File: [local] / www / errata43.html (download) (as text)
Revision 1.53, Sat Jul 23 14:19:32 2016 UTC (7 years, 10 months ago) by deraadt
Branch: MAIN
Changes since 1.52: +2 -1 lines
rotate errata files to prepare for next release
|
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<title>OpenBSD 4.3 Errata</title>
<meta name="description" content="the OpenBSD CD errata page">
<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
<meta name="viewport" content="width=device-width, initial-scale=1">
<link rel="stylesheet" type="text/css" href="openbsd.css">
<link rel="canonical" href="http://www.openbsd.org/errata43.html">
</head>
<!--
IMPORTANT REMINDER
IF YOU ADD A NEW ERRATUM, MAIL THE PATCH TO TECH AND ANNOUNCE
-->
<body bgcolor="#ffffff" text="#000000" link="#23238E">
<h2>
<a href="index.html">
<font color="#0000ff"><i>Open</i></font><font color="#000084">BSD</font></a>
<font color="#e00000">4.3 Errata</font>
</h2>
<hr>
<a href=stable.html>For OpenBSD patch branch information, please refer here.</a><br>
<br>
For errata on a certain release, click below:<br>
<a href="errata21.html">2.1</a>,
<a href="errata22.html">2.2</a>,
<a href="errata23.html">2.3</a>,
<a href="errata24.html">2.4</a>,
<a href="errata25.html">2.5</a>,
<a href="errata26.html">2.6</a>,
<a href="errata27.html">2.7</a>,
<a href="errata28.html">2.8</a>,
<a href="errata29.html">2.9</a>,
<a href="errata30.html">3.0</a>,
<a href="errata31.html">3.1</a>,
<a href="errata32.html">3.2</a>,
<a href="errata33.html">3.3</a>,
<a href="errata34.html">3.4</a>,
<a href="errata35.html">3.5</a>,
<a href="errata36.html">3.6</a>,
<br>
<a href="errata37.html">3.7</a>,
<a href="errata38.html">3.8</a>,
<a href="errata39.html">3.9</a>,
<a href="errata40.html">4.0</a>,
<a href="errata41.html">4.1</a>,
<a href="errata42.html">4.2</a>,
<a href="errata44.html">4.4</a>,
<a href="errata45.html">4.5</a>,
<a href="errata46.html">4.6</a>,
<a href="errata47.html">4.7</a>,
<a href="errata48.html">4.8</a>,
<a href="errata49.html">4.9</a>,
<a href="errata50.html">5.0</a>,
<a href="errata51.html">5.1</a>,
<a href="errata52.html">5.2</a>,
<a href="errata53.html">5.3</a>,
<br>
<a href="errata54.html">5.4</a>,
<a href="errata55.html">5.5</a>,
<a href="errata56.html">5.6</a>,
<a href="errata57.html">5.7</a>,
<a href="errata58.html">5.8</a>,
<a href="errata59.html">5.9</a>,
<a href="errata60.html">6.0</a>.
<br>
<hr>
<a href="http://ftp.openbsd.org/pub/OpenBSD/patches/4.3.tar.gz">
You can also fetch a tar.gz file containing all the following patches</a>.
This file is updated once a day.
<p>
The patches below are available in CVS via the
<code>OPENBSD_4_3</code> <a href="stable.html">patch branch</a>.
<p>
For more detailed information on how to install patches to OpenBSD, please
consult the <a href="./faq/faq10.html#Patches">OpenBSD FAQ</a>.
<p>
<hr>
<ul>
<li id="013_pf">
<font color="#009000"><strong>013: RELIABILITY FIX: April 11, 2009</strong></font>
<i>All architectures</i><br>
When pf attempts to perform translation on a specially crafted IP datagram,
a null pointer dereference will occur, resulting in a kernel panic.
In certain configurations this may be triggered by a remote attacker.
<br>
Restricting translation rules to protocols that are specific to the IP version
in use, is an effective workaround until the patch can be installed. As an
example, for IPv4 nat/binat/rdr rules you can use:
<pre>
nat/rdr ... inet proto { tcp udp icmp } ...
