This file lists the major changes made between the last released version of Owl and Owl-current. While some of the changes listed here may also be made to a stable branch, the complete lists of stable branch changes are included with those branches and as errata for the corresponding Owl releases only. This is very far from an exhaustive list of changes. Small changes to individual packages won't be mentioned here unless they fix a security or a critical reliability problem. They are, however, mentioned in change logs for the packages themselves. Changes made between Owl 2.0 and Owl-current. 2008/08/14 Package: postfix Updated to 2.4.8, disabled the Solaris symlink hack that allowed local mail deliveries through "root-owned" symlinks. Although this is a security update for some other systems, on Owl the problem was avoided or mitigated in several ways: - we have a patch, introduced prior to Owl 2.0, that adds the local_minimum_uid setting with a default of 500 - preventing local mail deliveries to user "root" (unless it is correctly setup as an alias to some other e-mail address), as well as to other system special accounts; - there's no potential attack vector to get group "mail" privileges on Owl with no third-party software added - no single program is installed SGID "mail"; - the mail spool directory is only writable by root and group "mail" (not world-writable), yet it has the sticky bit set (mode 1771), which prevents the attack for already-existing mailboxes; - "useradd -m", which must be used to create a user account with a home directory, also pre-creates the mailbox; - our default kernel includes the CONFIG_HARDEN_LINK option, enabled by default, which thwarts the hardlink-to-symlink attack. 2008/08/10 Package: bind Updated to 9.3.5-P2, added an OpenBSD-derived patch to implement support for more than 1024 simultaneous recursive queries. 2006/09/13 - 2008/07/10 Package: john Many updates to John the Ripper have been made, bringing it to version 1.7.3. Most notably, two Blowfish-based crypt(3) hashes may now be computed in parallel for much better performance on x86-64 CPUs. Also, "DumbForce" and "KnownForce" external mode samples have been added to the default john.conf. 2008/07/08 Package: bind SECURITY FIX Severity: medium, remote, active Updated to 9.3.5-P1, which additionally randomizes UDP query ports to improve resilience to DNS cache poisoning attacks. References: http://www.isc.org/sw/bind/forgery-resilience.php http://www.kb.cert.org/vuls/id/800113 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1447 2008/06/29 Package: vsftpd Updated to 2.0.6. 2008/05/27 Package: openssh Implemented support for RSA/DSA key blacklisting in sshd based on partial fingerprints, added a subpackage with blacklisted 48-bit partial fingerprints for 1024-bit and 2048-bit RSA and 1024-bit DSA keys as generated on vulnerable Debian, Ubuntu, and derived systems for PID range 1 to 32767. Due to the encoding scheme used, the blacklist file size is just 1.3 MB, which corresponds to less than 4.5 bytes per fingerprint. This effort was supported by CivicActions. References: http://www.openwall.com/lists/oss-security/2008/05/27/3 http://www.debian.org/security/2008/dsa-1571 http://www.ubuntu.com/usn/usn-612-1 http://metasploit.com/users/hdm/tools/debian-openssl/ http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0166 2008/05/18 Package: nmap Updated to 4.62. 2008/05/10 Package: cvs Updated to 1.11.23. 2008/04/17 - 2008/04/22 Package: lilo Updated to 22.8. 2008/03/26 Package: gnupg Updated to 1.4.9. 2008/03/20 Package: findutils Updated to 4.2.33. 2008/03/20 Package: bzip2 Updated to 1.0.5. This release fixes a potential buffer over-read bug, which allowed user-assisted remote attackers to cause a crash in libbz2 via a crafted file. Reference: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1372 2008/02/13 Package: pcre Updated to 7.6. 2008/02/12 Packages: pam_passwdqc, pam Applied numerous minor changes to pam_passwdqc and its default settings, including replacing its set of separator characters (used for randomly generated "passphrases") with some of those defined by RFC 3986 as being safe within "userinfo" part of URLs without encoding, reducing the default minimum length for passphrases from 12 to 11, and corrections to the documentation. 