402 lines
16 KiB
Plaintext
402 lines
16 KiB
Plaintext
<!--
|
|
FreeBSD errata document. Unlike some of the other RELNOTESng
|
|
files, this file should remain as a single SGML file, so that
|
|
the dollar FreeBSD dollar header has a meaningful modification
|
|
time. This file is all but useless without a datestamp on it,
|
|
so we'll take some extra care to make sure it has one.
|
|
|
|
(If we didn't do this, then the file with the datestamp might
|
|
not be the one that received the last change in the document.)
|
|
|
|
-->
|
|
|
|
<!DOCTYPE article PUBLIC "-//FreeBSD//DTD DocBook V4.1-Based Extension//EN" [
|
|
<!ENTITY % articles.ent PUBLIC "-//FreeBSD//ENTITIES DocBook FreeBSD Articles Entity Set//EN">
|
|
%articles.ent;
|
|
|
|
<!ENTITY % release PUBLIC "-//FreeBSD//ENTITIES Release Specification//EN">
|
|
%release;
|
|
<!ENTITY release.bugfix "5.2.1-RELEASE">
|
|
]>
|
|
|
|
<article>
|
|
<articleinfo>
|
|
<title>&os;
|
|
<![ %release.type.snapshot [
|
|
&release.prev;
|
|
]]>
|
|
<![ %release.type.release [
|
|
&release.current;
|
|
]]>
|
|
Errata</title>
|
|
|
|
<corpauthor>
|
|
The &os; Project
|
|
</corpauthor>
|
|
|
|
<pubdate>$FreeBSD$</pubdate>
|
|
|
|
<copyright>
|
|
<year>2000</year>
|
|
<year>2001</year>
|
|
<year>2002</year>
|
|
<year>2003</year>
|
|
<year>2004</year>
|
|
<holder role="mailto:doc@FreeBSD.org">The FreeBSD Documentation Project</holder>
|
|
</copyright>
|
|
|
|
<legalnotice id="trademarks" role="trademarks">
|
|
&tm-attrib.freebsd;
|
|
&tm-attrib.intel;
|
|
&tm-attrib.sparc;
|
|
&tm-attrib.general;
|
|
</legalnotice>
|
|
</articleinfo>
|
|
|
|
<abstract>
|
|
<para>This document lists errata items for &os;
|
|
<![ %release.type.current [
|
|
&release.prev;,
|
|
]]>
|
|
<![ %release.type.snapshot [
|
|
&release.prev;,
|
|
]]>
|
|
<![ %release.type.release [
|
|
&release.current;,
|
|
]]>
|
|
containing significant information discovered after the release
|
|
or too late in the release cycle to be otherwise included in the
|
|
release documentation.
|
|
This information includes security advisories, as well as news
|
|
relating to the software or documentation that could affect its
|
|
operation or usability. An up-to-date version of this document
|
|
should always be consulted before installing this version of
|
|
&os;.</para>
|
|
|
|
<para>This document also contains errata for &os;
|
|
&release.bugfix;, a <quote>point release</quote> made about one
|
|
month after &os; &release.prev;. Unless otherwise noted, all
|
|
errata items in this document apply to both &release.prev;
|
|
and &release.bugfix;.</para>
|
|
|
|
<para>This errata document for &os;
|
|
<![ %release.type.current [
|
|
&release.prev;
|
|
]]>
|
|
<![ %release.type.snapshot [
|
|
&release.prev;
|
|
]]>
|
|
<![ %release.type.release [
|
|
&release.current;
|
|
]]>
|
|
will be maintained until the release of &os; &release.next;.</para>
|
|
</abstract>
|
|
|
|
<sect1 id="intro">
|
|
<title>Introduction</title>
|
|
|
|
<para>This errata document contains <quote>late-breaking news</quote>
|
|
about &os;
|
|
<![ %release.type.current [
|
|
&release.prev;.
|
|
]]>
|
|
<![ %release.type.snapshot [
|
|
&release.prev;.
|
|
]]>
|
|
<![ %release.type.release [
|
|
&release.current;.
