-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

===========================================================================
             AUSCERT External Security Bulletin Redistribution

                        ESB-2006.0860 -- [OpenBSD]
                 Multiple fixes for OpenBSD, November 2006
                             21 November 2006

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Publisher:            OpenBSD
Operating System:     OpenBSD
Impact:               Increased Privileges
                      Denial of Service
                      Cross-site Scripting
Access:               Remote/Unauthenticated
CVE Names:            CVE-2006-4343 CVE-2006-3918 CVE-2006-3738
                      CVE-2006-2940 CVE-2006-2937

Original Bulletin:    http://www.openbsd.org/errata.html

Comment: This bulletin contains patches for both OpenBSD 4.0 and OpenBSD 3.9.

- --------------------------BEGIN INCLUDED TEXT--------------------

016: SECURITY FIX: November 19, 2006   
All architectures

ld.so(1) fails to properly sanitize the environment. There is a potential 
localhost security problem in cases we have not found yet.

Patch for OpenBSD 3.9:
ftp://ftp.openbsd.org/pub/OpenBSD/patches/3.9/common/016_ldso.patch


005: SECURITY FIX: November 19, 2006
All architectures

The ELF ld.so(1) fails to properly sanitize the environment.
There is a potential localhost security problem in cases we have
not found yet. This patch applies to all ELF-based systems (m68k,
m88k, and vax are a.out-based systems).

Patch for OpenBSD 4.0:
ftp://ftp.openbsd.org/pub/OpenBSD/patches/4.0/common/005_ldso.patch


004: RELIABILITY FIX: November 7, 2006
All architectures
 
Due to a bug in the arc(4) RAID driver the driver will not
properly synchronize the cache to the logical volumes upon system
shut down. The result being that the mounted file systems within
the logical volumes will not be properly marked as being clean and
fsck will be run for the subsequent boot up.

Patch for OpenBSD 4.0:
ftp://ftp.openbsd.org/pub/OpenBSD/patches/4.0/common/004_arc.patch


003: SECURITY FIX: November 4, 2006
All architectures

Fix for an integer overflow in systrace(4)'s STRIOCREPLACE
support, found by Chris Evans. This could be exploited for DoS,
limited kmem reads or local privilege escalation.

Patch for OpenBSD 4.0:
ftp://ftp.openbsd.org/pub/OpenBSD/patches/4.0/common/003_systrace.patch


002: SECURITY FIX: November 4, 2006
All architectures
 
Several problems have been found in OpenSSL. While parsing certain
invalid ASN.1 structures an error condition is mishandled,
possibly resulting in an infinite loop. A buffer overflow exists
in the SSL_get_shared_ciphers function. A NULL pointer may be
dereferenced in the SSL version 2 client code. In addition, many
applications using OpenSSL do not perform any validation of the
lengths of public keys being used. CVE-2006-2937, CVE-2006-3738,
CVE-2006-4343, CVE-2006-2940
 
Patch for OpenBSD 4.0:
ftp://ftp.openbsd.org/pub/OpenBSD/patches/4.0/common/002_openssl.patch
 
 
001: SECURITY FIX: November 4, 2006
All architectures
 
httpd(8) does not sanitize the Expect header from an HTTP
request when it is reflected back in an error message, which might
allow cross-site scripting (XSS) style attacks. CVE-2006-3918

Patch for OpenBSD 4.0:
ftp://ftp.openbsd.org/pub/OpenBSD/patches/4.0/common/001_httpd.patch

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

        http://www.auscert.org.au/render.html?cid=1980

If you believe that your computer system has been compromised or attacked in 
any way, we encourage you to let us know by completing the secure National IT 
Incident Reporting Form at:

        http://www.auscert.org.au/render.html?it=3192

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================

-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQCVAwUBRWJ9tCh9+71yA2DNAQLWSAQAiCsV543WaFihjTaaNc0hURO/bm1mN1Pm
ZModvnw8slHYsFOLoQZm/MpsBhwo2McNPqp9SAY8c2dQ8KZQyz/NFLtMl892ZzQM
9Sj2WCkCASUqWj8w+0H06bdJK6LmU36hGcX5CqTXiZ89XywZSufRq2nG6Aq9dqjl
6SjIyGGXO1Y=
=svyu
-----END PGP SIGNATURE-----