-
Notifications
You must be signed in to change notification settings - Fork 43
/
Copy patherrata39.html
406 lines (372 loc) · 15.9 KB
/
errata39.html
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
<!doctype html>
<html lang=en id=errata>
<meta charset=utf-8>
<title>OpenBSD 3.9 Errata</title>
<meta name="description" content="the OpenBSD CD errata page">
<meta name="viewport" content="width=device-width, initial-scale=1">
<link rel="stylesheet" type="text/css" href="openbsd.css">
<link rel="canonical" href="https://www.openbsd.org/errata39.html">
<!--
IMPORTANT REMINDER
IF YOU ADD A NEW ERRATUM, MAIL THE PATCH TO TECH AND ANNOUNCE
-->
<h2 id=OpenBSD>
<a href="index.html">
<i>Open</i><b>BSD</b></a>
3.9 Errata
</h2>
<hr>
For errata on a certain release, click below:<br>
<a href="errata20.html">2.0</a>,
<a href="errata21.html">2.1</a>,
<a href="errata22.html">2.2</a>,
<a href="errata23.html">2.3</a>,
<a href="errata24.html">2.4</a>,
<a href="errata25.html">2.5</a>,
<a href="errata26.html">2.6</a>,
<a href="errata27.html">2.7</a>,
<a href="errata28.html">2.8</a>,
<a href="errata29.html">2.9</a>,
<a href="errata30.html">3.0</a>,
<a href="errata31.html">3.1</a>,
<a href="errata32.html">3.2</a>,
<a href="errata33.html">3.3</a>,
<a href="errata34.html">3.4</a>,
<a href="errata35.html">3.5</a>,
<br>
<a href="errata36.html">3.6</a>,
<a href="errata37.html">3.7</a>,
<a href="errata38.html">3.8</a>,
<a href="errata40.html">4.0</a>,
<a href="errata41.html">4.1</a>,
<a href="errata42.html">4.2</a>,
<a href="errata43.html">4.3</a>,
<a href="errata44.html">4.4</a>,
<a href="errata45.html">4.5</a>,
<a href="errata46.html">4.6</a>,
<a href="errata47.html">4.7</a>,
<a href="errata48.html">4.8</a>,
<a href="errata49.html">4.9</a>,
<a href="errata50.html">5.0</a>,
<a href="errata51.html">5.1</a>,
<a href="errata52.html">5.2</a>,
<br>
<a href="errata53.html">5.3</a>,
<a href="errata54.html">5.4</a>,
<a href="errata55.html">5.5</a>,
<a href="errata56.html">5.6</a>,
<a href="errata57.html">5.7</a>,
<a href="errata58.html">5.8</a>,
<a href="errata59.html">5.9</a>,
<a href="errata60.html">6.0</a>,
<a href="errata61.html">6.1</a>,
<a href="errata62.html">6.2</a>,
<a href="errata63.html">6.3</a>,
<a href="errata64.html">6.4</a>,
<a href="errata65.html">6.5</a>,
<a href="errata66.html">6.6</a>,
<a href="errata67.html">6.7</a>,
<a href="errata68.html">6.8</a>,
<br>
<a href="errata69.html">6.9</a>,
<a href="errata70.html">7.0</a>,
<a href="errata71.html">7.1</a>,
<a href="errata72.html">7.2</a>,
<a href="errata73.html">7.3</a>,
<a href="errata74.html">7.4</a>,
<a href="errata75.html">7.5</a>,
<a href="errata76.html">7.6</a>,
<a href="errata77.html">7.7</a>.
<hr>
<p>
Patches for the OpenBSD base system are distributed as unified diffs.
Each patch contains usage instructions.
All the following patches are also available in one
<a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.9.tar.gz">tar.gz file</a>
for convenience.
<p>
Patches for supported releases are also incorporated into the
<a href="stable.html">-stable branch</a>.
<hr>
<ul>
<li id="sendmail">
<strong>001: SECURITY FIX: March 25, 2006</strong>
<i>All architectures</i><br>
A race condition has been reported to exist in the handling by sendmail of
asynchronous signals. A remote attacker may be able to execute arbitrary code with the
privileges of the user running sendmail, typically root. This is the second revision of
this patch.
