===================================================================
RCS file: /cvsrepo/anoncvs/cvs/www/plus25.html,v
retrieving revision 1.16
retrieving revision 1.17
diff -c -r1.16 -r1.17
*** www/plus25.html 2002/10/17 08:47:58 1.16
--- www/plus25.html 2003/03/06 16:27:10 1.17
***************
*** 1,8 ****
!
OpenBSD 2.5 changes
! OpenBSD 2.5 changes
!
!
Changes made between OpenBSD 2.4 and OpenBSD 2.5
This is a partial list of the major machine independent changes
--- 14,21 ----
!
Changes made between OpenBSD 2.4 and OpenBSD 2.5
This is a partial list of the major machine independent changes
***************
*** 27,33 ****
changes, starting with those listed below..
! Note: Problems for which patches exist are marked in red .
--- 28,34 ----
changes, starting with those listed below..
! Note: Problems for which patches exist are marked in red .
***************
*** 51,61 ****
!
OpenBSD 2.5 released (May 19, 1999).
2.5 source tree frozen.
! Fix ln kernel bug in vfs_lookup.c. A patch is available Fix ipf return-rst panic bug.
Add a -q flag to newfs, so that it does not print out information about the superblock backups. This is used by the install process.
Do not permit any IPSEC code unless the admin has enabled it using sysctl.
--- 52,62 ----
!
OpenBSD 2.5 released (May 19, 1999).
2.5 source tree frozen.
! Fix ln kernel bug in vfs_lookup.c. A patch is available Fix ipf return-rst panic bug.
Add a -q flag to newfs, so that it does not print out information about the superblock backups. This is used by the install process.
Do not permit any IPSEC code unless the admin has enabled it using sysctl.
***************
*** 86,94 ****
Workaround sun4m STP1020A errata #148494 regarding cache initialization.
In ipsend(8), do not crash if no options provided.
Various powerpc fixes, including further PIC support, and fix a kernel pmap crash.
! SECURITY ISSUE: In poll(2), constrain the nfds parameter better, so that kvm starvation is less likely. A patch is available Make at(1) easier to use next year (ie. Y2K issue).
! SECURITY ISSUE: Fix TSS fault handling. A patch is available In the ncr(4) driver, disable tagged queuing by default. Our filesystems and vfs layer is not prepared for this play-it-loose behaviour.
Repair ypwhich -h support; it was broken when running on non-server machines.
Add non-learning and non-discovery modes to the bridging code.
--- 87,95 ----
Workaround sun4m STP1020A errata #148494 regarding cache initialization.
In ipsend(8), do not crash if no options provided.
Various powerpc fixes, including further PIC support, and fix a kernel pmap crash.
! SECURITY ISSUE: In poll(2), constrain the nfds parameter better, so that kvm starvation is less likely. A patch is available Make at(1) easier to use next year (ie. Y2K issue).
! SECURITY ISSUE: Fix TSS fault handling. A patch is available In the ncr(4) driver, disable tagged queuing by default. Our filesystems and vfs layer is not prepared for this play-it-loose behaviour.
Repair ypwhich -h support; it was broken when running on non-server machines.
Add non-learning and non-discovery modes to the bridging code.
***************
*** 195,205 ****
Move ls(1) into ftpd(8).. directly.
In setproctitle(3), if sysctl(2) fails do not crash.
Constify getcap(3) API.
! For the i386, fix /boot argument mapping. A patch is available Put skipjack in libc.
Continue squishing new bugs in new ipsec PF_KEY code...
Fix autosetting of d_type and _dtypename in wd(4).
! SECURITY ISSUE: Fix the nlink overflow in FFS and EXT2FS. A patch is available Add zegrep(1) and zfgrep(1).
Change IPSEC stack to support PFKEYv2.
PentiumIII detection.
--- 196,206 ----
Move ls(1) into ftpd(8).. directly.
