forked from openbsd/www
-
Notifications
You must be signed in to change notification settings - Fork 0
/
errata31.html
381 lines (343 loc) · 14.6 KB
/
errata31.html
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
<!doctype html>
<html lang=en id=errata>
<meta charset=utf-8>
<title>OpenBSD 3.1 Errata</title>
<meta name="description" content="the OpenBSD CD errata page">
<meta name="viewport" content="width=device-width, initial-scale=1">
<link rel="stylesheet" type="text/css" href="openbsd.css">
<link rel="canonical" href="https://www.openbsd.org/errata31.html">
<!--
IMPORTANT REMINDER
IF YOU ADD A NEW ERRATUM, MAIL THE PATCH TO TECH AND ANNOUNCE
-->
<h2 id=OpenBSD>
<a href="index.html">
<i>Open</i><b>BSD</b></a>
3.1 Errata
</h2>
<hr>
For errata on a certain release, click below:<br>
<a href="errata20.html">2.0</a>,
<a href="errata21.html">2.1</a>,
<a href="errata22.html">2.2</a>,
<a href="errata23.html">2.3</a>,
<a href="errata24.html">2.4</a>,
<a href="errata25.html">2.5</a>,
<a href="errata26.html">2.6</a>,
<a href="errata27.html">2.7</a>,
<a href="errata28.html">2.8</a>,
<a href="errata29.html">2.9</a>,
<a href="errata30.html">3.0</a>,
<a href="errata32.html">3.2</a>,
<a href="errata33.html">3.3</a>,
<a href="errata34.html">3.4</a>,
<a href="errata35.html">3.5</a>,
<a href="errata36.html">3.6</a>,
<br>
<a href="errata37.html">3.7</a>,
<a href="errata38.html">3.8</a>,
<a href="errata39.html">3.9</a>,
<a href="errata40.html">4.0</a>,
<a href="errata41.html">4.1</a>,
<a href="errata42.html">4.2</a>,
<a href="errata43.html">4.3</a>,
<a href="errata44.html">4.4</a>,
<a href="errata45.html">4.5</a>,
<a href="errata46.html">4.6</a>,
<a href="errata47.html">4.7</a>,
<a href="errata48.html">4.8</a>,
<a href="errata49.html">4.9</a>,
<a href="errata50.html">5.0</a>,
<a href="errata51.html">5.1</a>,
<a href="errata52.html">5.2</a>,
<br>
<a href="errata53.html">5.3</a>,
<a href="errata54.html">5.4</a>,
<a href="errata55.html">5.5</a>,
<a href="errata56.html">5.6</a>,
<a href="errata57.html">5.7</a>,
<a href="errata58.html">5.8</a>,
<a href="errata59.html">5.9</a>,
<a href="errata60.html">6.0</a>,
<a href="errata61.html">6.1</a>,
<a href="errata62.html">6.2</a>,
<a href="errata63.html">6.3</a>,
<a href="errata64.html">6.4</a>,
<a href="errata65.html">6.5</a>,
<a href="errata66.html">6.6</a>,
<a href="errata67.html">6.7</a>,
<a href="errata68.html">6.8</a>,
<br>
<a href="errata69.html">6.9</a>,
<a href="errata70.html">7.0</a>.
<hr>
<p>
Patches for the OpenBSD base system are distributed as unified diffs.
Each patch contains usage instructions.
All the following patches are also available in one
<a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.1.tar.gz">tar.gz file</a>
for convenience.
<p>
Patches for supported releases are also incorporated into the
<a href="stable.html">-stable branch</a>.