2008/01/15 Package: tar Added a new option: --ignore-device-id, to be used when creating incremental dumps off filesystems with volatile device numbers, such as OpenVZ simfs. 2008/01/04 Package: hdparm Updated to 7.7. 2008/01/01 Package: gnupg Updated to 1.4.8. 2008/01/01 Package: e2fsprogs Updated to 1.40.4. 2007/12/16 Package: postfix Updated to 2.4.6. 2007/12/06 Package: e2fsprogs Applied upstream patch to fix integer overflows in libext2fs. This addresses a potential vulnerability where an untrusted filesystem can be corrupted on purpose in such a way that a program using libext2fs will allocate a buffer that is far too small. This can lead to either a crash or potentially a heap-based buffer overflow. Thanks to Rafal Wojtczuk of McAfee Avert Labs for reporting this issue. Reference: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5497 2007/12/05 Package: gettext Updated to 0.14.6. 2007/11/19 Package: findutils Updated to 4.2.31. 2007/11/18 Package: ltrace Updated to 0.5. 2007/11/18 Package: elfutils-libelf Updated to 0.131. 2007/11/15 Package: e2fsprogs Updated to 1.40.2. 2007/10/24 - 2007/11/05 Package: sysklogd Implemented logging of the sending user ID (when non-zero) and of the sending process ID (when different from the reported one) for syslog messages arriving via Unix domain sockets. This should allow for detection of spoofed messages. 2007/10/17 Package: diffstat Updated to 1.45. 2007/10/16 Package: dhcp Updated to 3.0.6. 2007/10/13 Package: openssl Backported upstream fix for off-by-one bug in the SSL_get_shared_ciphers function. It is unclear whether the bug had any security impact. References: http://lists.openwall.net/bugtraq/2007/09/27/14 http://lists.openwall.net/bugtraq/2007/10/01/7 http://www.openssl.org/news/secadv_20071012.txt http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5135 2007/10/08 Package: cvs Updated to 1.11.22. 2007/10/07 Package: bzip2 Updated to 1.0.4. 2007/10/07 Package: nmap Updated to 4.20. 2007/10/07 Packages: mdadm, raidtools; Owl/build/installorder.conf Replaced raidtools with mdadm. 2007/09/24 Package: pcre Updated to 7.4. 2007/08/30 Package: vim SECURITY FIX Severity: none to high, indirect, passive Backported upstream fix to restrict dangerous functions in modelines. Note that vim's modelines have always been disabled on Owl by default (with a setting in /usr/share/vim/vimrc) and even this fix is no guarantee modelines will be safe to use or the restricted mode safe to rely upon in the future. Backported upstream fix for format string vulnerability in the helptags_one function, which allowed user-assisted remote attackers to execute arbitrary code via format string specifiers in a help-tags tag in a help file. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2438 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2953 2007/08/18 kernel Updated to Linux 2.4.35-ow2. The single known security-relevant change added with Linux 2.4.35 is correction of the randomness pool update bug discovered by the PaX Team. The -ow2 revision adds a fix for the parent process death signal bug in the Linux kernel discovered by Wojciech Purczynski of COSEINC PTE Ltd. and iSEC Security Research; this bug has no security impact on Owl with no added SUID programs. Also added are two security hardening features, both enabled by default: restricted access to VM86 mode (specific to 32-bit x86) and restricted zero page mappings (generic). References: http://www.openwall.com/lists/announce/2007/08/08/1 http://www.openwall.com/lists/announce/2007/08/14/1 http://www.isec.pl/vulnerabilities/isec-0024-death-signal.txt http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3848 2007/08/18 Package: cpio Updated to 2.9. 2007/08/17 Package: tar Updated to 1.18. 2007/07/30 Package: bind SECURITY FIX Severity: medium, remote, passive Updated to 9.3.4-P1, which fixes a weakness in DNS query ids generator when answering resolver questions or sending NOTIFY messages to slave name servers. The weakness used to make it easier for remote attackers to guess the next query id and perform DNS cache poisoning. References: http://www.trusteer.com/bind9dns http://marc.info/?l=bind-announce&m=118531674631565 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2926 2007/06/01 Package: owl-cdrom In the default kernel for x86, enabled more IDE chipset drivers, common RAID and SATA controller drivers, USB and HID support (keyboard, mouse, storage devices), and more. This enables our CDs to boot off SATA and USB CD-ROM drives, in addition to IDE and SCSI ones that were supported previously. 