errata42.html

<!doctype html>
<html lang=en id=errata>
<meta charset=utf-8>

<title>OpenBSD 4.2 Errata</title>
<meta name="description" content="the OpenBSD CD errata page">
<meta name="viewport" content="width=device-width, initial-scale=1">
<link rel="stylesheet" type="text/css" href="openbsd.css">
<link rel="canonical" href="https://www.openbsd.org/errata42.html">

<!--
			IMPORTANT REMINDER
	IF YOU ADD A NEW ERRATUM, MAIL THE PATCH TO TECH AND ANNOUNCE
-->


<h2 id=OpenBSD>
<a href="index.html">
<i>Open</i><b>BSD</b></a>
4.2 Errata
</h2>
<hr>

For errata on a certain release, click below:<br>
<a href="errata20.html">2.0</a>,
<a href="errata21.html">2.1</a>,
<a href="errata22.html">2.2</a>,
<a href="errata23.html">2.3</a>,
<a href="errata24.html">2.4</a>,
<a href="errata25.html">2.5</a>,
<a href="errata26.html">2.6</a>,
<a href="errata27.html">2.7</a>,
<a href="errata28.html">2.8</a>,
<a href="errata29.html">2.9</a>,
<a href="errata30.html">3.0</a>,
<a href="errata31.html">3.1</a>,
<a href="errata32.html">3.2</a>,
<a href="errata33.html">3.3</a>,
<a href="errata34.html">3.4</a>,
<a href="errata35.html">3.5</a>,
<br>
<a href="errata36.html">3.6</a>,
<a href="errata37.html">3.7</a>,
<a href="errata38.html">3.8</a>,
<a href="errata39.html">3.9</a>,
<a href="errata40.html">4.0</a>,
<a href="errata41.html">4.1</a>,
<a href="errata43.html">4.3</a>,
<a href="errata44.html">4.4</a>,
<a href="errata45.html">4.5</a>,
<a href="errata46.html">4.6</a>,
<a href="errata47.html">4.7</a>,
<a href="errata48.html">4.8</a>,
<a href="errata49.html">4.9</a>,
<a href="errata50.html">5.0</a>,
<a href="errata51.html">5.1</a>,
<a href="errata52.html">5.2</a>,
<br>
<a href="errata53.html">5.3</a>,
<a href="errata54.html">5.4</a>,
<a href="errata55.html">5.5</a>,
<a href="errata56.html">5.6</a>,
<a href="errata57.html">5.7</a>,
<a href="errata58.html">5.8</a>,
<a href="errata59.html">5.9</a>,
<a href="errata60.html">6.0</a>,
<a href="errata61.html">6.1</a>,
<a href="errata62.html">6.2</a>,
<a href="errata63.html">6.3</a>,
<a href="errata64.html">6.4</a>,
<a href="errata65.html">6.5</a>,
<a href="errata66.html">6.6</a>,
<a href="errata67.html">6.7</a>,
<a href="errata68.html">6.8</a>,
<br>
<a href="errata69.html">6.9</a>,
<a href="errata70.html">7.0</a>,
<a href="errata71.html">7.1</a>,
<a href="errata72.html">7.2</a>,
<a href="errata73.html">7.3</a>,
<a href="errata74.html">7.4</a>,
<a href="errata75.html">7.5</a>,
<a href="errata76.html">7.6</a>,
<a href="errata77.html">7.7</a>.
<hr>

<p>
Patches for the OpenBSD base system are distributed as unified diffs.
Each patch contains usage instructions.
All the following patches are also available in one
<a href="https://ftp.openbsd.org/pub/OpenBSD/patches/4.2.tar.gz">tar.gz file</a>
for convenience.

<p>
Patches for supported releases are also incorporated into the
<a href="stable.html">-stable branch</a>.

