===================================================================
RCS file: /cvsrepo/anoncvs/cvs/www/security.html,v
retrieving revision 1.125
retrieving revision 1.126
diff -c -r1.125 -r1.126
*** www/security.html	2000/05/25 07:39:27	1.125
--- www/security.html	2000/05/25 16:44:37	1.126
***************
*** 204,233 ****
  
  <p>
  <ul>
! <li><a href=errata.html#procfs>May 25, 2000: 
  	xlockmore has a bug which a localhost attacker can use to gain
  	access to the encrypted root password hash (which is normally
  	encoded using blowfish (see
  	<a href="http://www.openbsd.org/cgi-bin/man.cgi?query=crypt&sektion=3">
  	crypt(3)</a>)
  	(patch included).</a>
! <li><a href=errata.html#procfs>Jan 20, 2000: 
  	Systems running with procfs enabled and mounted are
  	vulnerable to a very tricky exploit.  procfs is not
  	mounted by default.
  	(patch included).</a>
! <li><a href=errata.html#ifmedia>Nov 9, 1999: 
  	Any user could change interface media configurations, resulting in
  	a localhost denial of service attack.
  	(patch included).</a>
! <li><a href=errata.html#sslUSA>Dec 2, 1999:
  	A buffer overflow in the RSAREF code included in the
  	USA version of libssl, is possibly exploitable in
  	httpd, ssh, or isakmpd, if SSL/RSA features are enabled.
  	(patch included).<br></a>
  	<strong>Update:</strong> Turns out that this was not exploitable
  	in any of the software included in OpenBSD 2.6.
! <li><a href=errata.html#sendmail>Dec 4, 1999:
  	Sendmail permitted any user to cause a aliases file wrap,
  	thus exposing the system to a race where the aliases file
  	did not exist.
--- 204,233 ----
  
  <p>
  <ul>
! <li><a href=errata26.html#xlockmore>May 25, 2000: 
  	xlockmore has a bug which a localhost attacker can use to gain
  	access to the encrypted root password hash (which is normally
  	encoded using blowfish (see
  	<a href="http://www.openbsd.org/cgi-bin/man.cgi?query=crypt&sektion=3">
  	crypt(3)</a>)
  	(patch included).</a>
! <li><a href=errata26.html#procfs>Jan 20, 2000: 
  	Systems running with procfs enabled and mounted are
  	vulnerable to a very tricky exploit.  procfs is not
  	mounted by default.
  	(patch included).</a>
! <li><a href=errata26.html#ifmedia>Nov 9, 1999: 
  	Any user could change interface media configurations, resulting in
  	a localhost denial of service attack.
  	(patch included).</a>
! <li><a href=errata26.html#sslUSA>Dec 2, 1999:
  	A buffer overflow in the RSAREF code included in the
  	USA version of libssl, is possibly exploitable in
  	httpd, ssh, or isakmpd, if SSL/RSA features are enabled.
  	(patch included).<br></a>
  	<strong>Update:</strong> Turns out that this was not exploitable
  	in any of the software included in OpenBSD 2.6.
! <li><a href=errata26.html#sendmail>Dec 4, 1999:
  	Sendmail permitted any user to cause a aliases file wrap,
  	thus exposing the system to a race where the aliases file
  	did not exist.
***************
*** 520,526 ****
  <a href=index.html><img height=24 width=24 src=back.gif border=0 alt=OpenBSD></a>
  <a href=mailto:www@openbsd.org>www@openbsd.org</a>
  <br>
! <small>$OpenBSD: security.html,v 1.125 2000/05/25 07:39:27 deraadt Exp $</small>
  
  </body>
  </html>
--- 520,526 ----
  <a href=index.html><img height=24 width=24 src=back.gif border=0 alt=OpenBSD></a>
  <a href=mailto:www@openbsd.org>www@openbsd.org</a>
  <br>
! <small>$OpenBSD: security.html,v 1.126 2000/05/25 16:44:37 deraadt Exp $</small>
  
  </body>
  </html>