article.xml revision 129078
176082Sbmah<!-- 276082Sbmah FreeBSD errata document. Unlike some of the other RELNOTESng 376082Sbmah files, this file should remain as a single SGML file, so that 476082Sbmah the dollar FreeBSD dollar header has a meaningful modification 576082Sbmah time. This file is all but useless without a datestamp on it, 676082Sbmah so we'll take some extra care to make sure it has one. 776082Sbmah 876082Sbmah (If we didn't do this, then the file with the datestamp might 976082Sbmah not be the one that received the last change in the document.) 1076082Sbmah 1176082Sbmah--> 1276082Sbmah 1376082Sbmah<!DOCTYPE article PUBLIC "-//FreeBSD//DTD DocBook V4.1-Based Extension//EN" [ 1476082Sbmah<!ENTITY % man PUBLIC "-//FreeBSD//ENTITIES DocBook Manual Page Entities//EN"> 1576082Sbmah%man; 1676082Sbmah<!ENTITY % authors PUBLIC "-//FreeBSD//ENTITIES DocBook Author Entities//EN"> 1776082Sbmah%authors; 1876082Sbmah<!ENTITY % mlists PUBLIC "-//FreeBSD//ENTITIES DocBook Mailing List Entities//EN"> 1976082Sbmah%mlists; 20119884Ssimon<!ENTITY % trademarks PUBLIC "-//FreeBSD//ENTITIES DocBook Trademark Entities//EN"> 21119884Ssimon%trademarks; 2276082Sbmah<!ENTITY % release PUBLIC "-//FreeBSD//ENTITIES Release Specification//EN"> 2376082Sbmah%release; 24124312Sbmah<!ENTITY % misc PUBLIC "-//FreeBSD//ENTITIES DocBook Miscellaneous FreeBSD Entities//EN"> 25124312Sbmah%misc; 26126389Sbmah 27126389Sbmah<!ENTITY release.bugfix "5.2.1-RELEASE"> 2876082Sbmah]> 2976082Sbmah 3076082Sbmah<article> 3176082Sbmah <articleinfo> 32109307Sbmah <title>&os; 33109543Sbmah<![ %release.type.snapshot [ 34109543Sbmah &release.prev; 35109543Sbmah]]> 36109543Sbmah<![ %release.type.release [ 37109543Sbmah &release.current; 38109543Sbmah]]> 39109307Sbmah Errata</title> 4077914Sbmah 4176082Sbmah <corpauthor> 4276082Sbmah The &os; Project 4376082Sbmah </corpauthor> 4476082Sbmah 4576082Sbmah <pubdate>$FreeBSD: head/release/doc/en_US.ISO8859-1/errata/article.sgml 129078 2004-05-09 23:07:08Z bmah $</pubdate> 4676082Sbmah 4776082Sbmah <copyright> 4876082Sbmah <year>2000</year> 4976082Sbmah <year>2001</year> 5088820Sbmah <year>2002</year> 51108829Sbmah <year>2003</year> 52124312Sbmah <year>2004</year> 5376082Sbmah <holder role="mailto:doc@FreeBSD.org">The FreeBSD Documentation Project</holder> 5476082Sbmah </copyright> 55119884Ssimon 56119884Ssimon <legalnotice id="trademarks" role="trademarks"> 57119884Ssimon &tm-attrib.freebsd; 58119884Ssimon &tm-attrib.intel; 59119884Ssimon &tm-attrib.sparc; 60119884Ssimon &tm-attrib.general; 61119884Ssimon </legalnotice> 6276082Sbmah </articleinfo> 6376082Sbmah 6477914Sbmah <abstract> 6579807Sbmah <para>This document lists errata items for &os; 66109543Sbmah<![ %release.type.snapshot [ 67109543Sbmah &release.prev;, 68109543Sbmah]]> 69109543Sbmah<![ %release.type.release [ 70109543Sbmah &release.current;, 71109543Sbmah]]> 72112874Sbmah containing significant information discovered after the release 73112874Sbmah or too late in the release cycle to be otherwise included in the 74112874Sbmah release documentation. 7592295Sbmah This information includes security advisories, as well as news 7692295Sbmah relating to the software or documentation that could affect its 7792295Sbmah operation or usability. An up-to-date version of this document 7892295Sbmah should always be consulted before installing this version of 7992295Sbmah &os;.</para> 8077914Sbmah 81126389Sbmah <para>This document also contains errata for &os; 82126389Sbmah &release.bugfix;, a <quote>point release</quote> made about one 83126389Sbmah month after &os; &release.prev;. Unless otherwise noted, all 84126389Sbmah errata items in this document apply to both &release.prev; 85126389Sbmah and &release.bugfix;.</para> 86126389Sbmah 87109307Sbmah <para>This errata document for &os; 88109543Sbmah<![ %release.type.snapshot [ 89109543Sbmah &release.prev; 90109543Sbmah]]> 91109543Sbmah<![ %release.type.release [ 92109543Sbmah &release.current; 93109543Sbmah]]> 94116130Sbmah will be maintained until the release of &os; &release.next;.</para> 9577914Sbmah </abstract> 9677914Sbmah 97109143Sroam <sect1 id="intro"> 9876082Sbmah <title>Introduction</title> 9976082Sbmah 10079807Sbmah <para>This errata document contains <quote>late-breaking news</quote> 10192295Sbmah about &os; 102109543Sbmah<![ %release.type.snapshot [ 103109543Sbmah &release.prev;. 