2007/05/31 Package: mutt Updated to 1.4.2.3. This release fixes msgid validation in APOP authentication and potential buffer overflow in passwd GECOS field parser. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1558 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2683 2007/03/25 - 2007/05/22 Package: file SECURITY FIX Severity: high, indirect, passive Fixed potential heap buffer overflow in the file_printf function of the libmagic library. Reference: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1536 2007/03/29 Package: lftp Updated to 3.5.10. 2007/03/27 Package: elinks Updated to 0.11.2. 2007/03/26 Package: lftp Updated to 3.5.9. 2007/03/06 Package: gnupg SECURITY FIX Severity: medium, indirect, passive Updated to 1.4.7. This includes a fix for an unsigned data injection vulnerability: An attacker is able to add arbitrary content to a signed message, and the receiver of the message may not be able to distinguish the forged and the properly signed parts of the message. References: http://www.coresecurity.com/content/gnupg-and-gnupg-clients-unsigned-data-injection-vulnerability http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1263 2007/02/25 Package: openssl Updated to 0.9.7m. 2007/01/29 Package: bind SECURITY FIX Severity: low, remote, active Updated to 9.3.4, which fixes two security issues. The first issue is a "use after free" vulnerability which allowed remote DoS attack via unspecified vectors that cause BIND to "dereference (read) a freed fetch context". The second issue allowed remote DoS attack via a type ANY DNS query response that contains multiple RR sets in the answer section, which triggers an assertion error if DNSSEC validation is enabled. References: http://marc.info/?l=bind-announce&m=116968519321296 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0493 http://marc.info/?l=bind-announce&m=116968519300764 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0494 2007/01/18 Package: strace Updated to 4.5.15. 2007/01/13 Package: pcre Updated to 7.0. 2007/01/03 - 2007/01/09 Package: owl-setup Configuration of console font and locales has been implemented under a new sub-menu. Keyboard layout configuration has been moved to the same menu. The ncurses/CDK-based user interface now uses cfdisk rather than the traditional fdisk by default. 2006/12/30 - 2007/01/09 Owl/build/* New make targets have been added for creating ISO-9660 images of Owl bootable CDs. The added targets are buildkernel, installisotree, iso, and iso.gz. 2007/01/05 Package: mkisofs; Owl/build/installorder.conf New package: create ISO-9660 filesystem images. 2006/12/27 kernel Updated to Linux 2.4.34-ow1. 2006/12/06 Package: gnupg SECURITY FIX Severity: high, indirect, passive Updated to 1.4.6. This includes a fix for a remotely controllable function pointer vulnerability: using malformed OpenPGP packets an attacker was able to modify and dereference a function pointer in gpg. Reference: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-6235 2006/11/28 Package: gnupg SECURITY FIX Severity: high, indirect, passive Applied upstream fix for heap buffer overflow bug in gpg when running gpg interactively. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-6169 http://lists.gnupg.org/pipermail/gnupg-announce/2006q4/000241.html 2006/11/28 Package: tar SECURITY FIX Severity: high, indirect, passive Disabled GNUTYPE_NAMES handling by default to avoid directory traversal in GNU tar (where a malicious archive containing GNUTYPE_NAMES record with a symbolic link could specify files to be extracted to outside of the intended directory tree). References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-6097 http://lists.grok.org.uk/pipermail/full-disclosure/2006-November/050812.html 2006/11/19 Package: rpm Backported upstream fix for potential heap buffer overflow in showQueryPackage function. Although this particular bug is fixed, it remains unsafe to invoke "rpm" queries on untrusted package files. References: https://bugzilla.redhat.com/show_bug.cgi?id=212833 