The &os; Project $FreeBSD: head/release/doc/en_US.ISO8859-1/errata/article.sgml 114253 2003-04-29 20:39:38Z hrs $ 2000 2001 2002 2003 The FreeBSD Documentation Project This document lists errata items for &os; containing significant information discovered after the release or too late in the release cycle to be otherwise included in the release documentation. This information includes security advisories, as well as news relating to the software or documentation that could affect its operation or usability. An up-to-date version of this document should always be consulted before installing this version of &os;. This errata document for &os; will be maintained until the release of &os; 5.1-RELEASE. This errata document contains late-breaking news about &os; Before installing this version, it is important to consult this document to learn about any post-release discoveries or problems that may already have been found and fixed. Any version of this errata document actually distributed with the release (for example, on a CDROM distribution) will be out of date by definition, but other copies are kept updated on the Internet and should be consulted as the current errata for this release. These other copies of the errata are located at , plus any sites which keep up-to-date mirrors of this location. Source and binary snapshots of &os; &release.branch; also contain up-to-date copies of this document (as of the time of the snapshot). For a list of all &os; CERT security advisories, see or . Remotely exploitable vulnerabilities in CVS could allow an attacker to execute arbitrary comands on a CVS server. More details can be found in security advisory FreeBSD-SA-03:01. A timing-based attack on OpenSSL, could allow a very powerful attacker access to plaintext under certain circumstances. This problem has been corrected in &os; &release.current; with an upgrade to OpenSSL 0.9.7. On supported security fix branches, this problem has been corrected with the import of OpenSSL 0.9.6i. See security advisory FreeBSD-SA-03:02 for more details. It may be possible to recover the shared secret key used by the implementation of the syncookies feature. This reduces its effectiveness in dealing with TCP SYN flood denial-of-service attacks. Workaround information and fixes are given in security advisory FreeBSD-SA-03:03. Due to buffer overflows in header parsing in sendmail, a remote attacker can create a specially-crafted message that may cause &man.sendmail.8; to execute arbitrary code with the privileges of the user running it, typically root. More information, including pointers to patches, can be found in security advisories FreeBSD-SA-03:04 and FreeBSD-SA-03:07. The XDR encoder/decoder does incorrect bounds-checking, which could allow a remote attacker to cause a denial-of-service. For bugfix information, see security advisory FreeBSD-SA-03:05. OpenSSL has been found vulnerable to two recently-disclosed attacks. Information on workarounds and patches for supported security branches is contained in security advisory FreeBSD-SA-03:06. GEOM The &man.geom.4;-based disk partitioning code in the kernel will not allow an open partition to be overwritten. This usually prevents the use of disklabel -B to update the boot blocks on a disk because the a partition overlaps the space where the boot blocks are stored. A suggested workaround is to boot from an alternate disk, a CDROM, or a fixit floppy. &man.dump.8; When using disk media with sector sizes larger than 512 bytes (for instance, &man.gbde.4; encrypted disks), the &man.dump.8; program fails to respect the larger sector size and cannot dump the partition. One possible workaround is to copy the entire file system in raw format and dump the copy. It is, for instance, possible to dump a file system stored in a regular file: &prompt.root; dd if=/dev/ad0s1d.bde of=/junk/ad0.dd bs=1m &prompt.root; dump 0f - /junk/ad0.dd | ... A simpler workaround is to use &man.tar.1; or &man.cpio.1; to make backup copies. &man.mly.4; Hangs were reported during &os; 5.0 snapshot installations when installing to &man.mly.4;-supported RAID arrays, in hardware configurations that appear to work fine under &os; 4.7-RELEASE. These problems have been corrected in &os; &release.current;. NETNCP/Netware File System Support NETNCP and nwfs appear to be as-yet unadapted for KSE, and hence not working. These have been fixed in &os; &release.current;. &man.iir.4; controller During installation, the &man.iir.4; controller