<br>
<a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.9/common/001_sendmail.patch">
A source code patch exists which remedies this problem.</a>
<p>
<li id="xorg">
<strong>002: SECURITY FIX: May 2, 2006</strong>
<i>All architectures</i><br>
A security vulnerability has been found in the X.Org server --
<a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1526">CVE-2006-1526</a>.
Clients authorized to connect to the X server are able to crash it and to execute
malicious code within the X server.
<br>
<a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.9/common/002_xorg.patch">
A source code patch exists which remedies this problem.</a>
<p>
<li id="sendmail2">
<strong>003: SECURITY FIX: June 15, 2006</strong>
<i>All architectures</i><br>
A potential denial of service problem has been found in sendmail. A malformed MIME
message could trigger excessive recursion which will lead to stack exhaustion.
This denial of service attack only affects delivery of mail from the queue and
delivery of a malformed message. Other incoming mail is still accepted and
delivered. However, mail messages in the queue may not be reattempted if a
malformed MIME message exists.
<br>
<a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.9/common/003_sendmail2.patch">
A source code patch exists which remedies this problem.</a>
<p>
<li id="httpd">
<strong>004: SECURITY FIX: July 30, 2006</strong>
<i>All architectures</i><br>
<a href="https://man.openbsd.org/OpenBSD-3.9/httpd.8">httpd(8)</a>'s
mod_rewrite has a potentially exploitable off-by-one buffer overflow.
The buffer overflow may result in a vulnerability which, in combination
with certain types of Rewrite rules in the web server configuration files,
could be triggered remotely. The default install is not affected by the
buffer overflow. CVE-2006-3747
<br>
<a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.9/common/004_httpd.patch">
A source code patch exists which remedies this problem.</a>
<p>
<li id="sendmail3">
<strong>005: SECURITY FIX: August 25, 2006</strong>
<i>All architectures</i><br>
A potential denial of service problem has been found in sendmail. A message
with really long header lines could trigger a use-after-free bug causing
sendmail to crash.
<br>
<a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.9/common/005_sendmail3.patch">
A source code patch exists which remedies this problem.</a>
<p>
<li id="dhcpd">
<strong>006: SECURITY FIX: August 25, 2006</strong>
<i>All architectures</i><br>
Due to an off-by-one error in
<a href="https://man.openbsd.org/OpenBSD-3.9/dhcpd.8">dhcpd(8)</a>,
it is possible to cause
<a href="https://man.openbsd.org/OpenBSD-3.9/dhcpd.8">dhcpd(8)</a>
to exit by sending a DHCPDISCOVER packet with a 32-byte client identifier option.
<a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3122">CVE-2006-3122</a>
<br>
<a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.9/common/006_dhcpd.patch">
A source code patch exists which remedies this problem.</a>
<p>
<li id="sem">
<strong>007: SECURITY FIX: August 25, 2006</strong>
<i>All architectures</i><br>
It is possible to cause the kernel to panic when more than the default number of
semaphores have been allocated.
<br>
<a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.9/common/007_sem.patch">
A source code patch exists which remedies this problem.</a>
<p>
<li id="isakmpd">
<strong>008: SECURITY FIX: August 25, 2006</strong>
<i>All architectures</i><br>
A problem in
<a href="https://man.openbsd.org/OpenBSD-3.9/isakmpd.8">isakmpd(8)</a>
caused IPsec to run partly without replay protection. If
<a href="https://man.openbsd.org/OpenBSD-3.9/isakmpd.8">isakmpd(8)</a>
was acting as responder during SA negotiation, SA's with a replay window of size 0 were created.
An attacker could reinject sniffed IPsec packets, which will be accepted without checking the
replay counter.