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-5466 2006/11/09 Package: openssh Backported upstream fix for a bug in the sshd privilege separation monitor that weakened its verification of successful authentication. References: http://lists.mindrot.org/pipermail/openssh-unix-dev/2006-November/024882.html http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-5794 2006/11/07 Package: texinfo SECURITY FIX Severity: high, indirect, passive Applied upstream patch that fixes potential heap buffer overflow in texindex utility. Reference: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4810 2006/10/29 Package: screen SECURITY FIX Severity: low, remote, passive Applied upstream patch that fixes two bugs in UTF-8 combining characters handling. The bugs could be used to crash/hang screen by writing a special string to a window. References: http://lists.gnu.org/archive/html/screen-users/2006-10/msg00028.html http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4573 2006/10/03 Package: openssh SECURITY FIX Severity: low/none to high, remote/local, active Backported upstream fixes for sshd connection consumption vulnerability (severity: low, remote, active), scp local arbitrary command execution vulnerability (severity: none to high, local, active), CRC compensation attack detector DoS (severity: low, remote, active), client NULL dereference on protocol error (severity: low, remote, passive). References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-2069 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0225 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4924 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4925 2006/09/29 Package: openssl SECURITY FIX Severity: none to low/high, remote, active/passive Updated to 0.9.7l, which includes fixes for four security issues. References: http://www.openssl.org/news/secadv_20060928.txt http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2937 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2940 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3738 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4343 2006/09/27 Package: dhcp Updated to 3.0.4. 2006/09/19 Package: gzip SECURITY FIX Severity: high, indirect, passive Fixed multiple vulnerabilities (stack buffer overflow, heap buffer underflow, heap buffer overflow, infinite loop) discovered by Tavis Ormandy of Google Security Team. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4335 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4336 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4337 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4338 2006/09/19 Package: bison Updated to 2.3. 2006/09/07 Package: gpm Updated to 1.20.1. 2006/09/06 Package: openssl SECURITY FIX Severity: none to medium, remote, passive to active Applied upstream patch to avoid RSA signature forgery. References: http://www.openssl.org/news/secadv_20060905.txt http://www.imc.org/ietf-openpgp/mail-archive/msg14307.html http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4339 2006/09/06 Package: bind SECURITY FIX Severity: none to low, remote, active Updated to 9.3.2-P1, which fixes a couple of bugs that allowed for DoS attacks on certain BIND configurations. References: http://www.kb.cert.org/vuls/id/915404 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4095 http://www.kb.cert.org/vuls/id/697164 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4096 2006/08/17 kernel Updated to Linux 2.4.33-ow1. 2006/08/04 Package: postfix Updated to 2.2.11. 2006/08/04 Package: gnupg SECURITY FIX Severity: high, remote, passive Updated to 1.4.5. This includes fixes for two more possible memory allocation bugs, similar to the problem fixed in 1.4.3-owl1. References: http://lists.gnupg.org/pipermail/gnupg-announce/2006q3/000229.html http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3746 2006/06/28 Package: gnupg Updated to 1.4.4. 2006/06/27 Package: mutt SECURITY FIX Severity: high, remote, passive Applied an upstream fix for potential stack-based buffer overflow when processing an overly long namespace from IMAP server. Reference: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3242 2006/06/25 Package: nmap Updated to 4.11. 2006/06/25 Package: coreutils Updated to 5.97. 