunAs portion of the rule.  The bug only manifests  RENDER Extension crash,
 when the user being granted privileges is also a member of the group  RENDER Extension memory corruption,
 in the RunAs portion of the rule.  MIT-SHM arbitrary memory read,
   RECORD and Security extensions memory corruption.
   <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2360">CVE-2008-2360</a>,
   <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2361">CVE-2008-2361</a>,
   <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2362">CVE-2008-2362</a>,
   <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1379">CVE-2008-1379</a>,
   <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1377">CVE-2008-1377</a>.
 <br>  <br>
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/4.3/common/011_sudo.patch">  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/4.3/common/003_xorg.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
   
 <li id="p010_bgpd">  <li id="p004_bind">
 <strong>010: RELIABILITY FIX: February 18, 2009</strong>  <strong>004: SECURITY FIX: July 23, 2008</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 bgpd(8) did not correctly prepend its own AS to very long AS paths, causing  <b>2nd revision, July 23, 2008</b><br>
 the process to terminate because of the resulting corrupt path.  A vulnerability has been found with BIND. An attacker could use this vulnerability
   to poison the cache of a recursive resolving name server.
   <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1447">CVE-2008-1447</a>.
 <br>  <br>
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/4.3/common/010_bgpd.patch">  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/4.3/common/004_bind.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
   
 <li id="p009_bgpd">  <li id="p005_pcb">
 <strong>009: RELIABILITY FIX: January 30, 2009</strong>  <strong>005: RELIABILITY FIX: July 29, 2008</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 Upon reception of an invalid update with 4-byte AS attributes, bgpd -  Some kinds of IPv6 usage would leak kernel memory (in particular, this path
 adhering to the RFCs - closed the session to the neighbor.  was exercised by the named(8) patch for port randomization).  Since INET6 is
 This error in the specification allowed 3rd parties to close remote BGP  enabled by default, this condition affects all systems.
 sessions.  
 In the worst case Internet connectivity could be lost.  
 <br>  <br>
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/4.3/common/009_bgpd.patch">  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/4.3/common/005_pcb.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
   
 <li id="p008_bind">  <li id="p006_ndp">
 <strong>008: SECURITY FIX: January 14, 2009</strong>  <strong>006: SECURITY FIX: October 2, 2008</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 named(8) did not correctly check the return value of a DSA verification  The Neighbor Discovery Protocol (ndp) did not correctly verify neighbor
 function, potentially allowing bypass of verification of DNSSEC DSA  solicitation requests maybe allowing a nearby attacker to intercept traffic.
 signatures.  The attacker must have IPv6 connectivity to the same router as their target for
 <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0025">CVE-2009-0025</a>.  this vulnerability to be exploited.
   <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2476">CVE-2008-2476</a>.
 <br>  <br>
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/4.3/common/008_bind.patch">  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/4.3/common/006_ndp.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
   
Line 186 
Line 175 
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
   
 <li id="p006_ndp">  <li id="p008_bind">
 <strong>006: SECURITY FIX: October 2, 2008</strong>  <strong>008: SECURITY FIX: January 14, 2009</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 The Neighbor Discovery Protocol (ndp) did not correctly verify neighbor  named(8) did not correctly check the return value of a DSA verification
 solicitation requests maybe allowing a nearby attacker to intercept traffic.  function, potentially allowing bypass of verification of DNSSEC DSA
 The attacker must have IPv6 connectivity to the same router as their target for  signatures.
 this vulnerability to be exploited.  <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0025">CVE-2009-0025</a>.
 <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2476">CVE-2008-2476</a>.  
 <br>  <br>
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/4.3/common/006_ndp.patch">  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/4.3/common/008_bind.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
   
 <li id="p005_pcb">  <li id="p009_bgpd">
 <strong>005: RELIABILITY FIX: July 29, 2008</strong>  <strong>009: RELIABILITY FIX: January 30, 2009</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 Some kinds of IPv6 usage would leak kernel memory (in particular, this path  Upon reception of an invalid update with 4-byte AS attributes, bgpd -
 was exercised by the named(8) patch for port randomization).  Since INET6 is  adhering to the RFCs - closed the session to the neighbor.
 enabled by default, this condition affects all systems.  This error in the specification allowed 3rd parties to close remote BGP
   sessions.
   In the worst case Internet connectivity could be lost.
 <br>  <br>
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/4.3/common/005_pcb.patch">  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/4.3/common/009_bgpd.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
   
