File: [local] / www / security.html (download) (as text)
Revision 1.93, Sun Apr 18 02:34:01 1999 UTC (25 years, 1 month ago) by deraadt
Branch: MAIN
Changes since 1.92: +13 -1 lines
get ready for 2.5
|
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML Strict//EN">
<html>
<head>
<title>OpenBSD Security</title>
<link rev=made href=mailto:www@openbsd.org>
<meta name="resource-type" content="document">
<meta name="description" content="OpenBSD advisories">
<meta name="keywords" content="openbsd,main">
<meta name="distribution" content="global">
<meta name="copyright" content="This document copyright 1997,1998 by OpenBSD.">
</head>
<BODY BGCOLOR="#FFFFFF" TEXT="#000000" LINK="#23238E">
<img alt="[OpenBSD]" height=30 width=141 SRC="images/smalltitle.gif">
<hr>
<a href=#21>For 2.1 security advisories, please refer here</a>.<br>
<a href=#22>For 2.2 security advisories, please refer here</a>.<br>
<a href=#23>For 2.3 security advisories, please refer here</a>.<br>
<a href=#24>For 2.4 security advisories, please refer here</a>.<br>
<a href=#25>For 2.5 security advisories, please refer here</a>.<br>
<hr>
<p>
<h3><font color=#e00000><strong>OpenBSD Security Views</strong></font></h3>
OpenBSD believes in strong security. Our aspiration is to be NUMBER
ONE in the industry for security (if we are not already there). Our
open software development model permits us to take a more
uncompromising view towards increased security than Sun, SGI, IBM, HP,
or other vendors are able to. We can make changes the vendors would
not make. Also, since OpenBSD is exported with <a href=crypto.html>
cryptography</a>, we are able to take cryptographic approaches towards
fixing security problems.<p>
Like many readers of the
<a href=http://www.geek-girl.com/bugtraq/index.html>
BUGTRAQ mailing list</a>,
we believe in full disclosure of security problems. Security
information moves very fast in cracker circles. On the other hand,
our experience is that coding and releasing of proper security fixes
typically requires about an hour of work -- very fast fix turnaround
is possible. Thus we think that full disclosure helps the people who
really care about security.<p>
Our security auditing team typically has between six and twelve
members who continue to search for and fix new security holes. We
have been auditing since the summer of 1996. The process we follow to
increase security is simply a comprehensive file-by-file analysis of
every critical software component. Flaws have been found in just
about every area of the system. Entire new classes of security
problems have been found during our audit, and often source code
which had been audited earlier needs re-auditing with these new flaws
in mind. Code often gets audited multiple times, and by multiple
people with different auditing skills.<p>
Some members of our security auditing team work for
<a href=http://www.secnet.com>Secure Networks</a>, the company that
makes the industry's premier network security scanning software
package Ballista.
This company does a lot of security research, and this fits in well
with the OpenBSD stance. OpenBSD passes Ballista's tests with flying
colours.<p>
Another facet of our security auditing process is its proactiveness.
