ViewVC Help

View File | Revision Log | Show Annotations | Revision Graph | Download File | Root Listing

root/midnightbsd-cvs/src/UPDATING

Comparing src/UPDATING (file contents):
Revision 1.38.2.19 by laffer1, Wed Jun 10 15:49:25 2009 UTC vs.
Revision 1.94.2.5 by laffer1, Tue Nov 30 14:03:18 2010 UTC

#	Line 1 | Line 1
1		Updating Information for MidnightBSD users
2
3	<	Items affecting the mports and packages system can be found in
4	<	/usr/mports/UPDATING.
3	>	20101130:
4	>	A double free exists in the SSL client ECDH handling code, when
5	>	processing specially crafted public keys with invalid prime
6	>	numbers. [CVE-2010-2939]
7
8	<	20090610:
9	<	MidnightBSD 0.2.1-RELEASE-p10
10	<
11	<	This should be applied to all systems running 0.2.1. Users on
10	<	p9 simply should update their kernels. No world update is required.
8	>	20101110:
9	>	Fix a security issue with pseudofs which could result in running code in kernel
10	>	context or a kernel panic depending on system configuration.  This affects file
11	>	systems such as procfs for instance.
12
13	<	ipv6:
14	<	The SIOCSIFINFO_IN6 ioctl is missing a necessary permissions check.
15	<	Don't let everyone on the planet (with local access) change the
16	<	properties on the ipv6 interfaces.
13	>	20101008:
14	>	A bug in glob(3) results in uncontrolled memory usage causing a possible
15	>	DOS attach in sftpd and ftpd.  Rework the glob logic, fix the man page
16	>	and enable the fix in sftp.c and sftp-glob.c
17
18	<	anonymous pipes:
19	<	Stop unprivileged processes from reading pages of memory belonging
19	<	to other processes with anonymous pipes.
18	>	20100920:
19	>	Security update for bzip2 integer overflow
20
21	<	20090521:
22	<	MidnightBSD 0.2.1-RELEASE-p9
21	>	20100906:
22	>	Remove xz from the base system.  This will be developed in current.
23
24	<	This fix is only in configuration files for ssh and sshd.  Users on
25	<	p8 should simply add
24	>	RELENG_0_3 created.
25
26	<	Ciphers aes128-ctr,aes256-ctr,arcfour256,arcfour,aes128-cbc,aes256-cbc
26	>	20100902:
27	>	Fix a security issue with libutil that allows users to bypass cpu limits in
28	>	login.conf in some cases.  This combined with OpenSSH for example can allow
29	>	the user to get more resources than they're allowed.
30
31	<	to their configuration files for sshd_config and ssh_config in etc/ssh
31	>	20100822:
32	>	Import Apple's mDNSResponder (mdnsd).
33
34	+	20100814:
35	+	libdispatch added to MidnightBSD.  This provides functionality found in
36	+	Mac OS X's GCD.  We do not have blocks support yet.  As this code is
37	+	licensed under Apache 2, we create a new MK_APACHE option so that
38	+	it's not required for all users to run code under a license they
39	+	may not like.
40	+
41	+	20100713:
42	+	mbuf readonly fix related to sendfile(2) data corruption.
43	+
44	+	20100704:
45	+	brainfuck(1) imported from MirBSD.
46	+
47	+	20100505:
48	+	zlib 1.2.5
49	+
50	+	20100430:
51	+	Sudo 1.7.2p6 imported
52	+
53	+	20100321:
54	+	Update zlib to 1.2.4
55	+
56	+	20100319:
57	+	Removed i586 from default i386 generic kernel.
58	+
59	+	20100317:
60	+	Update to tzdata2010e (time zones).  This includes changes in
61	+	Mexico.
62	+
63	+	Add support for several newer sound cards via hda including
64	+	ATI and Realtek chipsets.
65	+
66	+	20100313:
67	+	CPU detection has been changed.  VIA Padlock detection added.