<br>
<a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.9/common/008_isakmpd.patch">
A source code patch exists which remedies this problem.</a>
<p>
<li id="sppp">
<strong>009: SECURITY FIX: September 2, 2006</strong>
<i>All architectures</i><br>
Due to the failure to correctly validate LCP configuration option lengths,
it is possible for an attacker to send LCP packets via an
<a href="https://man.openbsd.org/OpenBSD-3.9/sppp.4">sppp(4)</a>
connection causing the kernel to panic.
<a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4304">CVE-2006-4304</a>
<br>
<a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.9/common/009_sppp.patch">
A source code patch exists which remedies this problem.</a>
<p>
<li id="bind">
<strong>010: SECURITY FIX: September 8, 2006</strong>
<i>All architectures</i><br>
Two Denial of Service issues have been found with BIND.
An attacker who can perform recursive lookups on a DNS server and is able
to send a sufficiently large number of recursive queries, or is able to
get the DNS server to return more than one SIG(covered) RRsets can stop
the functionality of the DNS service.
An attacker querying an authoritative DNS server serving a RFC 2535
DNSSEC zone may be able to crash the DNS server.
<a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4095">CVE-2006-4095</a>
<a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4096">CVE-2006-4096</a>
<br>
<a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.9/common/010_bind.patch">
A source code patch exists which remedies this problem.</a>
<p>
<li id="openssl">
<strong>011: SECURITY FIX: September 8, 2006</strong>
<i>All architectures</i><br>
Due to incorrect PKCS#1 v1.5 padding validation in OpenSSL, it is possible for
an attacker to construct an invalid signature which OpenSSL would accept as a
valid PKCS#1 v1.5 signature.
<a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4339">CVE-2006-4339</a>
<br>
<a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.9/common/011_openssl.patch">
A source code patch exists which remedies this problem.</a>
<p>
<li id="httpd2">
<strong>012: SECURITY FIX: October 7, 2006</strong>
<i>All architectures</i><br>
<a href="https://man.openbsd.org/OpenBSD-3.9/httpd.8">httpd(8)</a>
does not sanitize the Expect header from an HTTP request when it is
reflected back in an error message, which might allow cross-site scripting (XSS)
style attacks.
<a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3918">CVE-2006-3918</a>
<br>
<a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.9/common/012_httpd2.patch">
A source code patch exists which remedies this problem.</a>
<p>
<li id="openssl2">
<strong>013: SECURITY FIX: October 7, 2006</strong>
<i>All architectures</i><br>
Several problems have been found in OpenSSL. While parsing certain invalid ASN.1
structures an error condition is mishandled, possibly resulting in an infinite
loop. A buffer overflow exists in the SSL_get_shared_ciphers function. A NULL
pointer may be dereferenced in the SSL version 2 client code. In addition, many
applications using OpenSSL do not perform any validation of the lengths of
public keys being used.
<a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2937">CVE-2006-2937</a>,
<a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3738">CVE-2006-3738</a>,
<a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4343">CVE-2006-4343</a>,
<a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2940">CVE-2006-2940</a>
<br>
<a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.9/common/013_openssl2.patch">
A source code patch exists which remedies this problem.</a>
<p>
<li id="systrace">
<strong>014: SECURITY FIX: October 7, 2006</strong>
<i>All architectures</i><br>
Fix for an integer overflow in
<a href="https://man.openbsd.org/OpenBSD-3.9/systrace.4">systrace(4)</a>'s
STRIOCREPLACE support, found by
Chris Evans. This could be exploited for DoS, limited kmem reads or local
privilege escalation.
<br>
<a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.9/common/014_systrace.patch">
A source code patch exists which remedies this problem.</a>
<p>
<li id="ssh">
<strong>015: SECURITY FIX: October 12, 2006</strong>
<i>All architectures</i><br>
Fix 2 security bugs found in OpenSSH. A pre-authentication denial of service (found
by Tavis Ormandy) that would cause
<a href="https://man.openbsd.org/OpenBSD-3.9/sshd.8">sshd(8)</a>
to spin until the login grace time expired.
An unsafe signal handler (found by Mark Dowd) that is vulnerable to a race condition
that could be exploited to perform a pre-authentication denial of service.