104109543Sbmah]]> 105109543Sbmah<![ %release.type.release [ 106109543Sbmah &release.current;. 107109543Sbmah]]> 10892295Sbmah Before installing this version, it is important to consult this 10992295Sbmah document to learn about any post-release discoveries or problems 11092295Sbmah that may already have been found and fixed.</para> 11179807Sbmah 11292295Sbmah <para>Any version of this errata document actually distributed 11392295Sbmah with the release (for example, on a CDROM distribution) will be 11492295Sbmah out of date by definition, but other copies are kept updated on 11592295Sbmah the Internet and should be consulted as the <quote>current 11692295Sbmah errata</quote> for this release. These other copies of the 11792295Sbmah errata are located at <ulink 11892295Sbmah url="http://www.FreeBSD.org/releases/"></ulink>, plus any sites 11992295Sbmah which keep up-to-date mirrors of this location.</para> 12076082Sbmah 12179807Sbmah <para>Source and binary snapshots of &os; &release.branch; also 12292295Sbmah contain up-to-date copies of this document (as of the time of 12392295Sbmah the snapshot).</para> 12476082Sbmah 12577914Sbmah <para>For a list of all &os; CERT security advisories, see <ulink 12692295Sbmah url="http://www.FreeBSD.org/security/"></ulink> or <ulink 12792295Sbmah url="ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/"></ulink>.</para> 12892295Sbmah 12976082Sbmah </sect1> 13076082Sbmah 131109143Sroam <sect1 id="security"> 13276082Sbmah <title>Security Advisories</title> 133109309Sbmah 134115963Sbmah<![ %release.type.release [ 135115963Sbmah <para>No advisories.</para> 136115963Sbmah]]> 137109309Sbmah 138115963Sbmah<![ %release.type.snapshot [ 139125249Sbmah 140126389Sbmah <para>(30 Jan 2004, updated 28 Feb 2004) A bug in &man.mksnap.ffs.8; causes the creation of a 141125249Sbmah filesystem snapshot to reset the flags on the filesystem to 142125249Sbmah their default values. The possible consequences depend on local 143125249Sbmah usage, but can include disabling extended access control lists 144125249Sbmah or enabling the use of setuid executables stored on an untrusted 145125249Sbmah filesystem. This bug also affects the &man.dump.8; 146125249Sbmah <option>-L</option> option, which uses &man.mksnap.ffs.8;. Note 147125249Sbmah that &man.mksnap.ffs.8; is normally only available to the 148125249Sbmah superuser and members of the <groupname>operator</groupname> 149126599Srushani group. This bug has been fixed on the &os; &release.prev; 150126389Sbmah security fix branch and in &os; &release.bugfix;. For more information, see security advisory <ulink 151125249Sbmah url="ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-04:01.mksnap_ffs.asc">FreeBSD-SA-04:01</ulink>.</para> 152125249Sbmah 153126389Sbmah <para>(8 Feb 2004, updated 28 Feb 2004) A bug with the System V Shared Memory interface 154125606Sbmah (specifically the &man.shmat.2; system call) 155125606Sbmah can cause a shared memory segment to reference 156125606Sbmah unallocated kernel memory. In turn, this can permit a local 157125606Sbmah attacker to gain unauthorized access to parts of kernel memory, 158125606Sbmah possibly resulting in disclosure of sensitive information, 159125606Sbmah bypass of access control mechanisms, or privilege escalation. 160126599Srushani This bug has been fixed on the &os; &release.prev; 161126389Sbmah security fix branch and in &os; &release.bugfix;. 162125606Sbmah More details, including bugfix and workaround information, 163125606Sbmah can be found in security advisory <ulink 164125606Sbmah url="ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-04:02.shmat.asc">FreeBSD-SA-04:02</ulink>.</para> 165125606Sbmah 166126389Sbmah <para>(28 Feb 2004) It is possible, under some circumstances, for 167126389Sbmah a processor with superuser privileges inside a &man.jail.8; 168126389Sbmah environment to change its root directory to a different jail, 169126389Sbmah giving it read and write access to the files and directories 170126389Sbmah within. This vulnerability has been closed on the &os; 171126599Srushani &release.prev; security fix branch and in &os; 172126389Sbmah &release.bugfix;. Information on the bug fix can be found in 173126389Sbmah security advisory <ulink 174126629Sbmah url="ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-04:03.jail.asc">FreeBSD-SA-04:03</ulink>.