OpenBSD 4.4 errata

This is the OpenBSD 4.4 release errata & patch list:

For OpenBSD patch branch information, please refer here.

For errata on a certain release, click below:
2.1, 2.2, 2.3, 2.4, 2.5, 2.6, 2.7, 2.8, 2.9, 3.0, 3.1, 3.2, 3.3, 3.4, 3.5, 3.6,
3.7, 3.8, 3.9, 4.0, 4.1, 4.2, 4.3, 4.5, 4.6, 4.7, 4.8, 4.9, 5.0, 5.1, 5.2, 5.3,
5.4, 5.5.

You can also fetch a tar.gz file containing all the following patches. This file is updated once a day.

The patches below are available in CVS via the OPENBSD_4_4 patch branch.

For more detailed information on how to install patches to OpenBSD, please consult the OpenBSD FAQ.

016: RELIABILITY FIX: October 28, 2009 All architectures
getsockopt(2) with any of IP_AUTH_LEVEL, IP_ESP_TRANS_LEVEL, IP_ESP_NETWORK_LEVEL, IP_IPCOMP_LEVEL will crash the system.
A source code patch exists which remedies this problem.
015: RELIABILITY FIX: October 05, 2009 i386 only
XMM exceptions are not correctly handled resulting in a kernel panic.
A source code patch exists which remedies this problem.
014: RELIABILITY FIX: July 29, 2009 All architectures
A vulnerability has been found in BIND's named server (CVE-2009-0696). An attacker could crash a server with a specially crafted dynamic update message to a zone for which the server is master.
A source code patch exists which remedies this problem.
013: RELIABILITY FIX: April 11, 2009 All architectures
When pf attempts to perform translation on a specially crafted IP datagram, a null pointer dereference will occur, resulting in a kernel panic. In certain configurations this may be triggered by a remote attacker.
Restricting translation rules to protocols that are specific to the IP version in use, is an effective workaround until the patch can be installed. As an example, for IPv4 nat/binat/rdr rules you can use:
```
    nat/rdr ... inet proto { tcp udp icmp } ...
```
Or for IPv6 nat/binat/rdr rules you can use:
```
    nat/rdr ... inet6 proto { tcp udp icmp6 } ...
```
A source code patch exists which remedies this problem.
012: RELIABILITY FIX: April 8, 2009 All architectures
The OpenSSL ASN.1 handling code could be forced to perform invalid memory accesses through the use of certain invalid strings (CVE-2009-0590) or under certain error conditions triggerable by invalid ASN.1 structures (CVE-2009-0789). These vulnerabilities could be exploited to achieve a denial-of-service. A more detailed description of these problems is available in the OpenSSL security advisory, but note that the other issue described there "Incorrect Error Checking During CMS verification" relates to code not enabled in OpenBSD.
A source code patch exists which remedies this problem.
011: SECURITY FIX: February 22, 2009 All architectures
sudo(8) may allow a user listed in the sudoers file to run a command as a different user than their access rule specifies when a Unix group is used in the RunAs portion of the rule. The bug only manifests when the user being granted privileges is also a member of the group in the RunAs portion of the rule.
A source code patch exists which remedies this problem.
010: RELIABILITY FIX: February 18, 2009 All architectures
bgpd(8) did not correctly prepend its own AS to very long AS paths, causing the process to terminate because of the resulting corrupt path.
A source code patch exists which remedies this problem.
009: RELIABILITY FIX: January 30, 2009 All architectures
Upon reception of an invalid update with 4-byte AS attributes, bgpd - adhering to the RFCs - closed the session to the neighbor. This error in the specification allowed 3rd parties to close remote BGP sessions. In the worst case Internet connectivity could be lost.
A source code patch exists which remedies this problem.
008: SECURITY FIX: January 14, 2009 All architectures
named(8) did not correctly check the return value of a DSA verification function, potentially allowing bypass of verification of DNSSEC DSA signatures. CVE-2009-0025.
A source code patch exists which remedies this problem.
007: SECURITY FIX: January 9, 2009 All architectures
The OpenSSL libraries did not correctly check the return value from certain verification functions, allowing validation to be bypassed and permitting a remote attacker to conduct a "man in the middle attack" against SSL/TLS connections if the server is configured with a DSA or ECDSA certificate. CVE-2008-5077.
A source code patch exists which remedies this problem.
006: RELIABILITY FIX: November 19, 2008 All architectures
Due to changes in the options handling this caused problems with some DHCP clients such as Solaris/OpenSolaris and some embedded routers not accepting DHCP offers.
A source code patch exists which remedies this problem.
005: RELIABILITY FIX: November 7, 2008 All architectures
A software bug could cause memory allocation to cause a kernel panic accessing an array out of its bounds, when physical memory is exhausted.
A source code patch exists which remedies this problem.
004: RELIABILITY FIX: November 6, 2008 All architectures
Fix httpd(8)'s mod_proxy module which is broken on 64-bit architectures. Due to the bug this will result in child processes crashing when utilizing proxy rules during an HTTP session.
A source code patch exists which remedies this problem.
003: RELIABILITY FIX: November 6, 2008 All architectures
Fix the IPv4 TCP/IP stack's TIME_WAIT socket recycling. Due to the bug this can result in TCP connections between two IPs being reset instead of accepted if being received on a socket in the TIME_WAIT state.
A source code patch exists which remedies this problem.
002: RELIABILITY FIX: November 2, 2008 All architectures
Due to a bug in the vr(4) driver it is possible for a system using the vr(4) driver to panic under heavy load if the RX path runs out of mbufs.
A source code patch exists which remedies this problem.
001: SECURITY FIX: November 2, 2008 All architectures
The Neighbor Discovery Protocol (ndp) did not correctly verify neighbor solicitation requests maybe allowing a nearby attacker to intercept traffic. The attacker must have IPv6 connectivity to the same router as their target for this vulnerability to be exploited. CVE-2008-2476.
A source code patch exists which remedies this problem.