appears to probe correctly, but finds no disk devices. &man.truss.1; race condition &man.truss.1; appears to contain a race condition during the start-up of debugging, which can result in &man.truss.1; failing to attach to the process before it exists. The symptom is that &man.truss.1; reports that it cannot open the &man.procfs.5; node supporting the process being debugged. A bug also appears to exist wherein &man.truss.1; will hang if &man.execve.2; returns ENOENT A further race appears to exist in which &man.truss.1; will return PIOCWAIT: Input/output error occasionally on startup. The fix for this sufficiently changes process execution handling that it has been deferred until after 5.0. Disk Partitioning in Installer Some bugs have been reported in &man.sysinstall.8; disk partitioning. One observed problem on the i386 is that &man.sysinstall.8; cannot recalculate the free space left on a disk after changing the type of an FDISK-type partition. Stale Documentation In some case, documentation (such as the FAQ or Handbook) has not been updated to take into account &os; &release.prev; features. Examples of areas where documentation is still needed include &man.gbde.8; and the new fast IPsec implementation. SMB File System Attempting to unmount smbfs shares may fail with Device busy errors even when the mount-point is not really busy. A workaround is to keep trying to unmount the share until it eventually succeeds. This bug has been fixed in &release.current;. Forcefully unmounting (umount -f) smbfs shares may cause a kernel panic. This bug has been fixed in &release.current;. &man.fstat.2; When called on a connected socket file descriptor, &man.fstat.2; is supposed to return the number of bytes available to read in the st_size member of struct stat. However, st_size is always erroneously reported as 0 on TCP sockets. This bug has been fixed in &release.current;. Kernel Event Queues The &man.kqueue.2; EVFILT_READ filter erroneously indicates that 0 bytes are available to be read on TCP sockets, regardless of the number of bytes that are actually available. The NOTE_LOWAT flag for EVFILT_READ is also broken on TCP sockets. This bug has been fixed in &release.current;. POSIX Named Semaphores &os; &release.prev; introduced support for POSIX named semaphores but the implementation contains a critical bug that causes &man.sem.open.3; to incorrectly handle the opening of the same semaphore multiple times by the same process, and that causes &man.sem.close.3; to crash calling programs. This bug has been fixed in &release.current;. /dev/tty Permissions &os; &release.prev; has a minor bug in how the permissions of /dev/tty are handled. This can be triggered by logging in as a non-root, non-tty group user, and using &man.su.1; to switch to a second non-root, non-tty group user. &man.ssh.1; will fail because it cannot open /dev/tty. This bug has been fixed in &release.current;. &man.growfs.8; &man.growfs.8; no longer works on &man.vinum.4; volumes (and presumably, on &man.geom.4; entities) since these subsystems no longer fake disklabels, but &man.growfs.8; insists on examining a label. IPFW &man.ipfw.4; skipto rules do not work when coupled with the log keyword. &man.ipfw.4; uid rules also do not work properly. These bugs have been fixed in &release.current;. Passwords and &man.adduser.8; &man.adduser.8; does not correctly handle setting user passwords containing special shell characters. This problem has been corrected in &release.current;. &man.xl.4; The &man.xl.4; driver has a timing bug that may cause a kernel panic (or other problems) when attempting to configure an interface. This bug has been fixed in &release.current;. ISC DHCP ISC DHCP was updated to 3.0.1rc11. This update was actually a part of &os; &release.prev;, but was not documented in the release notes. &man.amd.8; Interoperability &release.prev; contains some bugs in its non-blocking RPC code. The most noticeable side-effect of these bugs was that &man.amd.8; users were not able to mount volumes from a &release.prev; server. This bug has been fixed in &release.current;. nsswitch The release note documenting the addition of nsswitch support gave an incorrect name for the old resolver configuration file. It should have been listed as /etc/host.conf. Mailman Recently the mailing lists were changed from majordomo to the currently used Mailman list server. More information about using the new mailing lists can be found by visiting the FreeBSD Mailman Info Page.