4.5 Errata
Patches for the OpenBSD base system are distributed as unified diffs. Each patch contains usage instructions. All the following patches are also available in one tar.gz file for convenience.
Patches for supported releases are also incorporated into the -stable branch.
-
001: RELIABILITY FIX: April 8, 2009
All architectures
The OpenSSL ASN.1 handling code could be forced to perform invalid memory accesses through the use of certain invalid strings (CVE-2009-0590) or under certain error conditions triggerable by invalid ASN.1 structures (CVE-2009-0789). These vulnerabilities could be exploited to achieve a denial-of-service. A more detailed description of these problems is available in the OpenSSL security advisory, but note that the other issue described there "Incorrect Error Checking During CMS verification" relates to code not enabled in OpenBSD.
A source code patch exists which remedies this problem. -
002: RELIABILITY FIX: April 11, 2009
All architectures
When pf attempts to perform translation on a specially crafted IP datagram, a null pointer dereference will occur, resulting in a kernel panic. In certain configurations this may be triggered by a remote attacker.
Restricting translation rules to protocols that are specific to the IP version in use, is an effective workaround until the patch can be installed. As an example, for IPv4 nat/binat/rdr rules you can use:nat/rdr ... inet proto { tcp udp icmp } ...Or for IPv6 nat/binat/rdr rules you can use:nat/rdr ... inet6 proto { tcp udp icmp6 } ...A source code patch exists which remedies this problem. -
003: RELIABILITY FIX: April 24, 2009
i386 only
When DMA'able memory is mapped by device drivers, the mapping flags and protection are partially uninitialized. Depending on the calling context, this may cause devices to misbehave, like audio(4) to stutter, but other anomalies might be observed for other device types.
A source code patch exists which remedies this problem. -
004: RELIABILITY FIX: April 24, 2009
All architectures
In server mode when in full-duplex mode (the default) aucat(1) will send each synchronization message twice, causing client applications to think that buffer underruns are occurring. Depending on the application, this may cause the sound to stutter.
A source code patch exists which remedies this problem. -
005: RELIABILITY FIX: April 24, 2009
All architectures
On very high system load, an audio interrupt may occur while the audio process is filling audio ring buffers. This triggers bogus (and useless) correction code in the audio(4) driver causing the audio application to go out of sync, and in turn causing continuous stuttering until the application is restarted.
A source code patch exists which remedies this problem. -
006: RELIABILITY FIX: June 24, 2009
All architectures
An off-by-one error in the inflate function in Zlib.xs in the Compress::Raw::Zlib perl module before 2.017 (CVE-2009-1391), as used in AMaViS, SpamAssassin, and possibly other products, allows context-dependent attackers to cause a denial of service (hang or crash) via a crafted zlib compressed stream that triggers a heap-based buffer overflow.
A source code patch exists which remedies this problem. -
007: RELIABILITY FIX: July 29, 2009
All architectures
A vulnerability has been found in BIND's named server (CVE-2009-0696). An attacker could crash a server with a specially crafted dynamic update message to a zone for which the server is master.
A source code patch exists which remedies this problem. -
008: RELIABILITY FIX: October 05, 2009
i386 only
XMM exceptions are not correctly handled resulting in a kernel panic.
A source code patch exists which remedies this problem. -
009: RELIABILITY FIX: October 28, 2009
All architectures
getsockopt(2) with any of IP_AUTH_LEVEL, IP_ESP_TRANS_LEVEL, IP_ESP_NETWORK_LEVEL, IP_IPCOMP_LEVEL will crash the system.
A source code patch exists which remedies this problem. -
010: SECURITY FIX: November 26, 2009
All architectures
The SSL/TLS protocol is subject to man-in-the-middle attacks related to renegotiation (see CVE-2009-3555, draft-ietf-tls-renegotiation-00). OpenSSL permitted this protocol feature by default and had no way to disable it.
A source code patch exists which remedies this problem. -
011: RELIABILITY FIX: January 29, 2010
All architectures
By using ptrace(2) on an ancestor process, a loop in the process tree could be created, violating assumptions in other parts of the kernel and resulting in infinite loops.
A source code patch exists which remedies this problem. -
012: SECURITY FIX: March 12, 2010
All architectures
OpenSSL is susceptible to a buffer overflow due to a failure to check for NULL returns from bn_wexpand function calls.
A source code patch exists which remedies this problem. -
013: RELIABILITY FIX: March 12, 2010
All architectures
Due to a null pointer dereference, it would be possible to crash ftpd when handling glob(3)'ing requests. This is non-exploitable.
A source code patch exists which remedies this problem. -
014: RELIABILITY FIX: March 31, 2010
All architectures
When decrypting packets, the internal decryption functions were not paranoid enough in checking for underruns, which could potentially lead to crashes.
A source code patch exists which remedies this problem. -
015: RELIABILITY FIX: April 4, 2010
All architectures
When updating sensors showing the state of RAID volumes mpi(4) allocates temporary memory and then returns it to the kernel as device memory. This causes kernel memory usage to be misrepresented, eventually leading to a denial of service when a resource limit is apparently reached.
A source code patch exists which remedies this problem. -
016: SECURITY FIX: April 14, 2010
All architectures
In TLS connections, certain incorrectly formatted records can cause an OpenSSL client or server to crash due to a read attempt at NULL.
A source code patch exists which remedies this problem.