<hr>
<ul>
<li id="sshafs">
<strong>001: SECURITY FIX: April 22, 2002</strong>
<i>All architectures</i><br>
A local user can gain super-user privileges due to a buffer overflow
in <a href="https://man.openbsd.org/OpenBSD-3.1/sshd.8">sshd(8)</a>
if AFS has been configured on the system or if
KerberosTgtPassing or AFSTokenPassing has been enabled
in the sshd_config file. Ticket and token passing is not enabled
by default.<br>
<a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.1/common/001_sshafs.patch">
A source code patch exists which remedies this problem.</a>
<p>
<li id="sudo">
<strong>002: SECURITY FIX: April 25, 2002</strong>
<i>All architectures</i><br>
A bug in <a href="https://man.openbsd.org/OpenBSD-3.1/sudo.8">sudo(8)</a> may allow an attacker to corrupt the heap by specifying a custom prompt.<br>
<a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.1/common/002_sudo.patch">
A source code patch exists which remedies this problem.</a>
<p>
<li id="fdalloc2">
<strong>003: SECURITY FIX: May 8, 2002</strong>
<i>All architectures</i><br>
A race condition exists where an attacker could fill the file descriptor
table and defeat the kernel's protection of fd slots 0, 1, and 2 for a
setuid or setgid process.<br>
<a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.1/common/003_fdalloc2.patch">
A source code patch exists which remedies this problem.</a>
<p>
<li id="sshbsdauth">
<strong>004: SECURITY FIX: May 22, 2002</strong>
<i>All architectures</i><br>
Under certain conditions, on systems using YP with netgroups in the
password database, it is possible that
<a href="https://man.openbsd.org/OpenBSD-3.1/sshd.8">sshd(8)</a>
does ACL checks for the requested user name but uses the password
database entry of a different user for authentication. This means
that denied users might authenticate successfully while permitted
users could be locked out.<br>
<a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.1/common/004_sshbsdauth.patch">
A source code patch exists which remedies this problem.</a>
<p>
<li id="httpd">
<strong>005: SECURITY FIX: June 19, 2002</strong>
<i>All architectures</i><br>
A buffer overflow can occur during the interpretation of chunked
encoding in the http daemon, leading to possible remote crash or exploit.<br>
<a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.1/common/005_httpd.patch">
A source code patch exists which remedies this problem.</a>
<p>
<li id="sshd">
<strong>006: SECURITY FIX: June 24, 2002</strong>
<i>All architectures</i><br>
All versions of OpenSSH's sshd between 2.3.1 and 3.3 contain an input validation
error that can result in an integer overflow and privilege escalation.
This problem is fixed in <a href="https://www.openssh.com/openbsd.html">OpenSSH
3.4</a>, and a patch for the vulnerable releases is available as part of the
<a href="https://www.openssh.com/txt/preauth.adv">security advisory</a>.
<p>
<li id="resolver">
<strong>007: SECURITY FIX: June 25, 2002</strong>
<i>All architectures</i><br>
A potential buffer overflow in the DNS resolver has been found.<br>
<a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.1/common/007_resolver.patch">
A source code patch exists which remedies this problem.</a>
<p>
<li id="modssl">
<strong>008: SECURITY FIX: June 26, 2002</strong>
<i>All architectures</i><br>
A buffer overflow can occur in the .htaccess parsing code in mod_ssl httpd
module, leading to possible remote crash or exploit.<br>
<a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.1/common/008_mod_ssl.patch">
A source code patch exists which remedies this problem.</a>
<p>
<li id="ktrace">
<strong>009: SECURITY FIX: June 27, 2002</strong>
<i>All architectures</i><br>
The kernel would let any user <a href="https://man.openbsd.org/OpenBSD-3.1/ktrace.2">ktrace(2)</a> set[ug]id processes.<br>
<a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.1/common/009_ktrace.patch">
A source code patch exists which remedies this problem.</a>
<p>
<li id="isakmpd">
<strong>010: RELIABILITY FIX: July 5, 2002</strong>
<i>All architectures</i><br>
Receiving IKE payloads out of sequence can cause
<a href="https://man.openbsd.org/OpenBSD-3.1/isakmpd.8">isakmpd(8)</a> to crash.<br>
<a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.1/common/010_isakmpd.patch">
A source code patch exists which remedies this problem.</a>
<br>
This is the second version of the patch.
