article.xml revision 127626
176082Sbmah<!-- 276082Sbmah FreeBSD errata document. Unlike some of the other RELNOTESng 376082Sbmah files, this file should remain as a single SGML file, so that 476082Sbmah the dollar FreeBSD dollar header has a meaningful modification 576082Sbmah time. This file is all but useless without a datestamp on it, 676082Sbmah so we'll take some extra care to make sure it has one. 776082Sbmah 876082Sbmah (If we didn't do this, then the file with the datestamp might 976082Sbmah not be the one that received the last change in the document.) 1076082Sbmah 1176082Sbmah--> 1276082Sbmah 1376082Sbmah<!DOCTYPE article PUBLIC "-//FreeBSD//DTD DocBook V4.1-Based Extension//EN" [ 1476082Sbmah<!ENTITY % man PUBLIC "-//FreeBSD//ENTITIES DocBook Manual Page Entities//EN"> 1576082Sbmah%man; 1676082Sbmah<!ENTITY % authors PUBLIC "-//FreeBSD//ENTITIES DocBook Author Entities//EN"> 1776082Sbmah%authors; 1876082Sbmah<!ENTITY % mlists PUBLIC "-//FreeBSD//ENTITIES DocBook Mailing List Entities//EN"> 1976082Sbmah%mlists; 20119884Ssimon<!ENTITY % trademarks PUBLIC "-//FreeBSD//ENTITIES DocBook Trademark Entities//EN"> 21119884Ssimon%trademarks; 2276082Sbmah<!ENTITY % release PUBLIC "-//FreeBSD//ENTITIES Release Specification//EN"> 2376082Sbmah%release; 24124312Sbmah<!ENTITY % misc PUBLIC "-//FreeBSD//ENTITIES DocBook Miscellaneous FreeBSD Entities//EN"> 25124312Sbmah%misc; 26126389Sbmah 27126389Sbmah<!ENTITY release.bugfix "5.2.1-RELEASE"> 2876082Sbmah]> 2976082Sbmah 3076082Sbmah<article> 3176082Sbmah <articleinfo> 32109307Sbmah <title>&os; 33109543Sbmah<![ %release.type.snapshot [ 34109543Sbmah &release.prev; 35109543Sbmah]]> 36109543Sbmah<![ %release.type.release [ 37109543Sbmah &release.current; 38109543Sbmah]]> 39109307Sbmah Errata</title> 4077914Sbmah 4176082Sbmah <corpauthor> 4276082Sbmah The &os; Project 4376082Sbmah </corpauthor> 4476082Sbmah 4576082Sbmah <pubdate>$FreeBSD: head/release/doc/en_US.ISO8859-1/errata/article.sgml 127626 2004-03-30 17:43:26Z kensmith $</pubdate> 4676082Sbmah 4776082Sbmah <copyright> 4876082Sbmah <year>2000</year> 4976082Sbmah <year>2001</year> 5088820Sbmah <year>2002</year> 51108829Sbmah <year>2003</year> 52124312Sbmah <year>2004</year> 5376082Sbmah <holder role="mailto:doc@FreeBSD.org">The FreeBSD Documentation Project</holder> 5476082Sbmah </copyright> 55119884Ssimon 56119884Ssimon <legalnotice id="trademarks" role="trademarks"> 57119884Ssimon &tm-attrib.freebsd; 58119884Ssimon &tm-attrib.intel; 59119884Ssimon &tm-attrib.sparc; 60119884Ssimon &tm-attrib.general; 61119884Ssimon </legalnotice> 6276082Sbmah </articleinfo> 6376082Sbmah 6477914Sbmah <abstract> 6579807Sbmah <para>This document lists errata items for &os; 66109543Sbmah<![ %release.type.snapshot [ 67109543Sbmah &release.prev;, 68109543Sbmah]]> 69109543Sbmah<![ %release.type.release [ 70109543Sbmah &release.current;, 71109543Sbmah]]> 72112874Sbmah containing significant information discovered after the release 73112874Sbmah or too late in the release cycle to be otherwise included in the 74112874Sbmah release documentation. 7592295Sbmah This information includes security advisories, as well as news 7692295Sbmah relating to the software or documentation that could affect its 7792295Sbmah operation or usability. An up-to-date version of this document 7892295Sbmah should always be consulted before installing this version of 7992295Sbmah &os;.</para> 8077914Sbmah 81126389Sbmah <para>This document also contains errata for &os; 82126389Sbmah &release.bugfix;, a <quote>point release</quote> made about one 83126389Sbmah month after &os; &release.prev;. Unless otherwise noted, all 84126389Sbmah errata items in this document apply to both &release.prev; 85126389Sbmah and &release.bugfix;.</para> 86126389Sbmah 87109307Sbmah <para>This errata document for &os; 88109543Sbmah<![ %release.type.snapshot [ 89109543Sbmah &release.prev; 90109543Sbmah]]> 91109543Sbmah<![ %release.type.release [ 92109543Sbmah &release.current; 93109543Sbmah]]> 94116130Sbmah will be maintained until the release of &os; &release.next;.