In setproctitle(3), if sysctl(2) fails do not crash.
Constify getcap(3) API.
! For the i386, fix /boot argument mapping. A patch is available Put skipjack in libc.
Continue squishing new bugs in new ipsec PF_KEY code...
Fix autosetting of d_type and _dtypename in wd(4).
! SECURITY ISSUE: Fix the nlink overflow in FFS and EXT2FS. A patch is available Add zegrep(1) and zfgrep(1).
Change IPSEC stack to support PFKEYv2.
PentiumIII detection.
***************
*** 214,220 ****
Better promisc and multicast handling in sparc hme(4).
Fix an rdist(8) bug.
Handle powered-down xl(4) cards better.
! SECURITY ISSUE: Fix an overflow in ping(8). A patch is available In fork(2), always spare 5 last processes for root.
Better vis(3) support in savecore(8).
Quiet apm(4) and add machdep.apmwarn sysctl.
--- 215,221 ----
Better promisc and multicast handling in sparc hme(4).
Fix an rdist(8) bug.
Handle powered-down xl(4) cards better.
! SECURITY ISSUE: Fix an overflow in ping(8). A patch is available In fork(2), always spare 5 last processes for root.
Better vis(3) support in savecore(8).
Quiet apm(4) and add machdep.apmwarn sysctl.
***************
*** 224,230 ****
Add -x, -p, and -m options to ls(1).
In ld(1) and ld.so(1), do not optimize the search path when dealing with duplicate shared library names (even though both alternatives have problems).
Fix an kernel ipf bug relating to out-going icmp.
! SECURITY ISSUE: Fix an ipq race in ipintr(). A patch is available , which must be applied after the maxqueue patch has been installed. Allocate u-area early in fork1(), instead of vm_fork().
Fix msdosfs bug regarding corrupted FAT32 root directories.
Improve vfs lkm interface.
--- 225,231 ----
Add -x, -p, and -m options to ls(1).
In ld(1) and ld.so(1), do not optimize the search path when dealing with duplicate shared library names (even though both alternatives have problems).
Fix an kernel ipf bug relating to out-going icmp.
! SECURITY ISSUE: Fix an ipq race in ipintr(). A patch is available , which must be applied after the maxqueue patch has been installed. Allocate u-area early in fork1(), instead of vm_fork().
Fix msdosfs bug regarding corrupted FAT32 root directories.
Improve vfs lkm interface.
***************
*** 233,239 ****
Fix DES weak key checking in libdes (and netinet/libdeslite).
Improve the ipsec(4) man page.
Fix netstat -A header.
! SECURITY ISSUE: Improved fragment flood protection in the IP layer. A patch is available IPSEC skipjack support (do not bother using this unless you are .gov or .mil).
Check sub-regions better in subr_extent.c, which affects pcmcia.
Add -f option to comm(1) for case folding.
--- 234,240 ----
Fix DES weak key checking in libdes (and netinet/libdeslite).
Improve the ipsec(4) man page.
Fix netstat -A header.
! SECURITY ISSUE: Improved fragment flood protection in the IP layer. A patch is available IPSEC skipjack support (do not bother using this unless you are .gov or .mil).
Check sub-regions better in subr_extent.c, which affects pcmcia.
Add -f option to comm(1) for case folding.
***************
*** 249,260 ****
Merge changes from db.1.86 (but do not merge new hash code, since it has an incompatible format)
Handle kernel malloc() failing, for TCP SACK block allocation.
Do more careful system call range-checking and introduce socklen_t.
! Fix a bug we introduced before 2.4 shipped: readv(2) and writev(2) with iov_len == 0 is legal. A patch is available Fix a pcmcia mapping bug regarding address space allocation.
For wds(4) and ex(4) drivers, unmap address space if probing fails.
In ipsecadm(8), verify that keys and IVs are specified in hex.
Document that MD4 is pretty much broken, and MD5 is looking pretty bad too (so much for quality designs from RSA).
