FreeBSD 4.9-RELEASE Errata

1 Introduction

This errata document contains ``late-breaking news'' about FreeBSD 4.9-RELEASE. Before installing this version, it is important to consult this document to learn about any post-release discoveries or problems that may already have been found and fixed.

Any version of this errata document actually distributed with the release (for example, on a CDROM distribution) will be out of date by definition, but other copies are kept updated on the Internet and should be consulted as the ``current errata'' for this release. These other copies of the errata are located at http://www.FreeBSD.org/releases/, plus any sites which keep up-to-date mirrors of this location.

Source and binary snapshots of FreeBSD 4-STABLE also contain up-to-date copies of this document (as of the time of the snapshot).

For a list of all FreeBSD CERT security advisories, see http://www.FreeBSD.org/security/ or ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/.

2 Security Advisories

(5 Dec 2003) BIND contains the potential for a denial-of-service attack. This vulnerability has been addressed by a vendor patch on the 4.9-RELEASE security fix branch and by the import of a new version to the 4-STABLE development branch. For more information, see FreeBSD-SA-03:19.

(8 Feb 2004) A bug with the System V Shared Memory interface (specifically the shmat(2) system call) can cause a shared memory segment to reference unallocated kernel memory. In turn, this can permit a local attacker to gain unauthorized access to parts of kernel memory, possibly resulting in disclosure of sensitive information, bypass of access control mechanisms, or privilege escalation. More details, including bugfix and workaround information, can be found in security advisory FreeBSD-SA-04:02.

(4 Mar 2004) It is possible for a remote attacker to conduct a low-bandwidth denial-of-service attack against a machine providing TCP-based services, filling up the target's memory buffers and potentially leading to a system crash. This vulnerability has been addressed on the FreeBSD 4.9-RELEASE security fix branch. Security advisory FreeBSD-SA-04:04 contains more details, as well as information on patching existing systems.

(17 Mar 2004) By performing a specially crafted SSL/TLS handshake with an application that uses OpenSSL a null pointer may be dereferenced. This may in turn cause the application to crash, resulting in a denial of service attack. For more information see the Security Advisory FreeBSD-SA-04:05 which contains more details and instructions on how to patch existing systems.

3 Late-Breaking News

(28 Oct 2003) Very late in the release cycle, a change was made to the HyperThreading (HTT) support on Intel® processors. HTT support is now enabled by default on SMP-capable kernels; as a result, the HTT kernel option is unnecessary and has been removed. The extra logical CPUs are always started so that they can handle interrupts, but are prevented from executing user processes by default. To enable the logical CPUs, change the value of the machdep.hlt_logical_cpus sysctl(8) variable from 1 to 0. This value can also be set from the loader as a tunable of the same name. This behavior is now identical to FreeBSD 5.X.

(29 Oct 2003) Some of the packages contained in the first CD-ROM depend on different versions of the OpenLDAP packages, which cannot co-exist on the same host. One manifestation of this problem is that it is not possible to install both the x11/gnome2 and x11/kde3 packages.

(30 Oct 2003) It appears that the crypto distribution is required for correct functioning of the FreeBSD base system. At the very least, the libraries contained in the crypto distribution are required for pkg_add(1).

(30 Oct 2003) There are known cases of fairly-recent i386 machines with BIOSes that do not support booting from emulation mode El Torito CDROMs. This prevents booting from the FreeBSD 4.9-STABLE CDROMs. As a workaround, download the floppy disk images, use them to boot the machine into sysinstall(8), and then do a CDROM install. This problem does not seem to be wide-spread as of this writing.

(10 Nov 2003) An update was made to the xterm entry in the termcap(5) database which, among other things, removed the (already deprecated) bs backspacing capability. The hack(6) game appears to depend on this capability and hence fails when run from inside a window with a terminal type of xterm.

(10 Nov 2003) Tagged queueing in the ata(4) driver is broken and appears to cause kernel panics.