</para> 9577914Sbmah </abstract> 9677914Sbmah 97109143Sroam <sect1 id="intro"> 9876082Sbmah <title>Introduction</title> 9976082Sbmah 10079807Sbmah <para>This errata document contains <quote>late-breaking news</quote> 10192295Sbmah about &os; 102109543Sbmah<![ %release.type.snapshot [ 103109543Sbmah &release.prev;. 104109543Sbmah]]> 105109543Sbmah<![ %release.type.release [ 106109543Sbmah &release.current;. 107109543Sbmah]]> 10892295Sbmah Before installing this version, it is important to consult this 10992295Sbmah document to learn about any post-release discoveries or problems 11092295Sbmah that may already have been found and fixed.</para> 11179807Sbmah 11292295Sbmah <para>Any version of this errata document actually distributed 11392295Sbmah with the release (for example, on a CDROM distribution) will be 11492295Sbmah out of date by definition, but other copies are kept updated on 11592295Sbmah the Internet and should be consulted as the <quote>current 11692295Sbmah errata</quote> for this release. These other copies of the 11792295Sbmah errata are located at <ulink 11892295Sbmah url="http://www.FreeBSD.org/releases/"></ulink>, plus any sites 11992295Sbmah which keep up-to-date mirrors of this location.</para> 12076082Sbmah 12179807Sbmah <para>Source and binary snapshots of &os; &release.branch; also 12292295Sbmah contain up-to-date copies of this document (as of the time of 12392295Sbmah the snapshot).</para> 12476082Sbmah 12577914Sbmah <para>For a list of all &os; CERT security advisories, see <ulink 12692295Sbmah url="http://www.FreeBSD.org/security/"></ulink> or <ulink 12792295Sbmah url="ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/"></ulink>.</para> 12892295Sbmah 12976082Sbmah </sect1> 13076082Sbmah 131109143Sroam <sect1 id="security"> 13276082Sbmah <title>Security Advisories</title> 133109309Sbmah 134115963Sbmah<![ %release.type.release [ 135115963Sbmah <para>No advisories.</para> 136115963Sbmah]]> 137109309Sbmah 138115963Sbmah<![ %release.type.snapshot [ 139125249Sbmah 140126389Sbmah <para>(30 Jan 2004, updated 28 Feb 2004) A bug in &man.mksnap.ffs.8; causes the creation of a 141125249Sbmah filesystem snapshot to reset the flags on the filesystem to 142125249Sbmah their default values. The possible consequences depend on local 143125249Sbmah usage, but can include disabling extended access control lists 144125249Sbmah or enabling the use of setuid executables stored on an untrusted 145125249Sbmah filesystem. This bug also affects the &man.dump.8; 146125249Sbmah <option>-L</option> option, which uses &man.mksnap.ffs.8;. Note 147125249Sbmah that &man.mksnap.ffs.8; is normally only available to the 148125249Sbmah superuser and members of the <groupname>operator</groupname> 149126599Srushani group. This bug has been fixed on the &os; &release.prev; 150126389Sbmah security fix branch and in &os; &release.bugfix;. For more information, see security advisory <ulink 151125249Sbmah url="ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-04:01.mksnap_ffs.asc">FreeBSD-SA-04:01</ulink>.</para> 152125249Sbmah 153126389Sbmah <para>(8 Feb 2004, updated 28 Feb 2004) A bug with the System V Shared Memory interface 154125606Sbmah (specifically the &man.shmat.2; system call) 155125606Sbmah can cause a shared memory segment to reference 156125606Sbmah unallocated kernel memory. In turn, this can permit a local 157125606Sbmah attacker to gain unauthorized access to parts of kernel memory, 158125606Sbmah possibly resulting in disclosure of sensitive information, 159125606Sbmah bypass of access control mechanisms, or privilege escalation. 160126599Srushani This bug has been fixed on the &os; &release.prev; 161126389Sbmah security fix branch and in &os; &release.bugfix;. 162125606Sbmah More details, including bugfix and workaround information, 163125606Sbmah can be found in security advisory <ulink 164125606Sbmah url="ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-04:02.shmat.asc">FreeBSD-SA-04:02</ulink>.