Displaying 20 results from an estimated 1000 matches similar to: "OpenSSL heads-up"
2003 Oct 02
3
HEADS UP: upcoming security advisories
Hello Folks,
Just a status on upcoming advisories.
FreeBSD-SA-03:15.openssh
This is in final review and should be released today. Fixes
for this issue entered the tree on September 24. I apologize
for the delay in getting this one out.
FreeBSD-SA-03:16.filedesc
A reference counting bug was discovered that could lead to
kernel memory disclosure or a system panic.
2003 Sep 17
3
Sendmail vulnerability
You've probably already seen the latest sendmail vulnerability.
http://lists.netsys.com/pipermail/full-disclosure/2003-September/010287.html
I believe you can apply the following patch to any of the security
branches:
http://cvsweb.freebsd.org/src/contrib/sendmail/src/parseaddr.c.diff?r1=1.1.1.17&r2=1.1.1.18
Download the patch and:
# cd /usr/src
# patch -p1 < /path/to/patch
#
2003 Sep 17
3
Sendmail vulnerability
You've probably already seen the latest sendmail vulnerability.
http://lists.netsys.com/pipermail/full-disclosure/2003-September/010287.html
I believe you can apply the following patch to any of the security
branches:
http://cvsweb.freebsd.org/src/contrib/sendmail/src/parseaddr.c.diff?r1=1.1.1.17&r2=1.1.1.18
Download the patch and:
# cd /usr/src
# patch -p1 < /path/to/patch
#
2003 Sep 16
9
OpenSSH heads-up
OK, an official OpenSSH advisory was released, see here:
<URL: http://www.mindrot.org/pipermail/openssh-unix-announce/2003-September/000063.html >
The fix is currently in FreeBSD -CURRENT and -STABLE. It will be
applied to the security branches as well today. Attached are patches:
buffer46.patch -- For FreeBSD 4.6-RELEASE and later
buffer45.patch -- For FreeBSD 4.5-RELEASE and
2004 Aug 17
1
remotely exploitable vulnerability in lukemftpd / tnftpd
Hi Everyone,
http://vuxml.freebsd.org/c4b025bb-f05d-11d8-9837-000c41e2cdad.html
A critical vulnerability was found in lukemftpd, which shipped with some
FreeBSD versions (4.7 and later). However, with the exception of
FreeBSD 4.7, lukemftpd was not built and installed by default. So,
unless you are running FreeBSD 4.7-RELEASE or specified WANT_LUKEMFTP
when building FreeBSD from source, you
2004 Apr 07
5
Changing `security@freebsd.org' alias
Hello Folks,
The official email address for this list is
`freebsd-security@freebsd.org'. Due to convention, there is an email
alias for this list: security@freebsd.org, just as there is for
hackers@ & freebsd-hackers@, arch@ & freebsd-arch@, and so on.
The security@freebsd.org alias has been the source of occassional
problems. Several times in the past, postings have been made to
2004 Apr 20
10
TCP RST attack
http://www.uniras.gov.uk/vuls/2004/236929/index.htm
----Quote----
"The impact of this vulnerability varies by vendor and application, but in
some deployment scenarios it is rated critical. Please see the vendor
section below for further information. Alternatively contact your vendor
for product specific information.
If exploited, the vulnerability could allow an attacker to create a
2003 Oct 03
6
FreeBSD Security Advisory FreeBSD-SA-03:18.openssl
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
=============================================================================
FreeBSD-SA-03:18.openssl Security Advisory
The FreeBSD Project
Topic: OpenSSL vulnerabilities in ASN.1 parsing
Category: crypto
Module: openssl
Announced:
2003 Mar 31
8
what was that?
What does mean this bizarre msgid?
maillog:
Mar 31 19:31:15 cu sm-mta[5352]: h2VFVEGS005352: from=<nb@sindbad.ru>,
size=1737, class=0, nrcpts=1,
msgid=<!~!UENERkVCMDkAAQACAAAAAAAAAAAAAAAAABgAAAAAAAAAfp4Fa2ShPE2u4pP/QpPDIMKAAAAQAAAAj+zb4Isbuk+tYEPVF9Vf,
proto=ESMTP, daemon=MTA, relay=wg.pu.ru [193.124.85.219]
--
Nikolaj I. Potanin, SA http://www.drweb.ru
ID
2003 Nov 28
2
Kerberized applications in FreeBSD 5.x
In FreeBSD 5.x only telnet/telnetd works 'out of box' with kerberos.
Why ftp/ftpd, ssh/sshd and cvs do not support kerberos ?
Thanks!