</para> 175126389Sbmah 176126629Sbmah <para>(4 Mar 2004) It is possible for a remote attacker to conduct 177126629Sbmah a low-bandwidth denial-of-service attack against a machine 178126629Sbmah providing TCP-based services, filling up the target's memory 179126629Sbmah buffers and potentially leading to a system crash. This 180126629Sbmah vulnerability has been addressed on the &os; &release.prev; 181126629Sbmah security fix branch, but is present in both &os; &release.prev; 182126629Sbmah and &release.bugfix;. Security advisory <ulink 183126629Sbmah url="ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-04:04.tcp.asc">FreeBSD-SA-04:04</ulink> 184126629Sbmah contains more details, as well as information on patching 185126629Sbmah existing systems.</para> 186126629Sbmah 187127626Skensmith <para>(17 Mar 2004) By performing a specially crafted SSL/TLS 188127626Skensmith handshake with an application that uses OpenSSL a null pointer 189127626Skensmith may be dereferenced. This may in turn cause the application to 190127626Skensmith crash, resulting in a denial of service attack. For more information 191127626Skensmith see the Security Advisory <ulink 192127626Skensmith url="ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-04:05.openssl.asc">FreeBSD-SA-04:05</ulink> 193127626Skensmith which contains more details and instructions on how to patch existing 194127626Skensmith systems.</para> 195127626Skensmith 196127626Skensmith <para>(29 Mar 2004) A local attacker may take advantage of a 197127626Skensmith programming error in the handling of certain IPv6 socket options 198127626Skensmith in the &man.setsockopt.2; system call to read portions of kernel 199127626Skensmith memory without proper authorization. This may result in disclosure 200127626Skensmith of sensitive data, or potentially cause a panic. See Security 201127626Skensmith Advisory <ulink 202127626Skensmith url="ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-04:06.ipv6.asc">FreeBSD-SA-04:06</ulink> 203127626Skensmith for a more detailed description and instructions on how to patch 204127626Skensmith existing systems.</para> 205127626Skensmith 206129078Sbmah <para>(9 May 2004) Two programming errors in 207129078Sbmah <application>CVS</application> can allow a server to overwrite 208129078Sbmah arbitrary files on the client, and a client to read arbitrary 209129078Sbmah files on the server when accessing remote CVS repositories. 210129078Sbmah More details, including patch and upgrade information, can be 211129078Sbmah found in security advisory <ulink 212129078Sbmah url="ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-04:07.cvs.asc">FreeBSD-SA-04:07</ulink>.</para> 213129078Sbmah 214129078Sbmah <para>(9 May 2004) <application>Heimdal</application> may, under 215129078Sbmah some circumstances, not perform adequate checking of 216129078Sbmah authentication across autonomous realms. For more information, 217129078Sbmah see security advisory <ulink 218129078Sbmah url="ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-04:08.heimdal.asc">FreeBSD-SA-04:08</ulink>.</para> 219129078Sbmah 220115963Sbmah]]> 221111435Sbmah 222115963Sbmah </sect1> 223111435Sbmah 224115963Sbmah <sect1 id="open-issues"> 225115963Sbmah <title>Open Issues</title> 226111834Sbmah 227115963Sbmah<![ %release.type.release [ 228115963Sbmah <para>No open issues.</para> 229115963Sbmah]]> 230112435Sbmah 231115963Sbmah<![ %release.type.snapshot [ 232124312Sbmah 233124312Sbmah <para>(9 Jan 2004) Due to a change in &man.cpp.1; behavior, the 234124312Sbmah login screen for &man.xdm.1; is in black and white, even on 235124312Sbmah systems with color displays. As a workaround, update to a newer 236124312Sbmah version of the 237124312Sbmah <filename role="package">x11/XFree86-4-clients</filename> 238124312Sbmah port/package.