</para> 165125606Sbmah 166126389Sbmah <para>(28 Feb 2004) It is possible, under some circumstances, for 167126389Sbmah a processor with superuser privileges inside a &man.jail.8; 168126389Sbmah environment to change its root directory to a different jail, 169126389Sbmah giving it read and write access to the files and directories 170126389Sbmah within. This vulnerability has been closed on the &os; 171126599Srushani &release.prev; security fix branch and in &os; 172126389Sbmah &release.bugfix;. Information on the bug fix can be found in 173126389Sbmah security advisory <ulink 174126629Sbmah url="ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-04:03.jail.asc">FreeBSD-SA-04:03</ulink>.</para> 175126389Sbmah 176126629Sbmah <para>(4 Mar 2004) It is possible for a remote attacker to conduct 177126629Sbmah a low-bandwidth denial-of-service attack against a machine 178126629Sbmah providing TCP-based services, filling up the target's memory 179126629Sbmah buffers and potentially leading to a system crash. This 180126629Sbmah vulnerability has been addressed on the &os; &release.prev; 181126629Sbmah security fix branch, but is present in both &os; &release.prev; 182126629Sbmah and &release.bugfix;. Security advisory <ulink 183126629Sbmah url="ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-04:04.tcp.asc">FreeBSD-SA-04:04</ulink> 184126629Sbmah contains more details, as well as information on patching 185126629Sbmah existing systems.</para> 186126629Sbmah 187127626Skensmith <para>(17 Mar 2004) By performing a specially crafted SSL/TLS 188127626Skensmith handshake with an application that uses OpenSSL a null pointer 189127626Skensmith may be dereferenced. This may in turn cause the application to 190127626Skensmith crash, resulting in a denial of service attack. For more information 191127626Skensmith see the Security Advisory <ulink 192127626Skensmith url="ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-04:05.openssl.asc">FreeBSD-SA-04:05</ulink> 193127626Skensmith which contains more details and instructions on how to patch existing 194127626Skensmith systems.</para> 195127626Skensmith 196127626Skensmith <para>(29 Mar 2004) A local attacker may take advantage of a 197127626Skensmith programming error in the handling of certain IPv6 socket options 198127626Skensmith in the &man.setsockopt.2; system call to read portions of kernel 199127626Skensmith memory without proper authorization. This may result in disclosure 200127626Skensmith of sensitive data, or potentially cause a panic. See Security 201127626Skensmith Advisory <ulink 202127626Skensmith url="ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-04:06.ipv6.asc">FreeBSD-SA-04:06</ulink> 203127626Skensmith for a more detailed description and instructions on how to patch 204127626Skensmith existing systems.</para> 205127626Skensmith 206115963Sbmah]]> 207111435Sbmah 208115963Sbmah </sect1> 209111435Sbmah 210115963Sbmah <sect1 id="open-issues"> 211115963Sbmah <title>Open Issues</title> 212111834Sbmah 213115963Sbmah<![ %release.type.release [ 214115963Sbmah <para>No open issues.</para> 215115963Sbmah]]> 216112435Sbmah 217115963Sbmah<![ %release.type.snapshot [ 218124312Sbmah 219124312Sbmah <para>(9 Jan 2004) Due to a change in &man.cpp.1; behavior, the 220124312Sbmah login screen for &man.xdm.1; is in black and white, even on 221124312Sbmah systems with color displays. As a workaround, update to a newer 222124312Sbmah version of the 223124312Sbmah <filename role="package">x11/XFree86-4-clients</filename> 224124312Sbmah port/package.</para> 225124312Sbmah 226124312Sbmah <para>(9 Jan 2004) There remain some residual problems with ACPI. 227124312Sbmah In some cases, systems may behave erratically, or hang at boot 228124312Sbmah time. As a workaround, disable ACPI, using the <quote>safe 229124312Sbmah mode</quote> option of the bootloader or using the 230124312Sbmah <varname>hint.acpi.0.disabled</varname> kernel environment 231124312Sbmah variable. These problems are being investigated. For problems 232124312Sbmah that have not already been reported (check the mailing list 233124312Sbmah archives <emphasis>before</emphasis> posting), sending the 234124312Sbmah output of &man.dmesg.8; and &man.acpidump.8; to the 235124312Sbmah &a.current; may help diagnose the problem.