In most cases we have found that the determination of exploitability
is not an issue. During our ongoing auditing process we find many
bugs, and endeavor to fix them even though exploitability is not
proven. We fix the bug, and we move on to find other bugs to fix. We
have fixed many simple and obvious careless programming errors in code
and only months later discovered that the problems were in fact
exploitable. (Or, more likely someone on
<a href=http://www.geek-girl.com/bugtraq/index.html>BUGTRAQ</a>
would report that other operating systems were vulnerable to a `newly
discovered problem', and then it would be discovered that OpenBSD had
been fixed in a previous release). In other cases we have been saved
from full exploitability of complex step-by-step attacks because we
had fixed one of the intermediate steps. An example of where we
managed such a success is the
<a href=http://www.secnet.com/sni-advisories/sni-19.bsd.lpd.advisory.html>
lpd advisory from Secure Networks.</a><p>
Our proactive auditing process has really paid off. Statements like
``This problem was fixed in OpenBSD about 6 months ago'' have become
commonplace in security forums like
<a href=http://www.geek-girl.com/bugtraq/index.html>BUGTRAQ</a>.<p>
The most intense part of our security auditing happened immediately
before the OpenBSD 2.0 release and during the 2.0->2.1 transition,
over the last third of 1996 and first half of 1997. Thousands (yes,
thousands) of security issues were fixed rapidly over this year-long
period; bugs like the standard buffer overflows, protocol
implementation weaknesses, information gathering, and filesystem
races. Hence most of the security problems that we encountered were
fixed before our 2.1 release, and then a far smaller number needed
fixing for our 2.2 release. We do not find as many problems anymore,
it is simply a case of diminishing returns. Recently the security
problems we find and fix tend to be significantly more obscure or
complicated. Still we will persist for a number of reasons:<p>
<ul>
<li>Occasionally we find a simple problem we missed earlier. Doh!
<li>Security is like an arms race; the best attackers will continue
to search for more complicated exploits, so we will too.
<li>Finding and fixing subtle flaws in complicated software is
a lot of fun.
</ul>
The auditing process is not over yet, and as you can see we continue
to find and fix new security flaws.<p>
<a name=25></a>
<p>
<h3><font color=#e00000><strong>OpenBSD 2.5 Security Advisories</strong></font></h3>
These are the OpenBSD 2.5 advisories -- all these problems are solved
in <a href=anoncvs.html>OpenBSD current</a>. Obviously, all the
OpenBSD 2.4 advisories listed below are fixed in OpenBSD 2.5.
<ul>
<li>There are currently no 2.5 advisories.
</ul>
<a name=24></a>
<p>
<h3><font color=#e00000><strong>OpenBSD 2.4 Security Advisories</strong></font></h3>
These are the OpenBSD 2.4 advisories -- all these problems are solved
in <a href=anoncvs.html>OpenBSD current</a>. Obviously, all the
OpenBSD 2.3 advisories listed below are fixed in OpenBSD 2.4.
<ul>
<li><a href=errata24.html#poll>Mar 22, 1999: The nfds argument for poll(2) needs
to be constrained, to avoid kvm starvation (patch included).</a>
<li><a href=errata24.html#tss>Mar 21, 1999: A change in TSS handling stops
another kernel crash case caused by the <strong>crashme</strong>
program (patch included).</a>
<li><a href=errata24.html#nlink>Feb 25, 1999: An unbounded increment on the
nlink value in FFS and EXT2FS filesystems can cause a system crash.
(patch included).</a>
<li><a href=errata24.html#ping>Feb 23, 1999: Yet another buffer overflow
existed in ping(8). (patch included).</a>
<li><a href=errata24.html#ipqrace>Feb 19, 1999: ipintr() had a race in use of
the ipq, which could permit an attacker to cause a crash.
(patch included).</a>
<li><a href=errata24.html#accept>Feb 17, 1999: A race condition in the
kernel between accept(2) and select(2) could permit an attacker
to hang sockets from remote.
(patch included).</a>
<li><a href=errata24.html#maxqueue>Feb 17, 1999: IP fragment assembly can
bog the machine excessively and cause problems.
(patch included).</a>
<li><a href=errata24.html#trctrap>Feb 12, 1999: i386 T_TRCTRAP handling and
DDB interacted to possibly cause a crash.
(patch included).</a>
<li><a href=errata24.html#rst>Feb 11, 1999: TCP/IP RST handling was sloppy.