68	+
69	+	20100312:
70	+	Fix a number of bugs and compiler warnings in libmport. Handle
71	+	plus signs in paths for mport.check-fake
72	+
73	+	20100311:
74	+	mksh R39c
75	+
76	+	20100309:
77	+	Sudo 1.7.2p5
78	+
79	+	sqlite3 3.6.23
80	+
81	+	mksh R39b
82	+
83	+	libffi (ffi) 3.0.9
84	+
85	+	20100206:
86	+	WITHOUT_LIB32 is no longer needed on AMD64.  GCC was fixed to
87	+	properly pass arguments to ld.
88	+
89	+	re(4) and rl(4) have been updated to support several new
90	+	realtek chipsets.  Performance has been improved on re(4).
91	+
92	+	20100204:
93	+	Fix a bug cropping up on AMD64 MidnightBSD with sftp
94	+	segfaulting.
95	+
96	+	20100116:
97	+	Import ash changes from FreeBSD (bin/sh) 8-Stable.
98	+
99	+	BIND 9.6.1-P2
100	+
101	+	20100110:
102	+	Import Sendmail 8.14.4. Fix for SSL vulnerability.
103	+
104	+	posix_spawn(3) added to MidnightBSD libc.  Users may need to build and
105	+	install libc before doing a full buildworld when upating from 0.2 or
106	+	older current systems.
107	+
108	+	kqueue(2) was modified to support portions of libdispatch functionality.
109	+
110	+	20100106:
111	+	Bind security update.  Fix a bug with DNSSEC that causes negative
112	+	cache entries and thus a possible DNS cache poisoning attack.
113	+
114	+	Fix a bug in ZFS that can reset permissions on system crashes.
115	+
116	+	20091228:
117	+	amdtemp(4) was added.  It allows one to monitor to the temperature
118	+	of an AMD CPU such as a Phenom.
119	+
120	+	20091205:
121	+	OpenSSL security fix
122	+
123	+	The SSL version 3 and TLS protocols support session renegotiation without
124	+	cryptographically tying the new session parameters to the old parameters.
125	+
126	+	20091128:
127	+	OpenBSD sensors framework imported including sensorsd(8)
128	+
129	+	20091126:
130	+	OpenNTPD 4.4 import
131	+
132	+	Update OpenSSH to 5.3p1
133	+
134	+	mksh R39
135	+
136	+	20091124:
137	+	cpdup updated from DragonFly to 1.15
138	+
139	+	tzdata2009s updated with latest timezone data for November 2009.
140	+
141	+	20091010:
142	+	amd64 users should use WITHOUT_LIB32=yes in /etc/make.conf for now
143	+	to test current.
144	+
145	+	Revert unicode filename fixes from ntfs code.  This was causing chaos
146	+	on amd64 systems.
147	+
148	+	20091006:
149	+	Update timezone data with tzdata2009n with the Pakistan and
150	+	Argentina changes.
151	+
152	+	Sync several userland utilities with versions from FreeBSD 7.0 in
153	+	sbin and usr.sbin.
154	+
155	+	20090919:
156	+	Update timezone data with tzdate2009m from September 2009.
157	+
158	+	20090729:
159	+	Patch for Bind 9 security vulnerability. a dynmaic update packet
160	+	can trigger an assertion and cause named to exit
161	+
162	+	20090606:
163	+	Remove PCC from the base system.  This compiler will not work
164	+	as a system compiler for us as we've got some userland investment
165	+	in C++ code and may have Objective-C in the future.  We're stuck
166	+	with a solution that supports these three languages at a minimum.
167	+
168	+	I had wanted to keep it as an optional compiler because it is
169	+	fast, however too many users want to try to use it for the base
170	+	system which makes no sense.
171	+
172	+	A hack was added for Cypress based usb hard drive enclosures to
173	+	the kernel.  This should cut down on commands it claims to support
174	+	but does not (at the cam layer).  Found while testing ZFS on
175	+	an external device.
176	+
177	+	20090520:
178	+	The powerd daemon no longer starts automatically to improve
179	+	compatibility with many systems.  However, there is a new
180	+	installer option in the startup section to enable it. This
181	+	makes it easier to enable for users that have working systems. I                thought it was only a problem on older hardware, but it freaks
182	+	out my new Phenom too.
