OpenBSD patches -including local root hole

[n0cmonkey]

comments on deadly.org



<< "The mail(1) program can be made to execute arbitrary code in non interactive mode. this can be exploited using cron and the system startup scripts (by any local user with no privs) a patch is and advisory is available on the advisory page.
the 2.9 patch is at ftp://ftp.openbsd.org/pub/OpenBSD/patches/2.9/common/023_mail.patch the 3.0 patch is at ftp://ftp.openbsd.org/pub/OpenBSD/patches/3.0/common/018_mail.patch

the fix has also been applied to the stable branches." >>



There is an exploit in the wild for this one too, so if you have multiple users and you cant absolutely trust them all, fix this immediately (like 2 days ago).


OpenBSD errata page.
OpenBSD anoncvs page.

BUMPS and comments appreciated.

 

[Poontos]

n0c, OT, but:

What is your gripe with FreeBSD (the link in your sig.)? There is usually some truthful intent even if it is a "joke" for you to have that link.

 

[n0cmonkey]

<< n0c, OT, but:

What is your gripe with FreeBSD (the link in your sig.)? There is usually some truthful intent even if it is a "joke" for you to have that link. >>



Nothing major. I use FreeBSD on occassion. I like FreeBSD. If there was an OpenBSD spoof page like that Id throw that in there. If you cant laugh at yourself, who can you laugh at?

 

[Barnaby W. Füi]

<< At FreeBSD, 28901219283 developers working on security patches for the next millenium on every single one of our 2 architectures to ensure maximum capabilities on patch adds and revisions. >>


for some reason that really cracks me up 😛

 

[n0cmonkey]

<<

<< At FreeBSD, 28901219283 developers working on security patches for the next millenium on every single one of our 2 architectures to ensure maximum capabilities on patch adds and revisions. >>


for some reason that really cracks me up 😛 >>



😉

They also have a linux.com one thats pretty funny.

 

[DnetMHZ]

Thanks for the link!

<< off to patch the servers

 

[n0cmonkey]

<< Thanks for the link!

<< off to patch the servers >>



Working on that now :/