<hr>

<ul>

<li id="p001_dhcpd">
<strong>001: SECURITY FIX: October 8, 2007</strong>
&nbsp; <i>All architectures</i><br>
Malicious DHCP clients could cause dhcpd(8) to corrupt its stack<br>
A DHCP client that claimed to require a maximum message size less than
the minimum IP MTU could cause dhcpd(8) to overwrite stack memory.
<br>
<a href="https://ftp.openbsd.org/pub/OpenBSD/patches/4.2/common/001_dhcpd.patch">
A source code patch exists which remedies this problem.</a>
<p>
<li id="p002_openssl">
<strong>002: SECURITY FIX: October 10, 2007</strong>
&nbsp; <i>All architectures</i><br>
The SSL_get_shared_ciphers() function in OpenSSL contains an off-by-one overflow.<br>
<a href="https://ftp.openbsd.org/pub/OpenBSD/patches/4.2/common/002_openssl.patch">
A source code patch exists which remedies this problem.</a>
<p>

<li id="p003_i386_boot">
<strong>003: CD BOOT FAILURE ON OLDER COMPUTERS : October 30, 2007</strong>
&nbsp; <i>i386 only</i><br>
Some older BIOSes are unable to boot CD1 (ie. the commercial release sold
by the project, not the CD images available on the net).
A workaround using CD2 (amd64 architecture) is as follows.
(An amd64 machine is <i>NOT</i> required for this to work.)<br>
<br>

<ol>
<li>Insert CD2 and tell your computer to boot it;<br>
<li>When the <code>boot></code> prompt appears, stop the automatic boot
by pressing the space bar;<br>
<li>Remove CD2 and insert CD1;<br>
<li>Erase the character you typed to stop the boot, type<br>
<code><b>boot /4.2/i386/bsd.rd</b></code><br>
then press <i>Enter</i>.
</ol>
<p>

<li id="p004_pf">
<strong>004: RELIABILITY FIX: November 27, 2007</strong>
&nbsp; <i>All architectures</i><br>
A memory leak in pf can lead to machine lockups.<br>
<a href="https://ftp.openbsd.org/pub/OpenBSD/patches/4.2/common/004_pf.patch">
A source code patch exists which remedies this problem.</a>
<p>

<li id="p005_ifrtlabel">
<strong>005: RELIABILITY FIX: January 11, 2008</strong>
&nbsp; <i>All architectures</i><br>
A missing NULL pointer check can lead to a kernel panic.<br>
<a href="https://ftp.openbsd.org/pub/OpenBSD/patches/4.2/common/005_ifrtlabel.patch">
A source code patch exists which remedies this problem.</a>
<p>

<li id="p006_xorg">
<strong>006: SECURITY FIX: February 8, 2008</strong>
&nbsp; <i>All architectures</i><br>
<b>2nd revision, February 10, 2008</b><br>
Multiple vulnerabilities have been discovered in X.Org.<br>
XFree86 Misc extension out of bounds array index,
File existence disclosure,
Xinput extension memory corruption,
TOG-cup extension memory corruption,
MIT-SHM and EVI extensions integer overflows,
PCF Font parser buffer overflow.
<a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5760">CVE-2007-5760</a>,
<a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5958">CVE-2007-5958</a>,
<a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6427">CVE-2007-6427</a>,
<a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6428">CVE-2007-6428</a>,
<a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6429">CVE-2007-6429</a>,
<a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0006">CVE-2008-0006</a>.
<br>
<a href="https://ftp.openbsd.org/pub/OpenBSD/patches/4.2/common/006_xorg.patch">
A source code patch exists which remedies this problem.</a>
<p>

<li id="p007_tcprespond">
<strong>007: RELIABILITY FIX: February 22, 2008</strong>
&nbsp; <i>All architectures</i><br>
Incorrect assumptions in tcp_respond can lead to a kernel panic.<br>
<a href="https://ftp.openbsd.org/pub/OpenBSD/patches/4.2/common/007_tcprespond.patch">
A source code patch exists which remedies this problem.</a>
<p>

<li id="p008_ip6rthdr">
<strong>008: RELIABILITY FIX: February 25, 2008</strong>
&nbsp; <i>All architectures</i><br>
Malformed IPv6 routing headers can cause a kernel panic.<br>
<a href="https://ftp.openbsd.org/pub/OpenBSD/patches/4.2/common/008_ip6rthdr.patch">
A source code patch exists which remedies this problem.</a>
<p>