183	+
184	+	20090502:
185	+	OpenSSH 5.2p1 import
186	+
187	+	ale(4) connected to the build. (kernel module only)
188	+
189	+	20090501:
190	+	Imported makefs utility from NetBSD/FreeBSD
191	+
192		20090422:
193	<	MindightBSD 0.2.1-RELEASE-p8
193	>	OpenSSL security update
194
195		The function ASN1_STRING_print_ex does not properly validate the lengths
196	<	of BMPString or UniversalString objects before attempting to print them.
196	>	of BMPString or UniversalString objects before attempting to print them.
197
198	<	20090326:
199	<	MidnightBSD 0.2.1-RELEASE-p7
198	>	20090415:
199	>	Created a Symbol.map for libc/ohash symbols
200
201	<	Fix several security problems with sudo.  It is now 1.6.9-p20
201	>	Updated several usr/bin usr/sbin utilities.
202
203	<	20090115:
204	<	MidnightBSD 0.2.1-RELEASE-p6
203	>	Corrected a bug with Makefile.inc1 causing the bootstrap
204	>	tools to fail.
205
206	<	Correct an issue with BIND that allows for DNSSEC spoofing
207	<	attacks.
206	>	20090405:
207	>	xorg 7.4 wants to configure its input devices via hald which does not
208	>	yet work with USB. If the keyboard/mouse does not work in xorg then
209	>	add
210	>	Option "AllowEmptyInput" "off"
211	>	to your ServerLayout section.  This will cause X to use the configured
212	>	kbd and mouse sections from your xorg.conf
213
214	<	20090110:
215	<	MidnightBSD 0.2.1-RELEASE-p5
214	>	20090403:
215	>	mksh was disconnected a few day ago do to bugs with
216	>	buildworld and mports.  Now, connect it back
217	>	for use as /bin/sh with a conditional called
218	>	MK_ASH.  By default, ash is the standard /bin/sh
219	>	but we may change this later.  This will allow further
220	>	testing by users and developers of mksh without
221	>	causing an unpleasant default experience.  In the
222	>	long run, we need to fix mksh compatibility.
223
224	+	20090328:
225	+	Bring in mksh R37 from CVS. The dot.mkshrc files for root
226	+	and skel were changed.  mksh(1) now replaces ash aka sh(1)
227	+	as the default /bin/sh.  Please report bugs with
228	+	ports, etc. The ash code will remain in the repo for awhile
229	+	as I decide if we'll add something like MK_SHELL_ASH as
230	+	an optional build parameter.
231	+
232	+	ahd was disconnected from the lint environment until
233	+	the compiler bug is sorted (by updating gcc?)
234	+
235	+	Remove freebsd-tips from fortune files and change the
236	+	default for login and profile.
237	+
238	+	20090327:
239	+	Update libarchive to 2.5.5, tar, and add bsdcpio.
240	+
241	+	Also previously, ctriv has been connecting Perl 5.10
242	+	to the build (part of os).  This will have an impact
243	+	on mports.
244	+
245	+	20090325:
246	+	Update Bind to 9.4.3-P1
247	+
248	+	Update mksh to R36b
249	+
250	+	Update tcpdump to 3.9.8, fix libpcap to work with current.
251	+
252	+	Update pnpinfo, sync with FreeBSD.
253	+
254	+	20090115:
255	+	Fix a problem with DNSSEC and BIND.
256	+
257	+	20090110:
258		For applications using OpenSSL for SSL connections, an invalid SSL
259		certificate may be interpreted as valid.  This could for example be
260		used by an attacker to perform a man-in-the-middle attack.
#	Line 57 | Line 264 | Items affecting the mports and packages system can be
264
265		Stop cross site request forgery attacks in lukemftpd
266
267	<	20081231:
268	<	MidnightBSD 0.2.1-RELEASE-p4
267	>	20090104:
268	>	Import GNU libreadline 5.2
269
270	<	Correct a problem where function pointers for netgraph
271	<	and bluetooth sockets are not initialized properly.