</para> 236124312Sbmah 237126389Sbmah <para>(9 Jan 2004, updated 28 Feb 2004) In some cases, ATA devices may behave 238124312Sbmah erratically, particularly SATA devices. Reported symptoms 239124352Sbmah include command timeouts or missing interrupts. These problems 240124312Sbmah appear to be timing-dependent, making them rather difficult to 241124312Sbmah isolate. Workarounds include:</para> 242124312Sbmah 243124312Sbmah <itemizedlist> 244124312Sbmah <listitem> 245124312Sbmah <para>Turn off ATA DMA using the <quote>safe mode</quote> 246124312Sbmah option of the bootloader or the 247124312Sbmah <varname>hw.ata.ata_dma</varname> sysctl variable.</para> 248124312Sbmah </listitem> 249124312Sbmah 250124312Sbmah <listitem> 251124312Sbmah <para>Use the host's BIOS setup options to put the ATA 252124312Sbmah controller in its <quote>legacy mode</quote>, if 253124312Sbmah available.</para> 254124312Sbmah </listitem> 255124312Sbmah 256124312Sbmah <listitem> 257124312Sbmah <para>Disable ACPI, for example using the <quote>safe mode</quote> 258124312Sbmah option of the bootloader or using the 259124312Sbmah <varname>hint.acpi.0.disabled</varname> kernel environment 260124312Sbmah variable.</para> 261124312Sbmah </listitem> 262124312Sbmah </itemizedlist> 263124312Sbmah 264126389Sbmah <para>Some of these problems were addressed in &os; 265126389Sbmah &release.bugfix; with the import of a newer &man.ata.4; from 266126389Sbmah &release.current;.</para> 267126389Sbmah 268124312Sbmah <para>(9 Jan 2004) Installing over NFS when using the install 269124312Sbmah floppies requires that the <filename>nfsclient.ko</filename> 270124312Sbmah module be manually loaded from the third floppy disk. This can 271124312Sbmah be done by following the prompts when &man.sysinstall.8; 272124312Sbmah launches to load a driver off of the third floppy disk.</para> 273124312Sbmah 274124312Sbmah <para>(9 Jan 2004) The use of multiple vchans (virtual audio 275124312Sbmah channels with dynamic mixing in software) in the &man.pcm.4; 276124312Sbmah driver has been known to cause some instability.</para> 277124312Sbmah 278124352Sbmah <para>(10 Jan 2004) Although APIC interrupt routing seems to work 279124352Sbmah correctly on many systems, on some others (such as some laptops) 280124352Sbmah it can cause various errors, such as &man.ata.4; errors or hangs 281124352Sbmah when starting or exiting X11. For these situations, it may be 282124352Sbmah advisable to disable APIC routing, using the <quote>safe 283124352Sbmah mode</quote> of the bootloader or the 284124352Sbmah <varname>hint.apic.0.disabled</varname> loader tunable. Note 285124352Sbmah that disabling APIC is not compatible with SMP systems.</para> 286124352Sbmah 287126389Sbmah <para>(10 Jan 2004, updated 28 Feb 2004) The NFSv4 client may panic when attempting an 288124352Sbmah NFSv4 operation against an NFSv3/NFSv2-only server. This 289124352Sbmah problem has been fixed with revision 1.4 of 290124352Sbmah <filename>src/sys/rpc/rpcclnt.c</filename> in &os; 291126389Sbmah &release.current;. It was also fixed in &os; 292126389Sbmah &release.bugfix;.</para> 293124352Sbmah 294126389Sbmah <para>(11 Jan 2004, updated 28 Feb 2004) Some problems have been encountered when using 295124484Sbmah third-party NSS modules, such as <filename>nss_ldap</filename>, 296124484Sbmah and groups with large membership lists. These have been fixed 297124484Sbmah with revision 1.2 of <filename>src/include/nss.h</filename> and 298124484Sbmah revision 1.2 of 299124484Sbmah <filename>src/lib/libc/net/nss_compat.c</filename> in &os; 300126389Sbmah &release.current;; this fix was backported to &os; 301126389Sbmah &release.bugfix;.