This file lists the major changes made between the last released
version of Owl and Owl-current.  While some of the changes listed here
may also be made to a stable branch, the complete lists of stable
branch changes are included with those branches and as errata for the
corresponding Owl releases only.

This is very far from an exhaustive list of changes.  Small changes to
individual packages won't be mentioned here unless they fix a security
or a critical reliability problem.  They are, however, mentioned in
change logs for the packages themselves.


	Changes made between Owl 2.0 and Owl-current.

2008/11/02	Package: tar
Updated to 1.20.

2008/08/14	Package: postfix
Updated to 2.4.8, disabled the Solaris symlink hack that allowed local
mail deliveries through "root-owned" symlinks.  Although this is a
security update for some other systems, on Owl the problem was avoided
or mitigated in several ways:
- we have a patch, introduced prior to Owl 2.0, that adds the
local_minimum_uid setting with a default of 500 - preventing local mail
deliveries to user "root" (unless it is correctly setup as an alias to
some other e-mail address), as well as to other system special accounts;
- there's no potential attack vector to get group "mail" privileges on
Owl with no third-party software added - no single program is installed
SGID "mail";
- the mail spool directory is only writable by root and group "mail"
(not world-writable), yet it has the sticky bit set (mode 1771), which
prevents the attack for already-existing mailboxes;
- "useradd -m", which must be used to create a user account with a home
directory, also pre-creates the mailbox;
- our default kernel includes the CONFIG_HARDEN_LINK option, enabled by
default, which thwarts the hardlink-to-symlink attack.

2008/08/10	Package: bind
Updated to 9.3.5-P2, added an OpenBSD-derived patch to implement
support for more than 1024 simultaneous recursive queries.

2006/09/13 -
2008/07/10	Package: john
Many updates to John the Ripper have been made, bringing it to version
1.7.3.  Most notably, two Blowfish-based crypt(3) hashes may now be
computed in parallel for much better performance on x86-64 CPUs.  Also,
"DumbForce" and "KnownForce" external mode samples have been added to
the default john.conf.

2008/07/08	Package: bind
SECURITY FIX	Severity: medium, remote, active
Updated to 9.3.5-P1, which additionally randomizes UDP query ports to
improve resilience to DNS cache poisoning attacks.
References:
http://www.isc.org/sw/bind/forgery-resilience.php
http://www.kb.cert.org/vuls/id/800113
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1447

2008/06/29	Package: vsftpd
Updated to 2.0.6.

2008/05/27	Package: openssh
Implemented support for RSA/DSA key blacklisting in sshd based on
partial fingerprints, added a subpackage with blacklisted 48-bit partial
fingerprints for 1024-bit and 2048-bit RSA and 1024-bit DSA keys as
generated on vulnerable Debian, Ubuntu, and derived systems for PID
range 1 to 32767.  Due to the encoding scheme used, the blacklist file
size is just 1.3 MB, which corresponds to less than 4.5 bytes per
fingerprint.  This effort was supported by CivicActions.  References:
http://www.openwall.com/lists/oss-security/2008/05/27/3
http://www.debian.org/security/2008/dsa-1571
http://www.ubuntu.com/usn/usn-612-1
http://metasploit.com/users/hdm/tools/debian-openssl/
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0166

2008/05/18	Package: nmap
Updated to 4.62.

2008/05/10	Package: cvs
Updated to 1.11.23.

2008/04/17 -
2008/04/22	Package: lilo
Updated to 22.8.

2008/03/26	Package: gnupg
Updated to 1.4.9.

2008/03/20	Package: findutils
Updated to 4.2.33.

2008/03/20	Package: bzip2
Updated to 1.0.5.  This release fixes a potential buffer over-read bug,
which allowed user-assisted remote attackers to cause a crash in libbz2
via a crafted file.
Reference:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1372

2008/02/13	Package: pcre
Updated to 7.6.

2008/02/12	Packages: pam_passwdqc, pam
Applied numerous minor changes to pam_passwdqc and its default settings,
including replacing its set of separator characters (used for randomly
generated "passphrases") with some of those defined by RFC 3986 as being
safe within "userinfo" part of URLs without encoding, reducing the
default minimum length for passphrases from 12 to 11, and corrections to
the documentation.

