Four New Security Advisories Released for NetBSD

Dan writes "The NetBSD security team has issued Four NetBSD Security Advisories. (1) Format string vulnerability in zlib gzprintf(): a buffer overflow can result in arbitrary code execution. (2) RSA timing attack in OpenSSL code can enable remote recovery of private keys, from a host with low-latency access to the server - such as the local host, or a host on the LAN. (3) Encryption weakness in OpenSSL code enables an attacker to perform crypto operations using server's private keys. Finally (4), faulty length checks in xdrmem_getbytes (within libc) are susceptible to integer overflows that affect memory allocation in their local buffers."

Comments

why link to freebsdforums?

[kenfrid]

Why link to freebsdforums when you can get the original announcement here?

Re:why link to freebsdforums?

[jschauma]

Hmm, while you _do_ have to get the source (as if that was a bad thing!), it's certainly very simple to update only the relevant parts. As the SA states, you do not need to update the entire system but can simply do:

# cd src

# cvs update -d -P -r netbsd-1-6 lib/libz/gzio.c

# cd lib/libz

# make USETOOLS=no cleandir dependall

# make USETOOLS=no install

(Similarly for the other advisories.)
This is not really very difficult.