[BACK]Return to errata44.html CVS log [TXT][DIR] Up to [local] / www

Diff for /www/errata44.html between version 1.17 and 1.18

version 1.17, 2009/04/08 02:44:06 version 1.18, 2009/04/11 23:46:45
Line 86 
Line 86 
   
 <ul>  <ul>
   
   <li><a name="013_pf"></a>
   <font color="#009000"><strong>013: RELIABILITY FIX: April 11, 2009</strong></font> &nbsp; <i>All architectures</i><br>
   When pf attempts to perform translation on a specially crafted IP datagram,
   a null pointer dereference will occur, resulting in a kernel panic.
   In certain configurations this may be triggered by a remote attacker.
   <p>
   Restricting translation rules to protocols that are specific to the IP version
   in use, is an effective workaround until the patch can be installed. As an
   example, for IPv4 nat/binat/rdr rules you can use:
   <pre>
       nat/rdr ... inet proto { tcp udp icmp } ...
   </pre>
   Or for IPv6 nat/binat/rdr rules you can use:
   <pre>
       nat/rdr ... inet6 proto { tcp udp icmp6 } ...
   </pre>
   <a href="ftp://ftp.openbsd.org/pub/OpenBSD/patches/4.4/common/013_pf.patch">
   A source code patch exists which remedies this problem</a>.<br>
   <p>
   
 <li><a name="012_openssl"></a>  <li><a name="012_openssl"></a>
 <font color="#009000"><strong>012: RELIABILITY FIX: April 8, 2009</strong></font> &nbsp; <i>All architectures</i><br>  <font color="#009000"><strong>012: RELIABILITY FIX: April 8, 2009</strong></font> &nbsp; <i>All architectures</i><br>
 The OpenSSL ASN.1 handling code could be forced to perform invalid memory  The OpenSSL ASN.1 handling code could be forced to perform invalid memory
Legend:
Removed from v.1.17  
changed lines
  Added in v.1.18