<p>
<li id="pppd">
<strong>011: SECURITY FIX: July 29, 2002</strong>
<i>All architectures</i><br>
A race condition exists in the
<a href="https://man.openbsd.org/OpenBSD-3.1/pppd.8">pppd(8)</a>
daemon which may cause it to alter the file permissions of an arbitrary file.<br>
<a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.1/common/011_pppd.patch">
A source code patch exists which remedies this problem.</a>
<p>
<li id="xdr">
<strong>012: SECURITY FIX: July 29, 2002</strong>
<i>All architectures</i><br>
A buffer overflow can occur in the
<a href="https://man.openbsd.org/OpenBSD-3.1/xdr_array.3">xdr_array(3)</a>
RPC code, leading to possible remote crash.<br>
<a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.1/common/012_xdr.patch">
A source code patch exists which remedies this problem.</a>
<br>
This is the second version of the patch.
<p>
<li id="ssl">
<strong>013: SECURITY FIX: July 30, 2002</strong>
<i>All architectures</i><br>
Several remote buffer overflows can occur in the SSL2 server and SSL3 client of the
<a href="https://man.openbsd.org/OpenBSD-3.1/ssl.8">ssl(8)</a>
library, as in the ASN.1 parser code in the
<a href="https://man.openbsd.org/OpenBSD-3.1/crypto.3">crypto(3)</a>
library, all of them being potentially remotely exploitable.<br>
<a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.1/common/013_ssl.patch">
A source code patch exists which remedies this problem.</a>
<br>
This is the second version of the patch.
<p>
<li id="scarg">
<strong>014: SECURITY FIX: August 11, 2002</strong>
<i>All architectures</i><br>
An insufficient boundary check in the
<a href="https://man.openbsd.org/OpenBSD-3.1/select.2">select(2)</a>
system call allows an attacker to overwrite kernel memory and execute arbitrary
code in kernel context.<br>
<a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.1/common/014_scarg.patch">
A source code patch exists which remedies this problem.</a>
For more details, see the <a href="advisories/select.txt">OpenBSD advisory</a>.
<p>
<li id="kerntime">
<strong>015: SECURITY FIX: October 2, 2002</strong>
<i>All architectures</i><br>
Incorrect argument checking in the
<a href="https://man.openbsd.org/OpenBSD-3.1/setitimer.2">setitimer(2)</a> system call may allow an attacker to write to kernel memory.<br>
<a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.1/common/015_kerntime.patch">
A source code patch exists which remedies this problem.</a>
<p>
<li id="kadmin">
<strong>016: SECURITY FIX: October 21, 2002</strong>
<i>All architectures</i><br>
A buffer overflow can occur in the
<a href="https://man.openbsd.org/OpenBSD-3.1/kadmind.8">kadmind(8)</a>
daemon, leading to possible remote crash or exploit.<br>
<a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.1/common/016_kadmin.patch">
A source code patch exists which remedies this problem.</a>
<p>
<li id="smrsh">
<strong>017: SECURITY FIX: November 6, 2002</strong>
<i>All architectures</i><br>
An attacker can bypass the restrictions imposed by sendmail's restricted shell,
<a href="https://man.openbsd.org/OpenBSD-3.1/smrsh.8">smrsh(8)</a>,
and execute arbitrary commands with the privileges of his own account.<br>
<a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.1/common/017_smrsh.patch">
A source code patch exists which remedies this problem.</a>
<p>
<li id="kernresource">
<strong>018: SECURITY FIX: November 6, 2002</strong>
<i>All architectures</i><br>
Incorrect argument checking in the
<a href="https://man.openbsd.org/OpenBSD-3.1/getrlimit.2">getrlimit(2)</a>
system call may allow an attacker to crash the kernel.<br>
<a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.1/common/018_kernresource.patch">
A source code patch exists which remedies this problem.</a>
<p>
<li id="named">
<strong>019: SECURITY FIX: November 14, 2002</strong>
<i>All architectures</i><br>
A buffer overflow in
<a href="https://man.openbsd.org/OpenBSD-3.1/named.8">named(8)</a>
could allow an attacker to execute code with the privileges of named.