! SECURITY ISSUE: i386 T_TRCTRAP DDB handling could cause a system crash. A patch is available tcpdump(8) out-of-range access in LLC decoding.
Flesh out the vpn(8) manpage.
Add old dbm-compatible interface code, from db-1.86
--- 250,261 ----
Merge changes from db.1.86 (but do not merge new hash code, since it has an incompatible format)
Handle kernel malloc() failing, for TCP SACK block allocation.
Do more careful system call range-checking and introduce socklen_t.
! Fix a bug we introduced before 2.4 shipped: readv(2) and writev(2) with iov_len == 0 is legal. A patch is available Fix a pcmcia mapping bug regarding address space allocation.
For wds(4) and ex(4) drivers, unmap address space if probing fails.
In ipsecadm(8), verify that keys and IVs are specified in hex.
Document that MD4 is pretty much broken, and MD5 is looking pretty bad too (so much for quality designs from RSA).
! SECURITY ISSUE: i386 T_TRCTRAP DDB handling could cause a system crash. A patch is available tcpdump(8) out-of-range access in LLC decoding.
Flesh out the vpn(8) manpage.
Add old dbm-compatible interface code, from db-1.86
***************
*** 266,272 ****
ncurses-4.2-990206
Correct various freebsd/linux emulation issues.
Correct directory entry reads for numerous binary emulators.
! SECURITY ISSUE: Better RST handling in tcp input. A patch is available BeOS/i386 support in fdisk(8).
Two more nop instructions in sparc locore.s for greater reliability on Viking CPUs.
Pluralization fix in rup(1).
--- 267,273 ----
ncurses-4.2-990206
Correct various freebsd/linux emulation issues.
Correct directory entry reads for numerous binary emulators.
! SECURITY ISSUE: Better RST handling in tcp input. A patch is available BeOS/i386 support in fdisk(8).
Two more nop instructions in sparc locore.s for greater reliability on Viking CPUs.
Pluralization fix in rup(1).
***************
*** 277,283 ****
Handle MNT_NODEV in nullfs.
Correct a tcp ISS bug.
Support sparc bootpath handling in qe(4) and be(4).
! hp300 X in the 2.4 release has an installation issue. Further details available Fix isa_check_intr() support on the alpha.
Fix breaking support in fold -s .
Improve long line support in hexdump(1).
--- 278,284 ----
Handle MNT_NODEV in nullfs.
Correct a tcp ISS bug.
Support sparc bootpath handling in qe(4) and be(4).
! hp300 X in the 2.4 release has an installation issue. Further details available Fix isa_check_intr() support on the alpha.
Fix breaking support in fold -s .
Improve long line support in hexdump(1).
***************
*** 314,320 ****
Add -b flag to install(1).
For the bootblocks, fix error returns when running in decompressing mode.
Disable i386 bootblocks E801 memory probing test.
! SECURITY ISSUE: Fix a select(2)/accept(2) race condition. A patch is available Support & username expansion in sendbug, and fix the /tmp race.
Avoid a sendmail DOS regarding huge numbers of header lines.
rmdir(".") now returns EBUSY, as XPG2 says.
--- 315,321 ----
Add -b flag to install(1).
For the bootblocks, fix error returns when running in decompressing mode.
Disable i386 bootblocks E801 memory probing test.
! SECURITY ISSUE: Fix a select(2)/accept(2) race condition. A patch is available Support & username expansion in sendbug, and fix the /tmp race.
Avoid a sendmail DOS regarding huge numbers of header lines.
rmdir(".") now returns EBUSY, as XPG2 says.
***************
*** 333,339 ****
Fix a varargs related bug in patch(1).
MNT_NOATIME support in msdosfs.
VIA Rhine ethernet driver.
! Fix an nfs v3 bug when talking to the pedantic solaris7 server. A patch is available Merge other fixes from ksh 5.2.13.6
Add RFNOWAIT support to rfork(2).