</para> 239124312Sbmah 240124312Sbmah <para>(9 Jan 2004) There remain some residual problems with ACPI. 241124312Sbmah In some cases, systems may behave erratically, or hang at boot 242124312Sbmah time. As a workaround, disable ACPI, using the <quote>safe 243124312Sbmah mode</quote> option of the bootloader or using the 244124312Sbmah <varname>hint.acpi.0.disabled</varname> kernel environment 245124312Sbmah variable. These problems are being investigated. For problems 246124312Sbmah that have not already been reported (check the mailing list 247124312Sbmah archives <emphasis>before</emphasis> posting), sending the 248124312Sbmah output of &man.dmesg.8; and &man.acpidump.8; to the 249124312Sbmah &a.current; may help diagnose the problem.</para> 250124312Sbmah 251126389Sbmah <para>(9 Jan 2004, updated 28 Feb 2004) In some cases, ATA devices may behave 252124312Sbmah erratically, particularly SATA devices. Reported symptoms 253124352Sbmah include command timeouts or missing interrupts. These problems 254124312Sbmah appear to be timing-dependent, making them rather difficult to 255124312Sbmah isolate. Workarounds include:</para> 256124312Sbmah 257124312Sbmah <itemizedlist> 258124312Sbmah <listitem> 259124312Sbmah <para>Turn off ATA DMA using the <quote>safe mode</quote> 260124312Sbmah option of the bootloader or the 261124312Sbmah <varname>hw.ata.ata_dma</varname> sysctl variable.</para> 262124312Sbmah </listitem> 263124312Sbmah 264124312Sbmah <listitem> 265124312Sbmah <para>Use the host's BIOS setup options to put the ATA 266124312Sbmah controller in its <quote>legacy mode</quote>, if 267124312Sbmah available.</para> 268124312Sbmah </listitem> 269124312Sbmah 270124312Sbmah <listitem> 271124312Sbmah <para>Disable ACPI, for example using the <quote>safe mode</quote> 272124312Sbmah option of the bootloader or using the 273124312Sbmah <varname>hint.acpi.0.disabled</varname> kernel environment 274124312Sbmah variable.</para> 275124312Sbmah </listitem> 276124312Sbmah </itemizedlist> 277124312Sbmah 278126389Sbmah <para>Some of these problems were addressed in &os; 279126389Sbmah &release.bugfix; with the import of a newer &man.ata.4; from 280126389Sbmah &release.current;.</para> 281126389Sbmah 282124312Sbmah <para>(9 Jan 2004) Installing over NFS when using the install 283124312Sbmah floppies requires that the <filename>nfsclient.ko</filename> 284124312Sbmah module be manually loaded from the third floppy disk. This can 285124312Sbmah be done by following the prompts when &man.sysinstall.8; 286124312Sbmah launches to load a driver off of the third floppy disk.</para> 287124312Sbmah 288124312Sbmah <para>(9 Jan 2004) The use of multiple vchans (virtual audio 289124312Sbmah channels with dynamic mixing in software) in the &man.pcm.4; 290124312Sbmah driver has been known to cause some instability.</para> 291124312Sbmah 292124352Sbmah <para>(10 Jan 2004) Although APIC interrupt routing seems to work 293124352Sbmah correctly on many systems, on some others (such as some laptops) 294124352Sbmah it can cause various errors, such as &man.ata.4; errors or hangs 295124352Sbmah when starting or exiting X11. For these situations, it may be 296124352Sbmah advisable to disable APIC routing, using the <quote>safe 297124352Sbmah mode</quote> of the bootloader or the 298124352Sbmah <varname>hint.apic.0.disabled</varname> loader tunable. Note 299124352Sbmah that disabling APIC is not compatible with SMP systems.</para> 300124352Sbmah 301126389Sbmah <para>(10 Jan 2004, updated 28 Feb 2004) The NFSv4 client may panic when attempting an 302124352Sbmah NFSv4 operation against an NFSv3/NFSv2-only server. This 303124352Sbmah problem has been fixed with revision 1.4 of 304124352Sbmah <filename>src/sys/rpc/rpcclnt.c</filename> in &os; 305126389Sbmah &release.current;. It was also fixed in &os; 306126389Sbmah &release.bugfix;.</para> 307124352Sbmah 308126389Sbmah <para>(11 Jan 2004, updated 28 Feb 2004) Some problems have been encountered when using 309124484Sbmah third-party NSS modules, such as <filename>nss_ldap</filename>, 310124484Sbmah and groups with large membership lists. These have been fixed 311124484Sbmah with revision 1.2 of <filename>src/include/nss.h</filename> and 312124484Sbmah revision 1.2 of 313124484Sbmah <filename>src/lib/libc/net/nss_compat.c</filename> in &os; 314126389Sbmah &release.current;; this fix was backported to &os; 315126389Sbmah &release.bugfix;.