</pre>
Or for IPv6 nat/binat/rdr rules you can use:
<pre>
nat/rdr ... inet6 proto { tcp udp icmp6 } ...
</pre>
<a href="http://ftp.openbsd.org/pub/OpenBSD/patches/4.3/common/013_pf.patch">
A source code patch exists which remedies this problem.</a>
<p>
<li id="012_openssl">
<font color="#009000"><strong>012: RELIABILITY FIX: April 8, 2009</strong></font>
<i>All architectures</i><br>
The OpenSSL ASN.1 handling code could be forced to perform invalid memory
accesses through the use of certain invalid strings
(<a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0590">CVE-2009-0590</a>)
or under certain error conditions triggerable by invalid ASN.1 structures
(<a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0789">CVE-2009-0789</a>).
These vulnerabilities could be exploited to achieve a
denial-of-service. A more detailed description of these problems is available
in the
<a href="http://www.openssl.org/news/secadv_20090325.txt">OpenSSL security advisory</a>, but note that the other issue described there "Incorrect Error
Checking During CMS verification" relates to code not enabled in OpenBSD.
<br>
<a href="http://ftp.openbsd.org/pub/OpenBSD/patches/4.3/common/012_openssl.patch">
A source code patch exists which remedies this problem.</a>
<p>
<li id="011_sudo">
<font color="#009000"><strong>011: SECURITY FIX: February 22, 2009</strong></font>
<i>All architectures</i><br>
sudo(8) may allow a user listed in the sudoers file to run a command
as a different user than their access rule specifies when a Unix
group is used in the RunAs portion of the rule. The bug only manifests
when the user being granted privileges is also a member of the group
in the RunAs portion of the rule.
<br>
<a href="http://ftp.openbsd.org/pub/OpenBSD/patches/4.3/common/011_sudo.patch">
A source code patch exists which remedies this problem.</a>
<p>
<li id="010_bgpd">
<font color="#009000"><strong>010: RELIABILITY FIX: February 18, 2009</strong></font>
<i>All architectures</i><br>
bgpd(8) did not correctly prepend its own AS to very long AS paths, causing
the process to terminate because of the resulting corrupt path.
<br>
<a href="http://ftp.openbsd.org/pub/OpenBSD/patches/4.3/common/010_bgpd.patch">
A source code patch exists which remedies this problem.</a>
<p>
<li id="009_bgpd">
<font color="#009000"><strong>009: RELIABILITY FIX: January 30, 2009</strong></font>
<i>All architectures</i><br>
Upon reception of an invalid update with 4-byte AS attributes, bgpd -
adhering to the RFCs - closed the session to the neighbor.
This error in the specification allowed 3rd parties to close remote BGP
sessions.
In the worst case Internet connectivity could be lost.
<br>
<a href="http://ftp.openbsd.org/pub/OpenBSD/patches/4.3/common/009_bgpd.patch">
A source code patch exists which remedies this problem.</a>
<p>
<li id="008_bind">
<font color="#009000"><strong>008: SECURITY FIX: January 14, 2009</strong></font>
<i>All architectures</i><br>
named(8) did not correctly check the return value of a DSA verification
function, potentially allowing bypass of verification of DNSSEC DSA
signatures.
<a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0025">CVE-2009-0025</a>.
<br>
<a href="http://ftp.openbsd.org/pub/OpenBSD/patches/4.3/common/008_bind.patch">
A source code patch exists which remedies this problem.</a>
<p>
<li id="007_openssl">
<font color="#009000"><strong>007: SECURITY FIX: January 9, 2009</strong></font>
<i>All architectures</i><br>
The OpenSSL libraries did not correctly check the return value from
certain verification functions, allowing validation to be bypassed and
permitting a remote attacker to conduct a "man in the middle attack"
against SSL/TLS connections if the server is configured with a DSA or ECDSA
certificate.
<a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5077">CVE-2008-5077</a>.