2008/01/15	Package: tar
Added a new option: --ignore-device-id, to be used when creating
incremental dumps off filesystems with volatile device numbers, such as
OpenVZ simfs.

2008/01/04	Package: hdparm
Updated to 7.7.

2008/01/01	Package: gnupg
Updated to 1.4.8.

2008/01/01	Package: e2fsprogs
Updated to 1.40.4.

2007/12/16	Package: postfix
Updated to 2.4.6.

2007/12/06	Package: e2fsprogs
Applied upstream patch to fix integer overflows in libext2fs.
This addresses a potential vulnerability where an untrusted filesystem
can be corrupted on purpose in such a way that a program using libext2fs
will allocate a buffer that is far too small.  This can lead to either a
crash or potentially a heap-based buffer overflow.
Thanks to Rafal Wojtczuk of McAfee Avert Labs for reporting this issue.
Reference:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5497

2007/12/05	Package: gettext
Updated to 0.14.6.

2007/11/19	Package: findutils
Updated to 4.2.31.

2007/11/18	Package: ltrace
Updated to 0.5.

2007/11/18	Package: elfutils-libelf
Updated to 0.131.

2007/11/15	Package: e2fsprogs
Updated to 1.40.2.

2007/10/24 -
2007/11/05	Package: sysklogd
Implemented logging of the sending user ID (when non-zero) and of the
sending process ID (when different from the reported one) for syslog
messages arriving via Unix domain sockets.  This should allow for
detection of spoofed messages.

2007/10/17	Package: diffstat
Updated to 1.45.

2007/10/16	Package: dhcp
Updated to 3.0.6.

2007/10/13	Package: openssl
Backported upstream fix for off-by-one bug in the SSL_get_shared_ciphers
function.  It is unclear whether the bug had any security impact.
References:
http://lists.openwall.net/bugtraq/2007/09/27/14
http://lists.openwall.net/bugtraq/2007/10/01/7
http://www.openssl.org/news/secadv_20071012.txt
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5135

2007/10/08	Package: cvs
Updated to 1.11.22.

2007/10/07	Package: bzip2
Updated to 1.0.4.

2007/10/07	Package: nmap
Updated to 4.20.

2007/10/07	Packages: mdadm, raidtools;
		Owl/build/installorder.conf
Replaced raidtools with mdadm.

2007/09/24	Package: pcre
Updated to 7.4.

2007/08/30	Package: vim
SECURITY FIX	Severity: none to high, indirect, passive
Backported upstream fix to restrict dangerous functions in modelines.
Note that vim's modelines have always been disabled on Owl by default
(with a setting in /usr/share/vim/vimrc) and even this fix is no guarantee
modelines will be safe to use or the restricted mode safe to rely upon
in the future.
Backported upstream fix for format string vulnerability in the
helptags_one function, which allowed user-assisted remote attackers to
execute arbitrary code via format string specifiers in a help-tags tag
in a help file.
References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2438
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2953

2007/08/18	kernel
Updated to Linux 2.4.35-ow2.  The single known security-relevant change
added with Linux 2.4.35 is correction of the randomness pool update bug
discovered by the PaX Team.  The -ow2 revision adds a fix for the parent
process death signal bug in the Linux kernel discovered by Wojciech
Purczynski of COSEINC PTE Ltd. and iSEC Security Research; this bug has
no security impact on Owl with no added SUID programs.  Also added are
two security hardening features, both enabled by default: restricted
access to VM86 mode (specific to 32-bit x86) and restricted zero page
mappings (generic).
References:
http://www.openwall.com/lists/announce/2007/08/08/1
http://www.openwall.com/lists/announce/2007/08/14/1
http://www.isec.pl/vulnerabilities/isec-0024-death-signal.txt
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3848

2007/08/18	Package: cpio
Updated to 2.9.

2007/08/17	Package: tar
Updated to 1.18.

2007/07/30	Package: bind
SECURITY FIX	Severity: medium, remote, passive
Updated to 9.3.4-P1, which fixes a weakness in DNS query ids generator
when answering resolver questions or sending NOTIFY messages to slave
name servers.  The weakness used to make it easier for remote attackers
to guess the next query id and perform DNS cache poisoning.
References:
http://www.trusteer.com/bind9dns
http://marc.info/?l=bind-announce&m=118531674631565
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2926

2007/06/01	Package: owl-cdrom
In the default kernel for x86, enabled more IDE chipset drivers, common
RAID and SATA controller drivers, USB and HID support (keyboard, mouse,
storage devices), and more.  This enables our CDs to boot off SATA and
USB CD-ROM drives, in addition to IDE and SCSI ones that were supported
previously.

