www/security.html - diff

Return to security.html CVS log

Up to [local] / www

Diff for /www/security.html between version 1.412 and 1.413

version 1.412, 2014/05/01 15:15:22

version 1.413, 2014/05/13 20:12:43

Line 718

<h3><font color="#e00000">OpenBSD 3.8 Security Advisories</font></h3>

These are the OpenBSD 3.8 advisories -- all these problems are solved

in <a href=anoncvs.html>OpenBSD current</a> and the

<a href=stable.html>patch branch</a>.

Line 784

<h3><font color="#e00000">OpenBSD 3.7 Security Advisories</font></h3>

These are the OpenBSD 3.7 advisories -- all these problems are solved

in <a href="anoncvs.html">OpenBSD current</a>. The

<a href="stable.html">patch branch</a> for 3.7 is no longer being maintained,

you should update your machine.

Line 823

<h3><font color="#e00000">OpenBSD 3.6 Security Advisories</font></h3>

These are the OpenBSD 3.6 advisories -- all these problems are solved

in <a href="anoncvs.html">OpenBSD current</a>. The

<a href="stable.html">patch branch</a> for 3.6 is no longer being maintained,

you should update your machine.

Line 865

<h3><font color="#e00000">OpenBSD 3.5 Security Advisories</font></h3>

These are the OpenBSD 3.5 advisories -- all these problems are solved

in <a href="anoncvs.html">OpenBSD current</a>. The

<a href="stable.html">patch branch</a> for 3.5 is no longer being maintained,

you should update your machine.

Line 916

to the possibility of principal impersonation from other

Kerberos realms if they are trusted with a cross-realm trust.</a>

<li><a href="errata35.html#xdm"> May 26, 2004:

xdm(1) ignores the requestPort resource and creates a

listening socket regardless of the setting in xdm-config.</a>

<li><a href="errata35.html#cvs2"> May 20, 2004:

A buffer overflow in the cvs(1) server has been found,

Line 936

<h3><font color="#e00000">OpenBSD 3.4 Security Advisories</font></h3>

These are the OpenBSD 3.4 advisories -- all these problems are solved

in <a href="anoncvs.html">OpenBSD current</a>. The

<a href="stable.html">patch branch</a> for 3.4 is no longer being maintained,

you should update your machine.

Line 1009

<h3><font color="#e00000">OpenBSD 3.3 Security Advisories</font></h3>

These are the OpenBSD 3.3 advisories -- all these problems are solved

in <a href="anoncvs.html">OpenBSD current</a>. The

<a href="stable.html">patch branch</a> for 3.3 is no longer being maintained,

you should update your machine.

Line 1040

Several message handling flaws in isakmpd(8) have been reported

by Thomas Walpuski.</a>

<li><a href="errata33.html#ibcs2">November 17, 2003:

It may be possible for a local user to execute arbitrary code

resulting in escalation of privileges due to a stack overrun

in compat_ibcs2(8).</a>

<li><a href="errata33.html#asn1">October 1, 2003:

The use of certain ASN.1 encodings or malformed public keys may

allow an attacker to mount a denial of service attack against

applications linked with ssl(3).</a>

<li><a href="errata33.html#pfnorm">September 24, 2003:

Access of freed memory in pf(4) could be used to

remotely panic a machine using scrub rules.</a>

<li><a href="errata33.html#sendmail">September 17, 2003:

A buffer overflow in the address parsing in

Line 1073

<h3><font color="#e00000">OpenBSD 3.2 Security Advisories</font></h3>

These are the OpenBSD 3.2 advisories -- all these problems are solved

in <a href="anoncvs.html">OpenBSD current</a>. The

<a href="stable.html">patch branch</a> for 3.2 is no longer being maintained,

you should update your machine.

Line 1084

allow an attacker to mount a denial of service attack against

applications linked with ssl(3). This does not affect OpenSSH.</a>

<li><a href="errata32.html#pfnorm">September 24, 2003:

Access of freed memory in pf(4) could be used to

remotely panic a machine using scrub rules.</a>

<li><a href="errata32.html#sendmail4">September 17, 2003:

A buffer overflow in the address parsing in

Line 1123

numbers as part of the file handle.</a>

<li><a href="errata32.html#ssl">February 22, 2003:

In ssl(8) an information leak can occur via timing by performing

a MAC computation even if incorrect block cipher padding has

been found, this is a countermeasure. Also, check for negative

sizes, in allocation routines.</a>

<li><a href="errata32.html#cvs">January 20, 2003:

Line 1153

<h3><font color="#e00000">OpenBSD 3.1 Security Advisories</font></h3>

These are the OpenBSD 3.1 advisories -- all these problems are solved

in <a href="anoncvs.html">OpenBSD current</a>. The

<a href="stable.html">patch branch</a> for 3.1 is no longer being maintained,

you should update your machine.

Line 1180

sendmail(8) may allow an attacker to gain root privileges.</a>

<li><a href="errata31.html#ssl2">February 23, 2003:

In ssl(8) an information leak can occur via timing by performing

a MAC computation even if incorrect block cipher padding has

been found, this is a countermeasure. Also, check for negative

sizes, in allocation routines.</a>

<li><a href="errata31.html#cvs">January 20, 2003:

Line 1258

<h3><font color="#e00000">OpenBSD 3.0 Security Advisories</font></h3>

These are the OpenBSD 3.0 advisories -- all these problems are solved

in <a href="anoncvs.html">OpenBSD current</a>. The

<a href="stable.html">patch branch</a> for 3.0 is no longer being maintained,

you should update your machine.