 <li id="p004_bind">  <li id="p010_bgpd">
 <strong>004: SECURITY FIX: July 23, 2008</strong>  <strong>010: RELIABILITY FIX: February 18, 2009</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 <b>2nd revision, July 23, 2008</b><br>  bgpd(8) did not correctly prepend its own AS to very long AS paths, causing
 A vulnerability has been found with BIND. An attacker could use this vulnerability  the process to terminate because of the resulting corrupt path.
 to poison the cache of a recursive resolving name server.  
 <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1447">CVE-2008-1447</a>.  
 <br>  <br>
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/4.3/common/004_bind.patch">  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/4.3/common/010_bgpd.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
   
 <li id="p003_xorg">  <li id="p011_sudo">
 <strong>003: SECURITY FIX: July 15, 2008</strong>  <strong>011: SECURITY FIX: February 22, 2009</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 Multiple vulnerabilities have been discovered in X.Org.<br>  sudo(8) may allow a user listed in the sudoers file to run a command
 RENDER Extension heap buffer overflow,  as a different user than their access rule specifies when a Unix
 RENDER Extension crash,  group is used in the RunAs portion of the rule.  The bug only manifests
 RENDER Extension memory corruption,  when the user being granted privileges is also a member of the group
 MIT-SHM arbitrary memory read,  in the RunAs portion of the rule.
 RECORD and Security extensions memory corruption.  
 <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2360">CVE-2008-2360</a>,  
 <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2361">CVE-2008-2361</a>,  
 <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2362">CVE-2008-2362</a>,  
 <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1379">CVE-2008-1379</a>,  
 <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1377">CVE-2008-1377</a>.  
 <br>  <br>
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/4.3/common/003_xorg.patch">  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/4.3/common/011_sudo.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
   
 <li id="p002_openssh2">  <li id="p012_openssl">
 <strong>002: SECURITY FIX: April 3, 2008</strong>  <strong>012: RELIABILITY FIX: April 8, 2009</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 Avoid possible hijacking of X11-forwarded connections with sshd(8)  The OpenSSL ASN.1 handling code could be forced to perform invalid memory
 by refusing to listen on a port unless all address families bind  accesses through the use of certain invalid strings
 successfully.<br>  (<a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0590">CVE-2009-0590</a>)
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/4.3/common/002_openssh2.patch">  or under certain error conditions triggerable by invalid ASN.1 structures
   (<a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0789">CVE-2009-0789</a>).
   These vulnerabilities could be exploited to achieve a
   denial-of-service. A more detailed description of these problems is available
   in the
   <a href="http://www.openssl.org/news/secadv_20090325.txt">OpenSSL security advisory</a>, but note that the other issue described there "Incorrect Error
   Checking During CMS verification" relates to code not enabled in OpenBSD.
   <br>
   <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/4.3/common/012_openssl.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
   
 <li id="p001_openssh">  <li id="p013_pf">
 <strong>001: SECURITY FIX: March 30, 2008</strong>  <strong>013: RELIABILITY FIX: April 11, 2009</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 sshd(8) would execute ~/.ssh/rc even when a sshd_config(5) <em>ForceCommand</em>  When pf attempts to perform translation on a specially crafted IP datagram,
 directive was in effect, allowing users with write access to this file to  a null pointer dereference will occur, resulting in a kernel panic.
 execute arbitrary commands. This behaviour was documented, but was an unsafe  In certain configurations this may be triggered by a remote attacker.
 default and an extra hassle for administrators.<br>  <br>
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/4.3/common/001_openssh.patch">  Restricting translation rules to protocols that are specific to the IP version
   in use, is an effective workaround until the patch can be installed. As an
   example, for IPv4 nat/binat/rdr rules you can use:
   <pre>
       nat/rdr ... inet proto { tcp udp icmp } ...
   </pre>
   Or for IPv6 nat/binat/rdr rules you can use:
   <pre>
       nat/rdr ... inet6 proto { tcp udp icmp6 } ...
   </pre>
   <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/4.3/common/013_pf.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
   
 </ul>  </ul>
   
 <hr>  <hr>
   1
Legend:
Removed from v.1.63  
changed lines
  Added in v.1.64