On OpenBSD, named runs as a non-root user in a chrooted environment
which mitigates the effects of this bug.<br>
<a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.1/common/019_named.patch">
A source code patch exists which remedies this problem.</a>
<p>
<li id="cvs">
<strong>020: SECURITY FIX: January 20, 2003</strong>
<i>All architectures</i><br>
A double free in
<a href="https://man.openbsd.org/OpenBSD-3.1/cvs.1">cvs(1)</a>
could allow an attacker to execute code with the privileges of the
user running cvs. This is only an issue when the cvs command is
being run on a user's behalf as a different user. This means that,
in most cases, the issue only exists for cvs configurations that use
the <em>pserver</em> client/server connection method.<br>
<a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.1/common/020_cvs.patch">
A source code patch exists which remedies this problem.</a>
<p>
<li id="ssl2">
<strong>021: SECURITY FIX: February 23, 2003</strong>
<i>All architectures</i><br>
In
<a href="https://man.openbsd.org/OpenBSD-3.1/ssl.8">ssl(8)</a> an information leak can occur via timing by performing a MAC computation
even if incorrect block cipher padding has been found, this is a
countermeasure. Also, check for negative sizes in memory allocation routines.<br>
<a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.1/common/021_ssl.patch">
A source code patch exists which fixes these two issues</a>.
<p>
<li id="sendmail">
<strong>022: SECURITY FIX: March 3, 2003</strong>
<i>All architectures</i><br>
A buffer overflow in the envelope comments processing in
<a href="https://man.openbsd.org/OpenBSD-3.1/sendmail.8">sendmail(8)</a>
may allow an attacker to gain root privileges.<br>
<a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.1/common/022_sendmail.patch">
A source code patch exists which remedies this problem.</a>
<p>
<li id="lprm">
<strong>023: SECURITY FIX: March 5, 2003</strong>
<i>All architectures</i><br>
A fix for an
<a href="https://man.openbsd.org/OpenBSD-3.1/lprm.1">lprm(1)</a>
bug made in 1996 contains an error that could lead to privilege escalation.
<br>
<a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.1/common/023_lprm.patch">
A source code patch exists which remedies this problem.</a>
<p>
<li id="blinding">
<strong>024: SECURITY FIX: March 18, 2003</strong>
<i>All architectures</i><br>
Various SSL and TLS operations in OpenSSL are vulnerable to timing attacks.
<br>
<a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.1/common/024_blinding.patch">
A source code patch exists which remedies this problem.</a>
<p>
<li id="kpr">
<strong>025: SECURITY FIX: March 19, 2003</strong>
<i>All architectures</i><br>
OpenSSL is vulnerable to an extension of the "Bleichenbacher" attack designed
by Czech researchers Klima, Pokorny and Rosa.
<br>
<a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.1/common/025_kpr.patch">
A source code patch exists which remedies this problem.</a>
<p>
<li id="kerberos">
<strong>026: SECURITY FIX: March 24, 2003</strong>
<i>All architectures</i><br>
The cryptographic weaknesses in the Kerberos v4 protocol can be exploited
on Kerberos v5 as well.
<br>
<a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.1/common/026_kerberos.patch">
A source code patch exists which remedies this problem.</a>
<p>
<li id="sendmail2">
<strong>027: SECURITY FIX: March 31, 2003</strong>
<i>All architectures</i><br>
A buffer overflow in the address parsing in
<a href="https://man.openbsd.org/OpenBSD-3.1/sendmail.8">sendmail(8)</a>
may allow an attacker to gain root privileges.<br>
<a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.1/common/027_sendmail.patch">
A source code patch exists which remedies this problem.</a>
<p>
</ul>
<hr>