<br>
<a href="http://ftp.openbsd.org/pub/OpenBSD/patches/4.3/common/007_openssl.patch">
A source code patch exists which remedies this problem.</a>
<p>
<li id="006_ndp">
<font color="#009000"><strong>006: SECURITY FIX: October 2, 2008</strong></font>
<i>All architectures</i><br>
The Neighbor Discovery Protocol (ndp) did not correctly verify neighbor
solicitation requests maybe allowing a nearby attacker to intercept traffic.
The attacker must have IPv6 connectivity to the same router as their target for
this vulnerability to be exploited.
<a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2476">CVE-2008-2476</a>.
<br>
<a href="http://ftp.openbsd.org/pub/OpenBSD/patches/4.3/common/006_ndp.patch">
A source code patch exists which remedies this problem.</a>
<p>
<li id="005_pcb">
<font color="#009000"><strong>005: RELIABILITY FIX: July 29, 2008</strong></font>
<i>All architectures</i><br>
Some kinds of IPv6 usage would leak kernel memory (in particular, this path
was exercised by the named(8) patch for port randomization). Since INET6 is
enabled by default, this condition affects all systems.
<br>
<a href="http://ftp.openbsd.org/pub/OpenBSD/patches/4.3/common/005_pcb.patch">
A source code patch exists which remedies this problem.</a>
<p>
<li id="004_bind">
<font color="#009000"><strong>004: SECURITY FIX: July 23, 2008</strong></font>
<i>All architectures</i><br>
<strong>2nd revision, July 23, 2008</strong><br>
A vulnerability has been found with BIND. An attacker could use this vulnerability
to poison the cache of a recursive resolving name server.
<a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1447">CVE-2008-1447</a>.
<br>
<a href="http://ftp.openbsd.org/pub/OpenBSD/patches/4.3/common/004_bind.patch">
A source code patch exists which remedies this problem.</a>
<p>
<li id="003_xorg">
<font color="#009000"><strong>003: SECURITY FIX: July 15, 2008</strong></font>
<i>All architectures</i><br>
Multiple vulnerabilities have been discovered in X.Org.<br>
RENDER Extension heap buffer overflow,
RENDER Extension crash,
RENDER Extension memory corruption,
MIT-SHM arbitrary memory read,
RECORD and Security extensions memory corruption.
<a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2360">CVE-2008-2360</a>,
<a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2361">CVE-2008-2361</a>,
<a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2362">CVE-2008-2362</a>,
<a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1379">CVE-2008-1379</a>,
<a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1377">CVE-2008-1377</a>.
<br>
<a href="http://ftp.openbsd.org/pub/OpenBSD/patches/4.3/common/003_xorg.patch">
A source code patch exists which remedies this problem.</a>
<p>
<li id="002_openssh2">
<font color="#009000"><strong>002: SECURITY FIX: April 3, 2008</strong></font>
<i>All architectures</i><br>
Avoid possible hijacking of X11-forwarded connections with sshd(8)
by refusing to listen on a port unless all address families bind
successfully.<br>
<a href="http://ftp.openbsd.org/pub/OpenBSD/patches/4.3/common/002_openssh2.patch">
A source code patch exists which remedies this problem.</a>
<p>
<li id="001_openssh">
<font color="#009000"><strong>001: SECURITY FIX: March 30, 2008</strong></font>
<i>All architectures</i><br>
sshd(8) would execute ~/.ssh/rc even when a sshd_config(5) <em>ForceCommand</em>
directive was in effect, allowing users with write access to this file to
execute arbitrary commands. This behaviour was documented, but was an unsafe
default and an extra hassle for administrators.<br>
<a href="http://ftp.openbsd.org/pub/OpenBSD/patches/4.3/common/001_openssh.patch">
A source code patch exists which remedies this problem.</a>
<p>
</ul>
<hr>
</body>
</html>
![[BACK]](/icons/back.gif){kind=icon}
Return to errata43.html CVS log ![[TXT]](/icons/text.gif){kind=icon}
![[DIR]](/icons/dir.gif){kind=icon}
Up to [local] / www