2003 Sep 23
3
OpenSSH: multiple vulnerabilities in the new PAM code
This affects only 3.7p1 and 3.7.1p1. The advice to leave
PAM disabled is far from heartening, nor is the semi-lame
blaming the PAM spec for implementation bugs.
I happen to like OPIE for remote access.
Subject: Portable OpenSSH Security Advisory: sshpam.adv
This document can be found at: http://www.openssh.com/txt/sshpam.adv
1. Versions affected:
Portable OpenSSH versions 3.7p1
2005 May 23
1
TCP timestamp vulnerability
On May 19, 2005, at 5:53 AM, Christian Brueffer wrote:
> Hi,
>
> fixes for the vulnerability described in http://www.kb.cert.org/
> vuls/id/637934
> were checked in to CURRENT and RELENG_5 by ps in April.
>
> http://www.freebsd.org/cgi/cvsweb.cgi/src/sys/netinet/tcp_input.c
>
> Revisions 1.270 and 1.252.2.16
>
> He didn't commit it to RELENG_5_4 for some
2003 Aug 11
1
Kernel build fails (RELENG_4_5)
Hi Jacques, list,
On Mon, Aug 11, 2003 at 09:09:18AM +0100, Bruce M Simpson wrote:
> cc -c -O -pipe -Wall -Wredundant-decls -Wnested-externs -Wstrict-prototypes -Wmissing-prototypes -Wpointer-arith -Winline -Wcast-qual -fformat-extensions -ansi -g -nostdinc -I- -I. -I/usr/src/sys -I/usr/src/sys/../include -I/usr/src/sys/contrib/ipfilter -D_KERNEL -include opt_global.h -elf
2003 Nov 26
0
HEADS-UP: BIND denial-of-service vulnerability
Hello Everyone,
ISC has released new versions of BIND 8 which address a remotely
exploitable denial-of-service vulnerability that may allow an attacker
to perform `negative cache poisoning'--- convincing a name server that
certain RRs do not exist (even though they may). I do not know of any
workaround at this time.
I have committed fixes to the RELENG_5_1 and RELENG_4_9 security
branches.
2003 Jul 14
0
Security Officer-supported branches update
Hello Everyone,
The branches supported by the FreeBSD Security Officer have been
updated to reflect recent releases and EoL (end-of-life) events. The
new list is below (and should appear at
<URL: http://www.freebsd.org/security/ > soon).
In particular, FreeBSD 4.6 and FreeBSD 5.0 have `expired'. If you wish
to be certain to get critical bug fixes, it is recommended that you
upgrade
2004 Jan 09
0
Security Officer-supported branches update
Hello Everyone,
The branches supported by the FreeBSD Security Officer have been
updated to reflect recent EoL (end-of-life) events. The new list is
below (and should appear at <URL: http://www.freebsd.org/security/ >
soon). FreeBSD 4.7 has `expired', but I have extended the EoL date
for FreeBSD 5.1.
If you are running FreeBSD 4.7 or older and you wish to be certain to
get critical
2004 Feb 29
5
mbuf vulnerability
In
http://docs.freebsd.org/cgi/mid.cgi?200402260743.IAA18903
it seems RELENG_4 is vulnerable. Is there any work around to a system that
has to have ports open ?
Version: 1 2/18/2004@03:47:29 GMT
>Initial report
>
<<https://ialert.idefense.com/KODetails.jhtml?irId=207650>https://ialert.idefense.com/KODetails.jhtml?irId=207650;
>ID#207650:
>FreeBSD Memory Buffer
2003 Aug 03
12
FreeBSD Security Advisory FreeBSD-SA-03:08.realpath
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
=============================================================================
FreeBSD-SA-03:08.realpath Security Advisory
The FreeBSD Project
Topic: Single byte buffer overflow in realpath(3)
Category: core
Module: libc
Announced:
2004 May 03
1
Bad VuXML check on PNG port ?
Hello,
The current png-1.2.5_4 port has no more vulnerability.
It has been corrected by ache@FreeBSD.org yesterday.
But when i try to install the updated port to remplace
the vulnerable one this is what i am told :
# make install
===> png-1.2.5_4 has known vulnerabilities:
>> libpng denial-of-service.
Reference:
2003 Mar 26
2
what actually uses xdr_mem.c?
In regards to FreeBSD-SA-03:05.xdr, does anyone know which static binaries
or tools under /bin or /sbin actually use that problem code?
The recent XDR fixes the xdrmem_getlong_aligned(),
xdrmem_putlong_aligned(), xdrmem_getlong_unaligned(),
xdrmem_putlong_unaligned(), xdrmem_getbytes(), and/or xdrmem_putbytes()
functions, but it is difficult to know what uses these (going backwards
manually).