|
|
]]>
|
|
Before installing this version, it is important to consult this
|
|
document to learn about any post-release discoveries or problems
|
|
that may already have been found and fixed.</para>
|
|
|
|
<para>Any version of this errata document actually distributed
|
|
with the release (for example, on a CDROM distribution) will be
|
|
out of date by definition, but other copies are kept updated on
|
|
the Internet and should be consulted as the <quote>current
|
|
errata</quote> for this release. These other copies of the
|
|
errata are located at <ulink
|
|
url="http://www.FreeBSD.org/releases/"></ulink>, plus any sites
|
|
which keep up-to-date mirrors of this location.</para>
|
|
|
|
<para>Source and binary snapshots of &os; &release.branch; also
|
|
contain up-to-date copies of this document (as of the time of
|
|
the snapshot).</para>
|
|
|
|
<para>For a list of all &os; CERT security advisories, see <ulink
|
|
url="http://www.FreeBSD.org/security/"></ulink> or <ulink
|
|
url="ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/"></ulink>.</para>
|
|
|
|
</sect1>
|
|
|
|
<sect1 id="security">
|
|
<title>Security Advisories</title>
|
|
|
|
<![ %release.type.release [
|
|
<para>No advisories.</para>
|
|
]]>
|
|
|
|
<![ %release.type.current [
|
|
<para>No advisories.</para>
|
|
]]>
|
|
|
|
<![ %release.type.snapshot [
|
|
|
|
<para>(30 Jan 2004, updated 28 Feb 2004) A bug in &man.mksnap.ffs.8; causes the creation of a
|
|
filesystem snapshot to reset the flags on the filesystem to
|
|
their default values. The possible consequences depend on local
|
|
usage, but can include disabling extended access control lists
|
|
or enabling the use of setuid executables stored on an untrusted
|
|
filesystem. This bug also affects the &man.dump.8;
|
|
<option>-L</option> option, which uses &man.mksnap.ffs.8;. Note
|
|
that &man.mksnap.ffs.8; is normally only available to the
|
|
superuser and members of the <groupname>operator</groupname>
|
|
group. This bug has been fixed on the &os; &release.prev;
|
|
security fix branch and in &os; &release.bugfix;. For more information, see security advisory <ulink
|
|
url="ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-04:01.mksnap_ffs.asc">FreeBSD-SA-04:01</ulink>.</para>
|
|
|
|
<para>(8 Feb 2004, updated 28 Feb 2004) A bug with the System V Shared Memory interface
|
|
(specifically the &man.shmat.2; system call)
|
|
can cause a shared memory segment to reference
|
|
unallocated kernel memory. In turn, this can permit a local
|
|
attacker to gain unauthorized access to parts of kernel memory,
|
|
possibly resulting in disclosure of sensitive information,
|
|
bypass of access control mechanisms, or privilege escalation.
|
|
This bug has been fixed on the &os; &release.prev;
|
|
security fix branch and in &os; &release.bugfix;.
|
|
More details, including bugfix and workaround information,
|
|
can be found in security advisory <ulink
|
|
url="ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-04:02.shmat.asc">FreeBSD-SA-04:02</ulink>.</para>
|
|
|
|
<para>(28 Feb 2004) It is possible, under some circumstances, for
|
|
a processor with superuser privileges inside a &man.jail.8;
|
|
environment to change its root directory to a different jail,
|
|
giving it read and write access to the files and directories
|
|
within. This vulnerability has been closed on the &os;
|
|
&release.prev; security fix branch and in &os;
|
|
&release.bugfix;. Information on the bug fix can be found in
|
|
security advisory <ulink
|
|
url="ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-04:03.jail.asc">FreeBSD-SA-04:03</ulink>.</para>
|
|
|
|
<para>(4 Mar 2004) It is possible for a remote attacker to conduct
|
|
a low-bandwidth denial-of-service attack against a machine
|
|
providing TCP-based services, filling up the target's memory
|
|
buffers and potentially leading to a system crash. This
|
|
vulnerability has been addressed on the &os; &release.prev;
|
|
security fix branch, but is present in both &os; &release.prev;
|
|
and &release.bugfix;. Security advisory <ulink
|
|
url="ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-04:04.tcp.asc">FreeBSD-SA-04:04</ulink>
|
|
contains more details, as well as information on patching
|
|
existing systems.</para>
|
|
|
|
<para>(17 Mar 2004) By performing a specially crafted SSL/TLS
|
|
handshake with an application that uses OpenSSL a null pointer
|
|
may be dereferenced. This may in turn cause the application to
|
|
crash, resulting in a denial of service attack. For more information
|
|
see the Security Advisory <ulink
|
|
url="ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-04:05.openssl.asc">FreeBSD-SA-04:05</ulink>
|
|
which contains more details and instructions on how to patch existing
|
|
systems.</para>
|
|
|
|
<para>(29 Mar 2004) A local attacker may take advantage of a
|
|
programming error in the handling of certain IPv6 socket options
|
|
in the &man.setsockopt.2; system call to read portions of kernel
|
|
memory without proper authorization. This may result in disclosure
|
|
of sensitive data, or potentially cause a panic. See Security
|
|
Advisory <ulink
|
|
url="ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-04:06.ipv6.asc">FreeBSD-SA-04:06</ulink>
|
|
for a more detailed description and instructions on how to patch
|
|
existing systems.</para>
|
|
|
|
<para>(9 May 2004) Two programming errors in
|
|
<application>CVS</application> can allow a server to overwrite
|
|
arbitrary files on the client, and a client to read arbitrary
|
|
files on the server when accessing remote CVS repositories.