Careful strtol() use in make(1).
--- 334,340 ----
Fix a varargs related bug in patch(1).
MNT_NOATIME support in msdosfs.
VIA Rhine ethernet driver.
! Fix an nfs v3 bug when talking to the pedantic solaris7 server. A patch is available Merge other fixes from ksh 5.2.13.6
Add RFNOWAIT support to rfork(2).
Careful strtol() use in make(1).
***************
*** 372,378 ****
Correct nested ip_sum in icmp packets.
Correct the values of ip_len , ip_off , ip_id , and udp uh_sum fields for the embedded ip packet inside an icmp packet. (ip_sum is still wrong.)
More locking fixes in the vfs layer.
! Fix df(1) on NFS v3 filesystems. A source code patch is available which solves this problem Crank PID_MAX to 65535.
Do better pcmcia interrupt allocation.
Make ip_id non-repeating random, like DNS id's.
--- 373,379 ----
Correct nested ip_sum in icmp packets.
Correct the values of ip_len , ip_off , ip_id , and udp uh_sum fields for the embedded ip packet inside an icmp packet. (ip_sum is still wrong.)
More locking fixes in the vfs layer.
! Fix df(1) on NFS v3 filesystems. A source code patch is available which solves this problem Crank PID_MAX to 65535.
Do better pcmcia interrupt allocation.
Make ip_id non-repeating random, like DNS id's.
***************
*** 386,398 ****
Newer version of isakmpd.
In kgmon(8), let libkvm decide the default kernel name.
Repeat open operations in cdio, in case of slow changers.
! SECURITY ISSUE: Even more bootpd paranoia. Updated patches are available for 2.3 and 2.4 Make sa(8) 64bit clean.
In install(1), handle sparse files the same way pax(1) does.
! Replace raw termcap/terminfo databases with new ones based on a common and shared termtypes database. Since these databases had problems in the 2.4 release, updated versions are available Permit csh(1)-builtin printf function to have arguments.
Fix a display problem in hexdump(1).
! Fix an i386 installboot bug which prevents proper installation when the root partition (or the root partition end) are placed BEYOND the 4GB line. A source code patch is available which solves this problem Flesh mktemp(3) manpage out significantly.
Working mvme88k port.
For IPHDRINCL, check ip_hl for validity, too.
--- 387,399 ----
Newer version of isakmpd.
In kgmon(8), let libkvm decide the default kernel name.
Repeat open operations in cdio, in case of slow changers.
! SECURITY ISSUE: Even more bootpd paranoia. Updated patches are available for 2.3 and 2.4 Make sa(8) 64bit clean.
In install(1), handle sparse files the same way pax(1) does.
! Replace raw termcap/terminfo databases with new ones based on a common and shared termtypes database. Since these databases had problems in the 2.4 release, updated versions are available Permit csh(1)-builtin printf function to have arguments.
Fix a display problem in hexdump(1).
! Fix an i386 installboot bug which prevents proper installation when the root partition (or the root partition end) are placed BEYOND the 4GB line. A source code patch is available which solves this problem Flesh mktemp(3) manpage out significantly.
Working mvme88k port.
For IPHDRINCL, check ip_hl for validity, too.
***************
*** 418,424 ****
Make -ltermcap be -lcurses; and -lotermcap be -locurses, via links.
For kerberosIV, install prot.h (some things require it).
XFree86 3.3.3
! SECURITY ISSUE: Fix a remote exploit problem in bootpd (which noone runs anyways, without filtering, right?). This fixes a security problem. Patches are available for 2.3 and 2.4 In cut(1), avoid an infinite loop.
In top(1), skip disabled swap spaces.
Even more man page fixes courtesy of our local man page repair fanatic.
--- 419,425 ----
Make -ltermcap be -lcurses; and -lotermcap be -locurses, via links.
