This is the OpenBSD 2.8 release errata & patch list:

The patches below are available in CVS via the OPENBSD_2_8 patch branch.

For more detailed information on install patches to OpenBSD, please consult the OpenBSD FAQ.

All architectures

• 017: SECURITY FIX: Jan 22, 2001
  The rnd(4) device does not use all of its input when data is written to it.
  A source code patch exists which remedies the problem.
  

• 016: RELIABILITY FIX: Jan 4, 2001
  Allow ThunderLAN cards to share interrupts nicely.
  A source code patch exists which remedies the problem.

• 014: SECURITY FIX: Dec 22, 2000
  Improve xlock(1)'s authentication by authenticating via a pipe in an early forked process. No known vulnerability exists, this is just a precautionary patch.
  A source code patch exists which remedies the problem.

  In addition to a source code patch, new xlock binaries have been created for each architecture listed below. Place these binaries at /usr/X11R6/bin/xlock and chmod 4755 /usr/X11R6/bin/xlock.

  • Xlock - i386
  • Xlock - sparc
  • Xlock - mac68k
  • Xlock - powerpc
  • Xlock - amiga
  • Xlock - hp300
  • Xlock - mvme68k

• 013: SECURITY FIX: Dec 18, 2000
  Procfs contained numerous overflows, which could lead an intruder to root permissions. Procfs is NOT enabled by default in OpenBSD.
  A source code patch exists which remedies the problem.

• 011: RELIABILITY FIX: Dec 13, 2000
  The crypto subsystem could incorrectly fail to run certain software ciphers, if a hardware card existed in the machine.
  A source code patch exists which remedies the problem.

• 010: RELIABILITY FIX: Dec 11, 2000
  A crash could occur during fast routing, if IPSEC was enabled.
  A source code patch exists which remedies the problem.

• 009: SECURITY FIX: Dec 10, 2000
  Another problem exists in the Kerberos libraries.
  A source code patch exists which remedies the problem.

• 008: SECURITY FIX: Dec 7, 2000
  Two problems have recently been discovered in the KerberosIV code.

  1. A symlink problem was discovered in the KerberosIV password checking routines /usr/bin/su and /usr/bin/login, which makes it possible for a local user to overwrite any file on the local machine.

  2. It is possible to specify environment variables in telnet which will be passed over the to the remote host. This makes it possible to set environment variables on the remote side, including ones that have special meaning on the server. It is not clear at this time what the impact is, but we recommend everyone to upgrade their machines immediately.

  A source code patch exists which remedies the problem.

• 005: SECURITY FIX: Dec 4, 2000
  OpenBSD 2.8's ftpd contains a one-byte overflow in the replydirname() function.
  A source code patch exists which remedies the problem.
  You can view the OpenBSD Advisory here.

• 004: RELIABILITY FIX: Nov 17, 2000
  First off, AES (rijndael) encryption and decryption were broken for IPSec and swap encryption.
  Secondly, the AES code did not work properly on big endian machines.
  A second revision source code patch exists which remedies the problem.

• 002: IMPLEMENTATION FIX: Nov 10, 2000
  In ssh(1), skey support for SSH1 protocol was broken. Some people might consider that kind of important.
  A source code patch exists which remedies this problem.

i386

• 015: STABILITY FIX: Dec 22, 2000
  Some machines locked up while trying to use the mouse in console mode. This patch solves that problem.
  A source code patch exists which remedies this problem.

• 006: STABILITY FIX: Dec 4, 2000
  On some machines, a PCIBIOS device driver interrupt allocation bug can cause a kernel hang while probing PCI devices. If you have this symptom, you can disable PCIBIOS as a workaround. To do this,
  • Enter the User Kernel Configuration by booting with the option "boot -c".
  • Once at the UKC> prompt, enter

    
    	UKC> disable pcibios
    	UKC> quit
        

  • See FAQ 5.6 after a successful boot for instructions on how to re-write your kernel to disable PCIBIOS permanently.

mac68k

• 007: INSTALL PROBLEM: Dec 4, 2000
  The X packages share28.tgz and font28.tgz were not on the CD, and only available via FTP install. These packages can be added post-install by using the following command:

      # cd /; tar xvfpz xshare28.tgz
      # cd /; tar xvfpz xfont28.tgz
      

sparc

• 007: INSTALL PROBLEM: Dec 4, 2000
  The X packages share28.tgz and font28.tgz were not on the CD, and only available via FTP install. These packages can be added post-install by using the following command:

      # cd /; tar xvfpz xshare28.tgz
      # cd /; tar xvfpz xfont28.tgz
      

• 003: RELIABILITY FIX: Nov 17, 2000
  Configuring a qec+qe causes a NMI panic.
  A source code patch exists which remedies this problem.

• 001: RELIABILITY FIX: Nov 10, 2000
  When running a sparc with a serial console, certain types of interrupts would cause great grief.
  A source code patch exists which remedies this problem.

amiga

• 007: INSTALL PROBLEM: Dec 4, 2000
  The X packages share28.tgz and font28.tgz were not on the CD, and only available via FTP install. These packages can be added post-install by using the following command:

      # cd /; tar xvfpz xshare28.tgz
      # cd /; tar xvfpz xfont28.tgz
      

pmax

• No problems identified yet.

hp300

• 007: INSTALL PROBLEM: Dec 4, 2000
  The X packages share28.tgz and font28.tgz were not on the CD, and only available via FTP install. These packages can be added post-install by using the following command:

      # cd /; tar xvfpz xshare28.tgz
      # cd /; tar xvfpz xfont28.tgz
      

mvme68k

• 007: INSTALL PROBLEM: Dec 4, 2000
  The X packages share28.tgz and font28.tgz were not on the CD, and only available via FTP install. These packages can be added post-install by using the following command:

      # cd /; tar xvfpz xshare28.tgz
      # cd /; tar xvfpz xfont28.tgz
      

powerpc

• 012: INSTALL PROBLEM: Dec 14, 2000
  The IMac DV+ (and probably some other machines) incorrectly identify their video hardware, but it is possible to work around the problem.
  A source code patch exists which remedies the problem.

vax

• No problems identified yet.

sun3

• 007: INSTALL PROBLEM: Dec 4, 2000
  The X packages share28.tgz and font28.tgz were not on the CD, and only available via FTP install. These packages can be added post-install by using the following command:

      # cd /; tar xvfpz xshare28.tgz
      # cd /; tar xvfpz xfont28.tgz