---

1 Introduction

This errata document contains ``late-breaking news'' about FreeBSD 5.0-RELEASE. Before installing this version, it is important to consult this document to learn about any post-release discoveries or problems that may already have been found and fixed.

Any version of this errata document actually distributed with the release (for example, on a CDROM distribution) will be out of date by definition, but other copies are kept updated on the Internet and should be consulted as the ``current errata'' for this release. These other copies of the errata are located at http://www.FreeBSD.org/releases/, plus any sites which keep up-to-date mirrors of this location.

Source and binary snapshots of FreeBSD 5-CURRENT also contain up-to-date copies of this document (as of the time of the snapshot).

For a list of all FreeBSD CERT security advisories, see http://www.FreeBSD.org/security/ or ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/.

---

2 Security Advisories

Remotely exploitable vulnerabilities in CVS could allow an attacker to execute arbitrary comands on a CVS server. More details can be found in security advisory FreeBSD-SA-03:01.

A timing-based attack on OpenSSL, could allow a very powerful attacker access to plaintext under certain circumstances. This problem has been corrected in FreeBSD 5.0-CURRENT with an upgrade to OpenSSL 0.9.7. On supported security fix branches, this problem has been corrected with the import of OpenSSL 0.9.6i. See security advisory FreeBSD-SA-03:02 for more details.

It may be possible to recover the shared secret key used by the implementation of the ``syncookies'' feature. This reduces its effectiveness in dealing with TCP SYN flood denial-of-service attacks. Workaround information and fixes are given in security advisory FreeBSD-SA-03:03.

Due to buffer overflows in header parsing in sendmail, a remote attacker can create a specially-crafted message that may cause sendmail(8) to execute arbitrary code with the privileges of the user running it, typically root. More information, including pointers to patches, can be found in security advisories FreeBSD-SA-03:04 and FreeBSD-SA-03:07.

The XDR encoder/decoder does incorrect bounds-checking, which could allow a remote attacker to cause a denial-of-service. For bugfix information, see security advisory FreeBSD-SA-03:05.

OpenSSL has been found vulnerable to two recently-disclosed attacks. Information on workarounds and patches for supported security branches is contained in security advisory FreeBSD-SA-03:06.

---

3 Late-Breaking News

GEOM

The geom(4)-based disk partitioning code in the kernel will not allow an open partition to be overwritten. This usually prevents the use of disklabel -B to update the boot blocks on a disk because the a partition overlaps the space where the boot blocks are stored. A suggested workaround is to boot from an alternate disk, a CDROM, or a fixit floppy.

dump(8)

When using disk media with sector sizes larger than 512 bytes (for instance, gbde(4) encrypted disks), the dump(8) program fails to respect the larger sector size and cannot dump the partition. One possible workaround is to copy the entire file system in raw format and dump the copy. It is, for instance, possible to dump a file system stored in a regular file:

# dd if=/dev/ad0s1d.bde of=/junk/ad0.dd bs=1m
# dump 0f - /junk/ad0.dd | ...

A simpler workaround is to use tar(1) or cpio(1) to make backup copies.

mly(4)

Hangs were reported during FreeBSD 5.0 snapshot installations when installing to mly(4)-supported RAID arrays, in hardware configurations that appear to work fine under FreeBSD 4.7-RELEASE. These problems have been corrected in FreeBSD 5.0-CURRENT.

NETNCP/Netware File System Support

NETNCP and nwfs appear to be as-yet unadapted for KSE, and hence not working. These have been fixed in FreeBSD 5.0-CURRENT.

iir(4) controller

During installation, the iir(4) controller appears to probe correctly, but finds no disk devices.

truss(1) race condition

truss(1) appears to contain a race condition during the start-up of debugging, which can result in truss(1) failing to attach to the process before it exists. The symptom is that truss(1) reports that it cannot open the procfs(5) node supporting the process being debugged. A bug also appears to exist wherein truss(1) will hang if execve(2) returns ENOENT A further race appears to exist in which truss(1) will return ``PIOCWAIT: Input/output error'' occasionally on startup. The fix for this sufficiently changes process execution handling that it has been deferred until after 5.0.

Disk Partitioning in Installer

Some bugs have been reported in sysinstall(8) disk partitioning. One observed problem on the i386 is that sysinstall(8) cannot recalculate the free space left on a disk after changing the type of an FDISK-type partition.

Stale Documentation

In some case, documentation (such as the FAQ or Handbook) has not been updated to take into account FreeBSD 5.0-RELEASE features. Examples of areas where documentation is still needed include gbde(8) and the new ``fast IPsec'' implementation.

SMB File System

Attempting to unmount smbfs shares may fail with ``Device busy'' errors even when the mount-point is not really busy. A workaround is to keep trying to unmount the share until it eventually succeeds. This bug has been fixed in 5.0-CURRENT.

Forcefully unmounting (umount -f) smbfs shares may cause a kernel panic. This bug has been fixed in 5.0-CURRENT.

fstat(2)

When called on a connected socket file descriptor, fstat(2) is supposed to return the number of bytes available to read in the st_size member of struct stat. However, st_size is always erroneously reported as 0 on TCP sockets. This bug has been fixed in 5.0-CURRENT.

Kernel Event Queues

The kqueue(2) EVFILT_READ filter erroneously indicates that 0 bytes are available to be read on TCP sockets, regardless of the number of bytes that are actually available. The NOTE_LOWAT flag for EVFILT_READ is also broken on TCP sockets. This bug has been fixed in 5.0-CURRENT.

POSIX Named Semaphores

FreeBSD 5.0-RELEASE introduced support for POSIX named semaphores but the implementation contains a critical bug that causes sem_open(3) to incorrectly handle the opening of the same semaphore multiple times by the same process, and that causes sem_close(3) to crash calling programs. This bug has been fixed in 5.0-CURRENT.

/dev/tty Permissions

FreeBSD 5.0-RELEASE has a minor bug in how the permissions of /dev/tty are handled. This can be triggered by logging in as a non-root, non-tty group user, and using su(1) to switch to a second non-root, non-tty group user. ssh(1) will fail because it cannot open /dev/tty. This bug has been fixed in 5.0-CURRENT.

growfs(8)

growfs(8) no longer works on vinum(4) volumes (and presumably, on geom(4) entities) since these subsystems no longer fake disklabels, but growfs(8) insists on examining a label.

IPFW

ipfw(4) skipto rules do not work when coupled with the log keyword. ipfw(4) uid rules also do not work properly. These bugs have been fixed in 5.0-CURRENT.

Passwords and adduser(8)

adduser(8) does not correctly handle setting user passwords containing special shell characters. This problem has been corrected in 5.0-CURRENT.

xl(4)

The xl(4) driver has a timing bug that may cause a kernel panic (or other problems) when attempting to configure an interface. This bug has been fixed in 5.0-CURRENT.

ISC DHCP

ISC DHCP was updated to 3.0.1rc11. This update was actually a part of FreeBSD 5.0-RELEASE, but was not documented in the release notes.

amd(8) Interoperability

5.0-RELEASE contains some bugs in its non-blocking RPC code. The most noticeable side-effect of these bugs was that amd(8) users were not able to mount volumes from a 5.0-RELEASE server. This bug has been fixed in 5.0-CURRENT.

nsswitch

The release note documenting the addition of nsswitch support gave an incorrect name for the old resolver configuration file. It should have been listed as /etc/host.conf.

Mailman

Recently the mailing lists were changed from majordomo to the currently used Mailman list server. More information about using the new mailing lists can be found by visiting the FreeBSD Mailman Info Page.