For kerberosIV, install prot.h (some things require it).
XFree86 3.3.3
! SECURITY ISSUE: Fix a remote exploit problem in bootpd (which noone runs anyways, without filtering, right?). This fixes a security problem. Patches are available for 2.3 and 2.4 In cut(1), avoid an infinite loop.
In top(1), skip disabled swap spaces.
Even more man page fixes courtesy of our local man page repair fanatic.
***************
*** 450,456 ****
Fix a crash of ksh(1).
Ignore out-of-range environment LINES and COLUMNS in libocurses.
In libcurses in the issetugid(2) case, ignore $TERMINFO.
! SECURITY ISSUE: In libocurses and libcurses in the issetugid(2) case, only ignore $TERMCAP if it is a path. A patch is available Support full set of pty devices in the MAKEDEV scripts.
Make rl(4) match the Accton 1207D cards too.
Prototype getpgid(2)
--- 451,457 ----
Fix a crash of ksh(1).
Ignore out-of-range environment LINES and COLUMNS in libocurses.
In libcurses in the issetugid(2) case, ignore $TERMINFO.
! SECURITY ISSUE: In libocurses and libcurses in the issetugid(2) case, only ignore $TERMCAP if it is a path. A patch is available Support full set of pty devices in the MAKEDEV scripts.
Make rl(4) match the Accton 1207D cards too.
Prototype getpgid(2)
***************
*** 472,484 ****
Fix an expression handling bug in as(1).
Improve setregid() and setreuid() emulated behaviour.
ftok() is now XPG compliant.
! Put userdir support back into httpd(8). A patch is available Put userdir support back into httpd(8).
New daemon: isakmpd (ISAKMP/Oakley ipsec daemon).
Move /tmp/bootpd.dump to /var/run to avoid filesystem race.
Fix some manpages
sudo 1.5.6p6
! Fix a remote lockup problem in the TCP packet decoding code. This fixes a security problem. Patches are available for 2.3 and 2.4 Fix a deadlock in deadfs VOP_LOCK().
Support -p option in ipmon(8).
Change bpf to support full frame-grabbing for FDDI packets.
--- 473,485 ----
Fix an expression handling bug in as(1).
Improve setregid() and setreuid() emulated behaviour.
ftok() is now XPG compliant.
! Put userdir support back into httpd(8). A patch is available Put userdir support back into httpd(8).
New daemon: isakmpd (ISAKMP/Oakley ipsec daemon).
Move /tmp/bootpd.dump to /var/run to avoid filesystem race.
Fix some manpages
sudo 1.5.6p6
! Fix a remote lockup problem in the TCP packet decoding code. This fixes a security problem. Patches are available for 2.3 and 2.4 Fix a deadlock in deadfs VOP_LOCK().
Support -p option in ipmon(8).
Change bpf to support full frame-grabbing for FDDI packets.
***************
*** 509,515 ****
Use correct ioctl for flushing in ipmon(8).
Fix various tcp options bugs.
Fix tcp timestamps.
! Repair sparc kvm dump header problem. A patch is available More carefully check /etc/hostname.* file contents before using it.
Fix mktemp() problems in lynx(1).
--- 510,516 ----
Use correct ioctl for flushing in ipmon(8).
Fix various tcp options bugs.
Fix tcp timestamps.
! Repair sparc kvm dump header problem. A patch is available More carefully check /etc/hostname.* file contents before using it.
Fix mktemp() problems in lynx(1).
***************
*** 542,549 ****
www@openbsd.org
! $OpenBSD: plus25.html,v 1.16 2002/10/17 08:47:58 deraadt Exp $
--- 543,550 ----
www@openbsd.org
! $OpenBSD: plus25.html,v 1.17 2003/03/06 16:27:10 naddy Exp $
![[OpenBSD]](images/smalltitle.gif){kind=small}
! www@openbsd.org
!