2007/05/31	Package: mutt
Updated to 1.4.2.3.  This release fixes msgid validation in APOP
authentication and potential buffer overflow in passwd GECOS field parser.
References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1558
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2683

2007/03/25 -
2007/05/22	Package: file
SECURITY FIX	Severity: high, indirect, passive
Fixed potential heap buffer overflow in the file_printf function of the
libmagic library.
Reference:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1536

2007/03/29	Package: lftp
Updated to 3.5.10.

2007/03/27	Package: elinks
Updated to 0.11.2.

2007/03/26	Package: lftp
Updated to 3.5.9.

2007/03/06	Package: gnupg
SECURITY FIX	Severity: medium, indirect, passive
Updated to 1.4.7.  This includes a fix for an unsigned data injection
vulnerability:
An attacker is able to add arbitrary content to a signed message, and
the receiver of the message may not be able to distinguish the forged
and the properly signed parts of the message.
References:
http://www.coresecurity.com/content/gnupg-and-gnupg-clients-unsigned-data-injection-vulnerability
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1263

2007/02/25	Package: openssl
Updated to 0.9.7m.

2007/01/29	Package: bind
SECURITY FIX	Severity: low, remote, active
Updated to 9.3.4, which fixes two security issues.
The first issue is a "use after free" vulnerability which allowed remote
DoS attack via unspecified vectors that cause BIND to "dereference (read)
a freed fetch context".
The second issue allowed remote DoS attack via a type ANY DNS query
response that contains multiple RR sets in the answer section, which
triggers an assertion error if DNSSEC validation is enabled.
References:
http://marc.info/?l=bind-announce&m=116968519321296
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0493
http://marc.info/?l=bind-announce&m=116968519300764
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0494

2007/01/18	Package: strace
Updated to 4.5.15.

2007/01/13	Package: pcre
Updated to 7.0.

2007/01/03 -
2007/01/09	Package: owl-setup
Configuration of console font and locales has been implemented under a
new sub-menu.  Keyboard layout configuration has been moved to the same
menu.  The ncurses/CDK-based user interface now uses cfdisk rather than
the traditional fdisk by default.

2006/12/30 -
2007/01/09	Owl/build/*
New make targets have been added for creating ISO-9660 images of Owl
bootable CDs.  The added targets are buildkernel, installisotree, iso,
and iso.gz.

2007/01/05	Package: mkisofs;
		Owl/build/installorder.conf
New package: create ISO-9660 filesystem images.

2006/12/27	kernel
Updated to Linux 2.4.34-ow1.

2006/12/06	Package: gnupg
SECURITY FIX	Severity: high, indirect, passive
Updated to 1.4.6.  This includes a fix for a remotely controllable
function pointer vulnerability: using malformed OpenPGP packets an
attacker was able to modify and dereference a function pointer in gpg.
Reference:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-6235

2006/11/28	Package: gnupg
SECURITY FIX	Severity: high, indirect, passive
Applied upstream fix for heap buffer overflow bug in gpg when running
gpg interactively.
References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-6169
http://lists.gnupg.org/pipermail/gnupg-announce/2006q4/000241.html

2006/11/28	Package: tar
SECURITY FIX	Severity: high, indirect, passive
Disabled GNUTYPE_NAMES handling by default to avoid directory traversal
in GNU tar (where a malicious archive containing GNUTYPE_NAMES record
with a symbolic link could specify files to be extracted to outside of
the intended directory tree).
References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-6097
http://lists.grok.org.uk/pipermail/full-disclosure/2006-November/050812.html

2006/11/19	Package: rpm
Backported upstream fix for potential heap buffer overflow in
showQueryPackage function.  Although this particular bug is fixed,
it remains unsafe to invoke "rpm" queries on untrusted package files.
References:
https://bugzilla.redhat.com/show_bug.cgi?id=212833
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-5466