(patch included).</a>
<li><a href=errata24.html#bootpd>Nov 27, 1998: There is a remotely exploitable
problem in bootpd(8). (patch included).</a>
<li><a href=errata24.html#termcap>Nov 19, 1998: There is a possibly locally
exploitable problem relating to environment variables in termcap
and curses. (patch included).</a>
<li><a href=errata24.html#tcpfix>Nov 13, 1998: There is a remote machine lockup
bug in the TCP decoding kernel. (patch included).</a>
</ul>
<a name=23></a>
<p>
<h3><font color=#e00000><strong>OpenBSD 2.3 Security Advisories</strong></font></h3>
These are the OpenBSD 2.3 advisories -- all these problems are solved
in <a href=anoncvs.html>OpenBSD current</a>. Obviously, all the
OpenBSD 2.2 advisories listed below are fixed in OpenBSD 2.3.
<ul>
<li><a href=errata23.html#bootpd>Nov 27, 1998: There is a remotely exploitable
problem in bootpd(8). (patch included).</a>
<li><a href=errata23.html#tcpfix>Nov 13, 1998: There is a remote machine lockup
bug in the TCP decoding kernel. (patch included).</a>
<li><a href=errata23.html#fdalloc>Jul 2, 1998: setuid and setgid processes
should not be executed with fd slots 0, 1, or 2 free.
(patch included).</a>
<li><a href=errata23.html#resolver>August 31, 1998: A benign looking resolver buffer overflow bug was re-introduced accidentally (patches included).</a>
<li><a href=errata23.html#xlib>June 6, 1998: Further problems with the X
libraries (patches included).</a>
<li><a href=errata23.html#pctr>June 4, 1998: on non-Intel i386 machines, any user
can use pctr(4) to crash the machine.</a>
<li><a href=errata23.html#kill>May 17, 1998: kill(2) of setuid/setgid target
processes too permissive (4th revision patch included).</a>
<li><a href=errata23.html#immutable>May 11, 1998: mmap() permits partial bypassing
of immutable and append-only file flags. (patch included).</a>
<li><a href=errata23.html#xterm-xaw>May 1, 1998: Buffer overflow in xterm and Xaw
(CERT advisory VB-98.04) (patch included).</a>
<li><a href=errata23.html#ipsec>May 5, 1998: Incorrect handling of IPSEC packets
if IPSEC is enabled (patch included).</a>
</ul>
<a name=22></a>
<p>
<h3><font color=#e00000><strong>OpenBSD 2.2 Security Advisories</strong></font></h3>
These are the OpenBSD 2.2 advisories. All these problems are solved
in <a href=23.html>OpenBSD 2.3</a>. Some of these problems
still exist in other operating systems. (The supplied patches are for
OpenBSD 2.2; they may or may not work on OpenBSD 2.1).
<ul>
<li><a href=errata22.html#ipsec>May 5, 1998: Incorrect handling of IPSEC
packets if IPSEC is enabled (patch included).</a>
<li><a href=errata22.html#xterm-xaw>May 1, 1998: Buffer overflow in xterm
and Xaw (CERT advisory VB-98.04) (patch included).</a>
<li><a href=errata22.html#uucpd>Apr 22, 1998: Buffer overflow in uucpd
(patch included).</a>
<li><a href=errata22.html#rmjob>Apr 22, 1998: Buffer mismanagement in lprm
(patch included).</a>
<li><a href=errata22.html#ping>Mar 31, 1998: Overflow in ping -R (patch included).</a>
<li><a href=errata22.html#named>Mar 30, 1998: Overflow in named fake-iquery
(patch included).</a>
<li><a href=errata22.html#mountd>Mar 2, 1998: Accidental NFS filesystem
export (patch included).</a>
<li><a href=advisories/mmap>Feb 26, 1998: Read-write mmap() flaw.</a>
Revision 3 of the patch is available <a href=errata22.html#mmap>here</a>
<li><a href=advisories/sourceroute>Feb 19, 1998: Sourcerouted Packet
Acceptance.</a>
A patch is available <a href=errata22.html#sourceroute>here</a>.