</para> 316124484Sbmah 317124484Sbmah <para>(13 Jan 2004) The &os; &release.current; release notes 318124484Sbmah incorrectly stated that <application>GCC</application> was a 319124484Sbmah post-release GCC 3.3.3 snapshot. They should have stated that 320124484Sbmah GCC was a <emphasis>pre-release</emphasis> GCC 3.3.3 321124484Sbmah snapshot.</para> 322124484Sbmah 323126389Sbmah <para>(13 Jan 2004, updated 28 Feb 2004) The <filename 324124485Sbmah role="package">sysutils/kdeadmin3</filename> port/package has a 325124485Sbmah bug in the <application>KUser</application> component that can 326124485Sbmah cause deletion of the <username>root</username> user from the 327124485Sbmah system password file. Users are strongly urged to upgrade to 328126389Sbmah version 3.1.4_1 of this port/package. The package set included 329126389Sbmah with &os; &release.bugfix; contains the fixed version of this 330126389Sbmah package.</para> 331124485Sbmah 332126389Sbmah <para>(21 Jan 2004, updated 28 Feb 2004) Some bugs in the IPsec implementation imported 333124801Sbmah from the KAME Project can result in memory objects being freed 334124801Sbmah before all references to them were removed. Reported symptoms 335124801Sbmah include erratic behavior or kernel panics after flushing the 336124801Sbmah Security Policy Database (SPD). Some of these problems have 337124801Sbmah been fixed in &os; &release.current; in rev. 1.31 of 338124801Sbmah <filename>src/sys/netinet6/ipsec.c</filename>, rev. 1.136 of 339124801Sbmah <filename>src/sys/netinet/in_pcb.c</filename>, and revs. 1.63 340126389Sbmah and 1.64 of <filename>src/sys/netkey/key.c</filename>. These 341126389Sbmah bugfixes were backported to &os; &release.bugfix;. More 342124801Sbmah information about these problems has been posted to the 343124801Sbmah &a.current;, in particular the thread entitled <ulink 344124947Sbmah url="http://lists.FreeBSD.org/pipermail/freebsd-current/2004-January/thread.html#18084"> 345124801Sbmah <quote>[PATCH] IPSec fixes</quote></ulink>.</para> 346124801Sbmah 347126389Sbmah <para>(28 Feb 2004) The edition of the Porters Handbook included 348126389Sbmah with &os; &release.bugfix; contained an incorrect value for 349126389Sbmah &release.bugfix;'s <varname>__FreeBSD_version</varname>. The 350126389Sbmah correct value is <literal>502010</literal>.</para> 351126389Sbmah 352115963Sbmah]]> 353112477Sbmah 35476082Sbmah </sect1> 35576082Sbmah 356109309Sbmah <sect1 id="late-news"> 357109309Sbmah <title>Late-Breaking News</title> 358109309Sbmah 359115963Sbmah<![ %release.type.release [ 360115963Sbmah <para>No news.</para> 361115963Sbmah]]> 362109583Schris 363115963Sbmah<![ %release.type.snapshot [ 364124352Sbmah 365126389Sbmah <para>(10 Jan 2004, updated 28 Feb 2004) The TCP implementation in &os; now includes 366124352Sbmah protection against a certain class of TCP MSS resource 367124352Sbmah exhaustion attacks, in the form of limits on the size and rate 368124352Sbmah of TCP segments. The first limit sets the minimum allowed 369124352Sbmah maximum TCP segment size, and is controlled by the 370124352Sbmah <varname>net.inet.tcp.minmss</varname> sysctl variable (the 371124352Sbmah default value is <literal>216</literal> bytes). The second 372124352Sbmah limit is set by the 373124352Sbmah <varname>net.inet.tcp.minmssoverload</varname> variable, and 374124352Sbmah controls the maximum rate of connections whose average segment 375124352Sbmah size is less than <varname>net.inet.tcp.minmss</varname>. 376124352Sbmah Connections exceeding this packet rate are reset and dropped. 377124352Sbmah Because this feature was added late in the &release.prev; 378124352Sbmah release cycle, connection rate limiting is disabled by default, 379124352Sbmah but can be enabled manually by assigning a non-zero value to 380126389Sbmah <varname>net.inet.tcp.minmssoverload</varname>. This feature 381126389Sbmah was added to &os; &release.prev; too late for inclusion in its 382126389Sbmah release notes.</para> 383124352Sbmah 384115963Sbmah]]> 385109309Sbmah 386115963Sbmah </sect1> 387109583Schris 38876082Sbmah</article> 389