<a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4924">CVE-2006-4924</a>,
<a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-5051">CVE-2006-5051</a>
<br>
<a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.9/common/015_ssh.patch">
A source code patch exists which remedies this problem.</a>
<p>
<li id="ldso">
<strong>016: SECURITY FIX: November 19, 2006</strong>
<i>All architectures</i><br>
The ELF
<a href="https://man.openbsd.org/OpenBSD-3.9/ld.so.1">ld.so(1)</a>
fails to properly sanitize the environment. There is a potential localhost security
problem in cases we have not found yet. This patch applies to all ELF-based
systems (m68k, m88k, and vax are a.out-based systems).
<br>
<a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.9/common/016_ldso.patch">
A source code patch exists which remedies this problem.</a>
<p>
<li id="agp">
<strong>017: SECURITY FIX: January 3, 2007</strong>
<i>i386 only</i><br>
Insufficient validation in
<a href="https://man.openbsd.org/OpenBSD-3.9/vga.4">vga(4)</a>
may allow an attacker to gain root privileges if the kernel is compiled with
<code>option PCIAGP</code>
and the actual device is not an AGP device.
The <code>PCIAGP</code> option is present by default on i386
kernels only.
<br>
<a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.9/i386/017_agp.patch">
A source code patch exists which remedies this problem.</a>
<p>
<li id="icmp6">
<strong>018: RELIABILITY FIX: January 16, 2007</strong>
<i>All architectures</i><br>
Under some circumstances, processing an ICMP6 echo request would cause
the kernel to enter an infinite loop.
<br>
<a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.9/common/018_icmp6.patch">
A source code patch exists which remedies this problem.</a>
<p>
<li id="timezone">
<strong>019: INTEROPERABILITY FIX: February 4, 2007</strong>
<i>All architectures</i><br>
A US daylight saving time rules change takes effect in 2007.
<br>
<a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.9/common/019_timezone.patch">
A source code patch exists which syncs the timezone data files with tzdata2007a</a>.<br>
<p>
<li id="m_dup1">
<strong>020: SECURITY FIX: March 7, 2007</strong>
<i>All architectures</i><br>
<b>2nd revision, March 17, 2007</b><br>
Incorrect mbuf handling for ICMP6 packets.<br>
Using
<a href="https://man.openbsd.org/OpenBSD-3.9/pf.4">pf(4)</a>
to avoid the problem packets is an effective workaround until the patch
can be installed.<br>
Use "block in inet6" in /etc/pf.conf
<br>
<a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.9/common/020_m_dup1.patch">
A source code patch exists which remedies this problem.</a>
<p>
<li id="p021_xorg">
<strong>021: SECURITY FIX: April 4, 2007</strong>
<i>All architectures</i><br>
Multiple vulnerabilities have been discovered in X.Org.<br>
XC-MISC extension ProcXCMiscGetXIDList memory corruption vulnerability,
BDFFont parsing integer overflow vulnerability,
fonts.dir file parsing integer overflow vulnerability,
multiple integer overflows in the XGetPixel() and XInitImage functions
in ImUtil.c.
<a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1003">CVE-2007-1003</a>,
<a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1351">CVE-2007-1351</a>,
<a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1352">CVE-2007-1352</a>,
<a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1667">CVE-2007-1667</a>.
<br>
<a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.9/common/021_xorg.patch">
A source code patch exists which remedies this problem.</a>
<p>
<li id="p022_route6">
<strong>022: SECURITY FIX: April 23, 2007</strong>
<i>All architectures</i><br>
IPv6 type 0 route headers can be used to mount a DoS attack against
hosts and networks. This is a design flaw in IPv6 and not a bug in
OpenBSD.<br>
<a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.9/common/022_route6.patch">
A source code patch exists which remedies this problem.</a>
<p>
<li id="p023_altivec">
<strong>023: STABILITY FIX: April 26, 2007</strong>
<i>PowerPC</i><br>
An unhandled AltiVec assist exception can cause a kernel panic.<br>
<a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.9/macppc/023_altivec.patch">
A source code patch exists which remedies this problem.</a>
<p>
</ul>
<hr>