Line 1368

<h3><font color="#e00000">OpenBSD 2.9 Security Advisories</font></h3>

These are the OpenBSD 2.9 advisories -- all these problems are solved

in <a href="anoncvs.html">OpenBSD current</a>. The

<a href="stable.html">patch branch</a>. for 2.9 is no longer being maintained,

you should update your machine.

Line 1447

<h3><font color="#e00000">OpenBSD 2.8 Security Advisories</font></h3>

These are the OpenBSD 2.8 advisories -- all these problems are solved

in <a href="anoncvs.html">OpenBSD current</a>. The

<a href="stable.html">patch branch</a>. for 2.8 is no longer being maintained,

you should update your machine.

Line 1507

<h3><font color="#e00000">OpenBSD 2.7 Security Advisories</font></h3>

These are the OpenBSD 2.7 advisories -- all these problems are solved

in <a href="anoncvs.html">OpenBSD current</a>. Obviously, all the

OpenBSD 2.6 advisories listed below are fixed in OpenBSD 2.7.

Line 1526

X11 libraries have 2 potential overflows in xtrans code.

(patch included)</a>

<li><a href="errata27.html#httpd">Oct 18, 2000:

Apache mod_rewrite and mod_vhost_alias modules could expose files

on the server in certain configurations if used.

(patch included)</a>

<li><a href="errata27.html#telnetd">Oct 10, 2000:

Line 1590

<li><a href="errata27.html#ipf">May 25, 2000:

Improper use of ipf <i>keep-state</i> rules can result

in firewall rules being bypassed. (patch included)</a>

</ul>

<p>

Line 1598

<h3><font color="#e00000">OpenBSD 2.6 Security Advisories</font></h3>

These are the OpenBSD 2.6 advisories -- all these problems are solved

in <a href="anoncvs.html">OpenBSD current</a>. Obviously, all the

OpenBSD 2.5 advisories listed below are fixed in OpenBSD 2.6.

Line 1610

<li><a href="errata26.html#ipf">May 25, 2000:

Improper use of ipf <i>keep-state</i> rules can result

in firewall rules being bypassed. (patch included)</a>

<li><a href="errata26.html#xlockmore">May 25, 2000:

xlockmore has a bug which a localhost attacker can use to gain

access to the encrypted root password hash (which is normally

encoded using blowfish</a> (see

crypt(3)</a>)

(patch included).

<li><a href="errata26.html#procfs">Jan 20, 2000:

Systems running with procfs enabled and mounted are

vulnerable to a very tricky exploit. procfs is not

mounted by default.

Line 1636

(patch included).<br></a>

<strong>Update:</strong> Turns out that this was not exploitable

in any of the software included in OpenBSD 2.6.

<li><a href="errata26.html#ifmedia">Nov 9, 1999:

Any user could change interface media configurations, resulting in

a localhost denial of service attack.

(patch included).</a>

Line 1647

<h3><font color="#e00000">OpenBSD 2.5 Security Advisories</font></h3>

These are the OpenBSD 2.5 advisories -- all these problems are solved

in <a href="anoncvs.html">OpenBSD current</a>. Obviously, all the

OpenBSD 2.4 advisories listed below are fixed in OpenBSD 2.5.

<p>

<ul>

<li><a href="errata25.html#cron">Aug 30, 1999:

In cron(8), make sure argv[] is NULL terminated in the

fake popen() and run sendmail as the user, not as root.

(patch included).</a>

Line 1682

<h3><font color="#e00000">OpenBSD 2.4 Security Advisories</font></h3>

These are the OpenBSD 2.4 advisories -- all these problems are solved

in <a href="anoncvs.html">OpenBSD current</a>. Obviously, all the

OpenBSD 2.3 advisories listed below are fixed in OpenBSD 2.4.

Line 1699

<li><a href="errata24.html#ping">Feb 23, 1999: Yet another buffer overflow

existed in ping(8). (patch included).</a>

<li><a href="errata24.html#ipqrace">Feb 19, 1999: ipintr() had a race in use of

the ipq, which could permit an attacker to cause a crash.

(patch included).</a>

<li><a href="errata24.html#accept">Feb 17, 1999: A race condition in the

kernel between accept(2) and select(2) could permit an attacker

Line 1727

<h3><font color="#e00000">OpenBSD 2.3 Security Advisories</font></h3>

These are the OpenBSD 2.3 advisories -- all these problems are solved

in <a href="anoncvs.html">OpenBSD current</a>. Obviously, all the

OpenBSD 2.2 advisories listed below are fixed in OpenBSD 2.3.

Line 1829

<p>

<ul>

<li><a href="advisories/res_random.txt">April 22, 1997: Predictable IDs in the

resolver (patch included)</a>

<li>Many others... if people can hunt them down, please let me know

and we'll put them up here.

</ul>

Line 1875

transition between major releases.

<li>Install a binary snapshot for your

architecture, which are made available fairly often. For

instance, an i386 snapshot is typically made available weekly.

</ul>

<p>