</para> 302124484Sbmah 303124484Sbmah <para>(13 Jan 2004) The &os; &release.current; release notes 304124484Sbmah incorrectly stated that <application>GCC</application> was a 305124484Sbmah post-release GCC 3.3.3 snapshot. They should have stated that 306124484Sbmah GCC was a <emphasis>pre-release</emphasis> GCC 3.3.3 307124484Sbmah snapshot.</para> 308124484Sbmah 309126389Sbmah <para>(13 Jan 2004, updated 28 Feb 2004) The <filename 310124485Sbmah role="package">sysutils/kdeadmin3</filename> port/package has a 311124485Sbmah bug in the <application>KUser</application> component that can 312124485Sbmah cause deletion of the <username>root</username> user from the 313124485Sbmah system password file. Users are strongly urged to upgrade to 314126389Sbmah version 3.1.4_1 of this port/package. The package set included 315126389Sbmah with &os; &release.bugfix; contains the fixed version of this 316126389Sbmah package.</para> 317124485Sbmah 318126389Sbmah <para>(21 Jan 2004, updated 28 Feb 2004) Some bugs in the IPsec implementation imported 319124801Sbmah from the KAME Project can result in memory objects being freed 320124801Sbmah before all references to them were removed. Reported symptoms 321124801Sbmah include erratic behavior or kernel panics after flushing the 322124801Sbmah Security Policy Database (SPD). Some of these problems have 323124801Sbmah been fixed in &os; &release.current; in rev. 1.31 of 324124801Sbmah <filename>src/sys/netinet6/ipsec.c</filename>, rev. 1.136 of 325124801Sbmah <filename>src/sys/netinet/in_pcb.c</filename>, and revs. 1.63 326126389Sbmah and 1.64 of <filename>src/sys/netkey/key.c</filename>. These 327126389Sbmah bugfixes were backported to &os; &release.bugfix;. More 328124801Sbmah information about these problems has been posted to the 329124801Sbmah &a.current;, in particular the thread entitled <ulink 330124947Sbmah url="http://lists.FreeBSD.org/pipermail/freebsd-current/2004-January/thread.html#18084"> 331124801Sbmah <quote>[PATCH] IPSec fixes</quote></ulink>.</para> 332124801Sbmah 333126389Sbmah <para>(28 Feb 2004) The edition of the Porters Handbook included 334126389Sbmah with &os; &release.bugfix; contained an incorrect value for 335126389Sbmah &release.bugfix;'s <varname>__FreeBSD_version</varname>. The 336126389Sbmah correct value is <literal>502010</literal>.</para> 337126389Sbmah 338115963Sbmah]]> 339112477Sbmah 34076082Sbmah </sect1> 34176082Sbmah 342109309Sbmah <sect1 id="late-news"> 343109309Sbmah <title>Late-Breaking News</title> 344109309Sbmah 345115963Sbmah<![ %release.type.release [ 346115963Sbmah <para>No news.</para> 347115963Sbmah]]> 348109583Schris 349115963Sbmah<![ %release.type.snapshot [ 350124352Sbmah 351126389Sbmah <para>(10 Jan 2004, updated 28 Feb 2004) The TCP implementation in &os; now includes 352124352Sbmah protection against a certain class of TCP MSS resource 353124352Sbmah exhaustion attacks, in the form of limits on the size and rate 354124352Sbmah of TCP segments. The first limit sets the minimum allowed 355124352Sbmah maximum TCP segment size, and is controlled by the 356124352Sbmah <varname>net.inet.tcp.minmss</varname> sysctl variable (the 357124352Sbmah default value is <literal>216</literal> bytes). The second 358124352Sbmah limit is set by the 359124352Sbmah <varname>net.inet.tcp.minmssoverload</varname> variable, and 360124352Sbmah controls the maximum rate of connections whose average segment 361124352Sbmah size is less than <varname>net.inet.tcp.minmss</varname>. 362124352Sbmah Connections exceeding this packet rate are reset and dropped. 363124352Sbmah Because this feature was added late in the &release.prev; 364124352Sbmah release cycle, connection rate limiting is disabled by default, 365124352Sbmah but can be enabled manually by assigning a non-zero value to 366126389Sbmah <varname>net.inet.tcp.minmssoverload</varname>. This feature 367126389Sbmah was added to &os; &release.prev; too late for inclusion in its 368126389Sbmah release notes.</para> 369124352Sbmah 370115963Sbmah]]> 371109309Sbmah 372115963Sbmah </sect1> 373109583Schris 37476082Sbmah</article> 375