2006/06/22 Package: gnupg SECURITY FIX Severity: high, remote, passive Updated to 1.4.3. Applied a fix for integer overflow vulnerability in packet processing that could allow a remote attacker to cause gpg to crash and possibly overwrite memory via a message packet with a large length. Reference: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3082 2006/06/12 Package: hdparm Updated to 6.6. 2006/06/12 Package: smartmontools; Owl/build/installorder.conf New package: control and monitor storage systems using S.M.A.R.T. 2006/06/06 Package: patchutils Updated to 0.2.31. 2006/06/06 Package: automake Updated to 1.9.6. 2006/06/06 Package: which Updated to 2.16. 2006/06/06 Package: e2fsprogs Updated to 1.39. 2006/06/06 Package: pam Updated to 0.99.4.0+. 2006/06/06 Package: make Updated to 3.81. 2006/06/06 Package: libtool Updated to 1.5.22. 2006/06/06 Package: bison Updated to 2.1. 2006/06/06 Package: bind Updated to 9.3.2. 2006/06/06 Package: vsftpd Updated to 2.0.4. 2006/06/06 Package: chkconfig Updated to 1.3.29. 2006/06/06 Package: bash Updated to 3.1 patchlevel 17. 2006/05/27 Package: coreutils Updated to 5.96. 2006/05/21 Package: coreutils Updated to 5.95. 2006/05/21 Packages: bc, gnupg, gdb, lftp, readline; Owl/build/installorder.conf Updated readline to 5.1 patchlevel 4. 2006/05/19 Package: acct Updated to 6.4-pre1. 2006/05/08 - 2006/05/15 Package: john Bitslice DES code for x86 with SSE2 and x86-64 with 64-bit mode extended SSE2 has been added for better performance at DES-based crypt(3) hashes on Pentium 4 and SSE2-capable AMD processors. Assorted high-level changes have been applied to improve performance on current x86-64 processors. 2006/05/07 Package: perl Updated to 5.8.8. 2006/05/01 Package: vixie-cron Updated to OpenBSD CVS snapshot dated 2006/04/26. Changed crontab(1) to use $TMPDIR for creating the temporary file. 2006/05/01 Package: lftp Updated to 3.4.6. 2006/04/26 Package: nmap Updated to 4.03. 2006/03/25 - 2006/04/20 Package: owl-setup Many fixes and enhancements which had been postponed for after Owl 2.0 release have now been implemented. This includes directly talking to PAM when setting the initial root password, quick searches in scroll lists with the ncurses/CDK-based interface, progress indicators with both user interfaces (currently, this is used for installation of kernel headers), and manual pages for both "settle" and "setup". 2006/04/19 Package: lftp Updated to 3.4.4. 2006/04/19 Package: setarch Updated to 2.0. 2006/04/04 - 2006/04/07 Packages: *; Owl/build/{.rpmmacros,.rpmrc,buildworld.conf,buildworld.sh} Ported Owl to the x86-64 architecture. 2006/04/06 Packages: db4, pam, perl, postfix; Owl/build/installworld.sh Updated db4 to 4.3.29. 2006/04/06 Package: postfix Updated to 2.2.10. 2006/04/06 Package: gettext Updated to 0.14.5. 2006/04/04 Package: bash Updated to 3.1 patchlevel 16. 2006/03/23 Package: netlist Updated to 2.1. 2006/03/23 Package: setarch Updated to 1.9. 2006/03/11 Package: postfix Updated to 2.2.9. 2006/03/11 Package: gnupg SECURITY FIX Severity: medium, indirect, passive Updated to 1.4.2.2. This includes fixes for the signature verification vulnerabilities discovered by Tavis Ormandy of Gentoo. References: http://lists.gnupg.org/pipermail/gnupg-announce/2006q1/000211.html http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0455 http://lists.gnupg.org/pipermail/gnupg-announce/2006q1/000216.html http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0049 2006/03/05 Package: nmap Updated to 4.02 Alpha1. 2006/02/27 - 2006/03/05 Package: john Applied many minor corrections, including for better handling of certain uncommon scenarios and improper uses of John. Added a "keyboard cracker" to the default john.conf that will try sequences of adjacent keys on a keyboard as passwords. 2006/02/28 Package: iptables Updated to 1.3.5. 2006/02/20 Package: sed Updated to 4.1.5. 2006/02/20 Package: coreutils Updated to 5.94. 2006/02/20 Package: bash Updated to 3.1 patchlevel 8. 2006/02/20 Package: tar SECURITY FIX Severity: high, local, passive Backported upstream fix for potential heap buffer overrun in handling extended headers. References: http://lists.gnu.org/archive/html/bug-tar/2005-06/msg00029.html http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0300 $Owl: Owl/doc/CHANGES-current,v 1.139 2008/08/23 21:32:24 solar Exp $