2006/11/09	Package: openssh
Backported upstream fix for a bug in the sshd privilege separation
monitor that weakened its verification of successful authentication.
References:
http://lists.mindrot.org/pipermail/openssh-unix-dev/2006-November/024882.html
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-5794

2006/11/07	Package: texinfo
SECURITY FIX	Severity: high, indirect, passive
Applied upstream patch that fixes potential heap buffer overflow in
texindex utility.
Reference:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4810

2006/10/29	Package: screen
SECURITY FIX	Severity: low, remote, passive
Applied upstream patch that fixes two bugs in UTF-8 combining characters
handling.  The bugs could be used to crash/hang screen by writing a
special string to a window.
References:
http://lists.gnu.org/archive/html/screen-users/2006-10/msg00028.html
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4573

2006/10/03	Package: openssh
SECURITY FIX	Severity: low/none to high, remote/local, active
Backported upstream fixes for sshd connection consumption vulnerability
(severity: low, remote, active), scp local arbitrary command execution
vulnerability (severity: none to high, local, active), CRC compensation
attack detector DoS (severity: low, remote, active), client NULL
dereference on protocol error (severity: low, remote, passive).
References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-2069
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0225
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4924
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4925

2006/09/29	Package: openssl
SECURITY FIX	Severity: none to low/high, remote, active/passive
Updated to 0.9.7l, which includes fixes for four security issues.
References:
http://www.openssl.org/news/secadv_20060928.txt
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2937
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2940
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3738
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4343

2006/09/27	Package: dhcp
Updated to 3.0.4.

2006/09/19	Package: gzip
SECURITY FIX	Severity: high, indirect, passive
Fixed multiple vulnerabilities (stack buffer overflow, heap buffer
underflow, heap buffer overflow, infinite loop) discovered by Tavis
Ormandy of Google Security Team.
References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4335
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4336
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4337
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4338

2006/09/19	Package: bison
Updated to 2.3.

2006/09/07	Package: gpm
Updated to 1.20.1.

2006/09/06	Package: openssl
SECURITY FIX	Severity: none to medium, remote, passive to active
Applied upstream patch to avoid RSA signature forgery.
References:
http://www.openssl.org/news/secadv_20060905.txt
http://www.imc.org/ietf-openpgp/mail-archive/msg14307.html
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4339

2006/09/06	Package: bind
SECURITY FIX	Severity: none to low, remote, active
Updated to 9.3.2-P1, which fixes a couple of bugs that allowed for DoS
attacks on certain BIND configurations.
References:
http://www.kb.cert.org/vuls/id/915404
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4095
http://www.kb.cert.org/vuls/id/697164
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4096

2006/08/17	kernel
Updated to Linux 2.4.33-ow1.

2006/08/04	Package: postfix
Updated to 2.2.11.

2006/08/04	Package: gnupg
SECURITY FIX	Severity: high, remote, passive
Updated to 1.4.5.  This includes fixes for two more possible memory
allocation bugs, similar to the problem fixed in 1.4.3-owl1.
References:
http://lists.gnupg.org/pipermail/gnupg-announce/2006q3/000229.html
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3746

2006/06/28	Package: gnupg
Updated to 1.4.4.

2006/06/27	Package: mutt
SECURITY FIX	Severity: high, remote, passive
Applied an upstream fix for potential stack-based buffer overflow when
processing an overly long namespace from IMAP server.
Reference:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3242

2006/06/25	Package: nmap
Updated to 4.11.

2006/06/25	Package: coreutils
Updated to 5.97.

2006/06/22	Package: gnupg
SECURITY FIX	Severity: high, remote, passive
Updated to 1.4.3.  Applied a fix for integer overflow vulnerability in
packet processing that could allow a remote attacker to cause gpg to crash
and possibly overwrite memory via a message packet with a large length.
Reference:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3082

2006/06/12	Package: hdparm
Updated to 6.6.

2006/06/12	Package: smartmontools;
		Owl/build/installorder.conf
New package: control and monitor storage systems using S.M.A.R.T.

2006/06/06	Package: patchutils
Updated to 0.2.31.

2006/06/06	Package: automake
Updated to 1.9.6.

2006/06/06	Package: which
Updated to 2.16.

2006/06/06	Package: e2fsprogs
Updated to 1.39.