|
|
More details, including patch and upgrade information, can be
|
|
found in security advisory <ulink
|
|
url="ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-04:07.cvs.asc">FreeBSD-SA-04:07</ulink>.</para>
|
|
|
|
<para>(9 May 2004) <application>Heimdal</application> may, under
|
|
some circumstances, not perform adequate checking of
|
|
authentication across autonomous realms. For more information,
|
|
see security advisory <ulink
|
|
url="ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-04:08.heimdal.asc">FreeBSD-SA-04:08</ulink>.</para>
|
|
|
|
]]>
|
|
|
|
</sect1>
|
|
|
|
<sect1 id="open-issues">
|
|
<title>Open Issues</title>
|
|
|
|
<![ %release.type.current [
|
|
<para>No open issues.</para>
|
|
]]>
|
|
|
|
<![ %release.type.release [
|
|
<para>No open issues.</para>
|
|
]]>
|
|
|
|
<![ %release.type.snapshot [
|
|
|
|
<para>(9 Jan 2004) Due to a change in &man.cpp.1; behavior, the
|
|
login screen for &man.xdm.1; is in black and white, even on
|
|
systems with color displays. As a workaround, update to a newer
|
|
version of the
|
|
<filename role="package">x11/XFree86-4-clients</filename>
|
|
port/package.</para>
|
|
|
|
<para>(9 Jan 2004) There remain some residual problems with ACPI.
|
|
In some cases, systems may behave erratically, or hang at boot
|
|
time. As a workaround, disable ACPI, using the <quote>safe
|
|
mode</quote> option of the bootloader or using the
|
|
<varname>hint.acpi.0.disabled</varname> kernel environment
|
|
variable. These problems are being investigated. For problems
|
|
that have not already been reported (check the mailing list
|
|
archives <emphasis>before</emphasis> posting), sending the
|
|
output of &man.dmesg.8; and &man.acpidump.8; to the
|
|
&a.current; may help diagnose the problem.</para>
|
|
|
|
<para>(9 Jan 2004, updated 28 Feb 2004) In some cases, ATA devices may behave
|
|
erratically, particularly SATA devices. Reported symptoms
|
|
include command timeouts or missing interrupts. These problems
|
|
appear to be timing-dependent, making them rather difficult to
|
|
isolate. Workarounds include:</para>
|
|
|
|
<itemizedlist>
|
|
<listitem>
|
|
<para>Turn off ATA DMA using the <quote>safe mode</quote>
|
|
option of the bootloader or the
|
|
<varname>hw.ata.ata_dma</varname> sysctl variable.</para>
|
|
</listitem>
|
|
|
|
<listitem>
|
|
<para>Use the host's BIOS setup options to put the ATA
|
|
controller in its <quote>legacy mode</quote>, if
|
|
available.</para>
|
|
</listitem>
|
|
|
|
<listitem>
|
|
<para>Disable ACPI, for example using the <quote>safe mode</quote>
|
|
option of the bootloader or using the
|
|
<varname>hint.acpi.0.disabled</varname> kernel environment
|
|
variable.</para>
|
|
</listitem>
|
|
</itemizedlist>
|
|
|
|
<para>Some of these problems were addressed in &os;
|
|
&release.bugfix; with the import of a newer &man.ata.4; from
|
|
&release.current;.</para>
|
|
|
|
<para>(9 Jan 2004) Installing over NFS when using the install
|
|
floppies requires that the <filename>nfsclient.ko</filename>
|
|
module be manually loaded from the third floppy disk. This can
|
|
be done by following the prompts when &man.sysinstall.8;
|
|
launches to load a driver off of the third floppy disk.</para>
|
|
|
|
<para>(9 Jan 2004) The use of multiple vchans (virtual audio
|
|
channels with dynamic mixing in software) in the &man.pcm.4;
|
|
driver has been known to cause some instability.</para>
|
|
|
|
<para>(10 Jan 2004) Although APIC interrupt routing seems to work
|
|
correctly on many systems, on some others (such as some laptops)
|
|
it can cause various errors, such as &man.ata.4; errors or hangs
|
|
when starting or exiting X11. For these situations, it may be
|
|
advisable to disable APIC routing, using the <quote>safe
|
|
mode</quote> of the bootloader or the
|
|
<varname>hint.apic.0.disabled</varname> loader tunable. Note
|
|
that disabling APIC is not compatible with SMP systems.</para>
|
|
|
|
<para>(10 Jan 2004, updated 28 Feb 2004) The NFSv4 client may panic when attempting an
|
|