<li><a href=errata22.html#ruserok>Feb 13, 1998: Setuid coredump & Ruserok()
flaw (patch included).</a>
<li><a href=errata22.html#ldso>Feb 9, 1998: MIPS ld.so flaw (patch included).</a>
<li><a href=errata22.html#f00f>Dec 10, 1997: Intel P5 f00f lockup
(patch included).</a>
</ul>
<a name=21></a>
<p>
<h3><font color=#e00000><strong>OpenBSD 2.1 Security Advisories</strong></font></h3>
These are the OpenBSD 2.1 advisories. All these problems are solved
in <a href=22.html>OpenBSD 2.2</a>. Some of these problems still
exist in other operating systems. (If you are running OpenBSD 2.1, we
would strongly recommend an upgrade to the newest release, as this
patch list only attempts at fixing the most important security
problems. In particular, OpenBSD 2.2 fixes numerous localhost
security problems. Many of those problems were solved in ways which
make it hard for us to provide patches).
<ul>
<li><a href=advisories/signals>Sep 15, 1997: Deviant Signals (patch included)</a>
<li><a href=advisories/rfork>Aug 2, 1997: Rfork() system call flaw
(patch included)</a>
<li><a href=advisories/procfs>Jun 24, 1997: Procfs flaws (patch included)</a>
</ul>
<p>
<h3><font color=#e00000><strong>Watching our Security Changes</strong></font></h3>
Since we take a proactive stance with security, we are continually
finding and fixing new security problems. Not all of these problems
get widely reported because (as stated earlier) many of them are not
confirmed to be exploitable; many simple bugs we fix do turn out to
have security consequences we could not predict. We do not have the
time resources to make these changes available in the above format.<p>
Thus there are usually minor security fixes in the current source code
beyond the previous major OpenBSD release. We make a limited
guarantee that these problems are of minimal impact and unproven
exploitability. If we discover that a problem definitely matters for
security, patches will show up here <strong>VERY</strong> quickly.<p>
People who are really concerned with security can do a number of
things:<p>
<ul>
<li>If you understand security issues, watch our
<a href=mail.html>source-changes mailing list</a> and keep an
eye out for things which appear security related. Since
exploitability is not proven for many of the fixes we make,
do not expect the relevant commit message to say "SECURITY FIX!".
If a problem is proven and serious, a patch will be available
here very shortly after.
<li>Track our current source code tree, and teach yourself how to do a
complete system build from time to time (read /usr/src/Makefile
carefully). Users can make the assumption that the current
source tree always has stronger security than the previous release.
However, building your own system from source code is not trivial;
it is nearly 300MB of source code, and problems do occur as we
transition between major releases.
<li>Install a binary <a href=snapshots.html>snapshot</a> for your
architecture, which are made available fairly often. For
instance, an i386 snapshot is typically made available weekly.
</ul>
<p>
<h3><font color=#e00000><strong>Other Resources</strong></font></h3>
Other security advisories that have (in the past) affected OpenBSD can
be found at the <a href=http://www.secnet.com/nav1.html>Secure Networks archive</a>.
Some OpenBSD audit team members worked with Secure Networks on discovering
and solving the problems detailed in some of their security advisories.
<p> If you find a new security problem, you can mail it to
<a href=mailto:deraadt@openbsd.org>deraadt@openbsd.org</a>.
<br>
If you wish to PGP encode it (but please only do so if privacy is very
urgent, since it is inconvenient) use this <a href=advisories/pgpkey>pgp key</a>.
<hr>
<a href=index.html><img height=24 width=24 src=back.gif border=0 alt=OpenBSD></a>
<a href=mailto:www@openbsd.org>www@openbsd.org</a>
<br>
<small>$OpenBSD: security.html,v 1.93 1999/04/18 02:34:01 deraadt Exp $</small>
</body>
</html>
![[BACK]](/icons/back.gif){kind=icon}
Return to security.html CVS log ![[TXT]](/icons/text.gif){kind=icon}
![[DIR]](/icons/dir.gif){kind=icon}
Up to [local] / www