2006/06/06	Package: pam
Updated to 0.99.4.0+.

2006/06/06	Package: make
Updated to 3.81.

2006/06/06	Package: libtool
Updated to 1.5.22.

2006/06/06	Package: bison
Updated to 2.1.

2006/06/06	Package: bind
Updated to 9.3.2.

2006/06/06	Package: vsftpd
Updated to 2.0.4.

2006/06/06	Package: chkconfig
Updated to 1.3.29.

2006/06/06	Package: bash
Updated to 3.1 patchlevel 17.

2006/05/27	Package: coreutils
Updated to 5.96.

2006/05/21	Package: coreutils
Updated to 5.95.

2006/05/21	Packages: bc, gnupg, gdb, lftp, readline;
		Owl/build/installorder.conf
Updated readline to 5.1 patchlevel 4.

2006/05/19	Package: acct
Updated to 6.4-pre1.

2006/05/08 -
2006/05/15	Package: john
Bitslice DES code for x86 with SSE2 and x86-64 with 64-bit mode extended
SSE2 has been added for better performance at DES-based crypt(3) hashes
on Pentium 4 and SSE2-capable AMD processors.  Assorted high-level
changes have been applied to improve performance on current x86-64
processors.

2006/05/07	Package: perl
Updated to 5.8.8.

2006/05/01	Package: vixie-cron
Updated to OpenBSD CVS snapshot dated 2006/04/26.  Changed crontab(1) to
use $TMPDIR for creating the temporary file.

2006/05/01	Package: lftp
Updated to 3.4.6.

2006/04/26	Package: nmap
Updated to 4.03.

2006/03/25 -
2006/04/20	Package: owl-setup
Many fixes and enhancements which had been postponed for after Owl 2.0
release have now been implemented.  This includes directly talking to
PAM when setting the initial root password, quick searches in scroll
lists with the ncurses/CDK-based interface, progress indicators with
both user interfaces (currently, this is used for installation of kernel
headers), and manual pages for both "settle" and "setup".

2006/04/19	Package: lftp
Updated to 3.4.4.

2006/04/19	Package: setarch
Updated to 2.0.

2006/04/04 -
2006/04/07	Packages: *;
		Owl/build/{.rpmmacros,.rpmrc,buildworld.conf,buildworld.sh}
Ported Owl to the x86-64 architecture.

2006/04/06	Packages: db4, pam, perl, postfix;
		Owl/build/installworld.sh
Updated db4 to 4.3.29.

2006/04/06	Package: postfix
Updated to 2.2.10.

2006/04/06	Package: gettext
Updated to 0.14.5.

2006/04/04	Package: bash
Updated to 3.1 patchlevel 16.

2006/03/23	Package: netlist
Updated to 2.1.

2006/03/23	Package: setarch
Updated to 1.9.

2006/03/11	Package: postfix
Updated to 2.2.9.

2006/03/11	Package: gnupg
SECURITY FIX	Severity: medium, indirect, passive
Updated to 1.4.2.2.  This includes fixes for the signature verification
vulnerabilities discovered by Tavis Ormandy of Gentoo.
References:
http://lists.gnupg.org/pipermail/gnupg-announce/2006q1/000211.html
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0455
http://lists.gnupg.org/pipermail/gnupg-announce/2006q1/000216.html
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0049

2006/03/05	Package: nmap
Updated to 4.02 Alpha1.

2006/02/27 -
2006/03/05	Package: john
Applied many minor corrections, including for better handling of certain
uncommon scenarios and improper uses of John.  Added a "keyboard
cracker" to the default john.conf that will try sequences of adjacent
keys on a keyboard as passwords.

2006/02/28	Package: iptables
Updated to 1.3.5.

2006/02/20	Package: sed
Updated to 4.1.5.

2006/02/20	Package: coreutils
Updated to 5.94.

2006/02/20	Package: bash
Updated to 3.1 patchlevel 8.

2006/02/20	Package: tar
SECURITY FIX	Severity: high, local, passive
Backported upstream fix for potential heap buffer overrun in handling
extended headers.
References:
http://lists.gnu.org/archive/html/bug-tar/2005-06/msg00029.html
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0300

$Owl: Owl/doc/CHANGES-current,v 1.140 2008/11/02 04:13:08 solar Exp $