<li id="p009_ppp">
<strong>009: SECURITY FIX: March 7, 2008</strong>
&nbsp; <i>All architectures</i><br>
Buffer overflow in ppp command prompt parsing.<br>
<a href="https://ftp.openbsd.org/pub/OpenBSD/patches/4.2/common/009_ppp.patch">
A source code patch exists which remedies this problem.</a>
<p>

<li id="p010_openssh">
<strong>010: SECURITY FIX: March 30, 2008</strong>
&nbsp; <i>All architectures</i><br>
sshd(8) would execute ~/.ssh/rc even when a sshd_config(5) <em>ForceCommand</em>
directive was in effect, allowing users with write access to this file to
execute arbitrary commands. This behaviour was documented, but was an unsafe
default and an extra hassle for administrators.<br>
<a href="https://ftp.openbsd.org/pub/OpenBSD/patches/4.2/common/010_openssh.patch">
A source code patch exists which remedies this problem.</a>
<p>

<li id="p011_openssh2">
<strong>011: SECURITY FIX: April 3, 2008</strong>
&nbsp; <i>All architectures</i><br>
Avoid possible hijacking of X11-forwarded connections with sshd(8)
by refusing to listen on a port unless all address families bind
successfully.<br>
<a href="https://ftp.openbsd.org/pub/OpenBSD/patches/4.2/common/011_openssh2.patch">
A source code patch exists which remedies this problem.</a>
<p>


<li id="p012_xorg2">
<strong>012: SECURITY FIX: July 15, 2008</strong>
&nbsp; <i>All architectures</i><br>
Multiple vulnerabilities have been discovered in X.Org.<br>
RENDER Extension heap buffer overflow,
RENDER Extension crash,
RENDER Extension memory corruption,
MIT-SHM arbitrary memory read,
RECORD and Security extensions memory corruption.
<a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2360">CVE-2008-2360</a>,
<a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2361">CVE-2008-2361</a>,
<a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2362">CVE-2008-2362</a>,
<a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1379">CVE-2008-1379</a>,
<a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1377">CVE-2008-1377</a>.
<br>
<a href="https://ftp.openbsd.org/pub/OpenBSD/patches/4.2/common/012_xorg2.patch">
A source code patch exists which remedies this problem.</a>
<p>

<li id="p013_bind">
<strong>013: SECURITY FIX: July 23, 2008</strong>
&nbsp; <i>All architectures</i><br>
<b>2nd revision, July 23, 2008</b><br>
A vulnerability has been found with BIND. An attacker could use this vulnerability
to poison the cache of a recursive resolving name server.
<a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1447">CVE-2008-1447</a>.
<br>
<a href="https://ftp.openbsd.org/pub/OpenBSD/patches/4.2/common/013_bind.patch">
A source code patch exists which remedies this problem.</a>
<p>


<li id="p014_pcb">
<strong>014: RELIABILITY FIX: July 29, 2008</strong>
&nbsp; <i>All architectures</i><br>
Some kinds of IPv6 usage would leak kernel memory (in particular, this path
was exercised by the named(8) patch for port randomization).  Since INET6 is
enabled by default, this condition affects all systems.
<br>
<a href="https://ftp.openbsd.org/pub/OpenBSD/patches/4.2/common/014_pcb.patch">
A source code patch exists which remedies this problem.</a>
<p>

<li id="p015_ndp">
<strong>015: SECURITY FIX: October 2, 2008</strong>
&nbsp; <i>All architectures</i><br>
The Neighbor Discovery Protocol (ndp) did not correctly verify neighbor
solicitation requests maybe allowing a nearby attacker to intercept traffic.
The attacker must have IPv6 connectivity to the same router as their target for
this vulnerability to be exploited.
<a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2476">CVE-2008-2476</a>.
<br>
<a href="https://ftp.openbsd.org/pub/OpenBSD/patches/4.2/common/015_ndp.patch">
A source code patch exists which remedies this problem.</a>
<p>

</ul>

<hr>