NFSv4 operation against an NFSv3/NFSv2-only server. This
|
|
problem has been fixed with revision 1.4 of
|
|
<filename>src/sys/rpc/rpcclnt.c</filename> in &os;
|
|
&release.current;. It was also fixed in &os;
|
|
&release.bugfix;.</para>
|
|
|
|
<para>(11 Jan 2004, updated 28 Feb 2004) Some problems have been encountered when using
|
|
third-party NSS modules, such as <filename>nss_ldap</filename>,
|
|
and groups with large membership lists. These have been fixed
|
|
with revision 1.2 of <filename>src/include/nss.h</filename> and
|
|
revision 1.2 of
|
|
<filename>src/lib/libc/net/nss_compat.c</filename> in &os;
|
|
&release.current;; this fix was backported to &os;
|
|
&release.bugfix;.</para>
|
|
|
|
<para>(13 Jan 2004) The &os; &release.current; release notes
|
|
incorrectly stated that <application>GCC</application> was a
|
|
post-release GCC 3.3.3 snapshot. They should have stated that
|
|
GCC was a <emphasis>pre-release</emphasis> GCC 3.3.3
|
|
snapshot.</para>
|
|
|
|
<para>(13 Jan 2004, updated 28 Feb 2004) The <filename
|
|
role="package">sysutils/kdeadmin3</filename> port/package has a
|
|
bug in the <application>KUser</application> component that can
|
|
cause deletion of the <username>root</username> user from the
|
|
system password file. Users are strongly urged to upgrade to
|
|
version 3.1.4_1 of this port/package. The package set included
|
|
with &os; &release.bugfix; contains the fixed version of this
|
|
package.</para>
|
|
|
|
<para>(21 Jan 2004, updated 28 Feb 2004) Some bugs in the IPsec implementation imported
|
|
from the KAME Project can result in memory objects being freed
|
|
before all references to them were removed. Reported symptoms
|
|
include erratic behavior or kernel panics after flushing the
|
|
Security Policy Database (SPD). Some of these problems have
|
|
been fixed in &os; &release.current; in rev. 1.31 of
|
|
<filename>src/sys/netinet6/ipsec.c</filename>, rev. 1.136 of
|
|
<filename>src/sys/netinet/in_pcb.c</filename>, and revs. 1.63
|
|
and 1.64 of <filename>src/sys/netkey/key.c</filename>. These
|
|
bugfixes were backported to &os; &release.bugfix;. More
|
|
information about these problems has been posted to the
|
|
&a.current;, in particular the thread entitled <ulink
|
|
url="http://lists.FreeBSD.org/pipermail/freebsd-current/2004-January/thread.html#18084">
|
|
<quote>[PATCH] IPSec fixes</quote></ulink>.</para>
|
|
|
|
<para>(28 Feb 2004) The edition of the Porters Handbook included
|
|
with &os; &release.bugfix; contained an incorrect value for
|
|
&release.bugfix;'s <varname>__FreeBSD_version</varname>. The
|
|
correct value is <literal>502010</literal>.</para>
|
|
|
|
]]>
|
|
|
|
</sect1>
|
|
|
|
<sect1 id="late-news">
|
|
<title>Late-Breaking News</title>
|
|
|
|
<![ %release.type.current [
|
|
<para>No news.</para>
|
|
]]>
|
|
|
|
<![ %release.type.release [
|
|
<para>No news.</para>
|
|
]]>
|
|
|
|
<![ %release.type.snapshot [
|
|
|
|
<para>(10 Jan 2004, updated 28 Feb 2004) The TCP implementation in &os; now includes
|
|
protection against a certain class of TCP MSS resource
|
|
exhaustion attacks, in the form of limits on the size and rate
|
|
of TCP segments. The first limit sets the minimum allowed
|
|
maximum TCP segment size, and is controlled by the
|
|
<varname>net.inet.tcp.minmss</varname> sysctl variable (the
|
|
default value is <literal>216</literal> bytes). The second
|
|
limit is set by the
|
|
<varname>net.inet.tcp.minmssoverload</varname> variable, and
|
|
controls the maximum rate of connections whose average segment
|
|
size is less than <varname>net.inet.tcp.minmss</varname>.
|
|
Connections exceeding this packet rate are reset and dropped.
|
|
Because this feature was added late in the &release.prev;
|
|
release cycle, connection rate limiting is disabled by default,
|
|
but can be enabled manually by assigning a non-zero value to
|
|
<varname>net.inet.tcp.minmssoverload</varname>. This feature
|
|
was added to &os; &release.prev; too late for inclusion in its
|
|
release notes.</para>
|
|
|
|
]]>
|
|
|
|
</sect1>
|
|
|
|
</article>
|