270	>	20090101:
271	>	Update time zone data to 2008i.
272
273	<	20081124:
274	<	MidnightBSD 0.2.1-RELEASE-p3
273	>	20081231:
274	>	Correct a problem where bluetooth and netgraph sockets are not
275	>	properly initialized.
276
277	<	Correct a problem in arc4random which causes the device
70	<	not get get enough entropy for system services.  Geom
71	<	classes initialized at startup will still have problems.
277	>	Happy 2009.
278
279	<	20081002:
280	<	MidnightBSD 0.2.1-RELEASE-p2
279	>	20081206:
280	>	Due to the massive change in the underlying system under way,
281	>	we're naming the next release 1.0.  The sys/sys/param.h was
282	>	changed accordingly.  ipfilter and ncurses were corrected
283	>	using __MidnightBSD__ tests in the code.
284
285	<	IPv6 Neighbor Discovery Protocol routing vulnerability
285	>	The GENERIC kernel config was caught up on i386 today.  Consider
286	>	i386 still broken, but amd64 is running again.
287
288	<	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2476
79	<	http://www.kb.cert.org/vuls/id/472363
288	>	mdoc.local was updated with the new MidnightBSD version info.
289
290	<	This fix causes IPv6 Neighbor Discovery Neighbor Solicitation
291	<	messages to be ignored from non-neighbors.
290	>	batt(1) was rewritten in C.  It now supports several flags and
291	>	runs about 8 times faster on my laptop.  The default output
292	>	shows the number of minutes of battery life remaining and the
293	>	percentage.  You can use -u to display the number of batteries or
294	>	-c to get script friendly output.  Consult the man page for more.
295
296	<	This can be re-enabled, if needed, by setting the newly added
297	<	net.inet6.icmp6.nd6_onlink_ns_rfc4861 sysctl to 1.
296	>	20081204:
297	>	Work has completed on importing ZFS, jemalloc, several
298	>	new devices, SCTP, updated pf, a new tempfs, linuxolator 2.6 kernel
299	>	support, improved locking for file desc., audit (openbsm),
300	>	openssl .98e, nfe, imporved intel high def audio, midi, updated
301	>	intel gigabit (em), support for several wifi cards (intel), ...
302
303	<	20080929:
304	<	MidnightBSD 0.2.1-RELEASE-p1
303	>	Renamed 0.3-CURRENT officially. Switched to using MidnightBSD version
304	>	data from param.h instead of the FreeBSD version.  This means
305	>	testing is now possible in the ports tree for the version
306	>	and that any ports or code relying on the FreeBSD version from
307	>	sys/sys/param.h will need to be fixed.
308
90	–	Fix a defect in ftpd.  The command buffer was split which allowed
91	–	attackers to send arbritrary commands over the network.
92	–
309		20080905:
310	<	Update nve(4) to support newer hardware.
310	>	update nve(4) to support new hardware.
311
312	<	20080903:
313	<	Correct two defects in MidnightBSD.  AMD64/EMT64 systems had a
98	<	privledge escalation issue.  CVE-2008-3890
312	>	20080801:
313	>	Import OpenBSM 1.0
314
315	<	In case of an incoming ICMPv6 'Packet Too Big Message', there is an
101	<	insufficient check on the proposed new MTU for a path to the
102	<	destination.
103	<	CVE-2008-3530
315	>	Modify src/release to create 3 isos instead of 2 for packages.
316
317	<	20080830:
106	<	MidnightBSD 0.2.1-RELEASE
317	>	etc/rc.d/firstboot now enables kdm, gnustep + slim and bsdstats.
318
319	<	Oops, fix some bugs with sysinstall's handling of packages found
109	<	on the release ISOs.  Tweak etc/firstboot while where here.
319	>	Many ia64, alpha, powerpc items were removed.
320
321	<	20080829:
112	<	MidnightBSD 0.2-RELEASE
321	>	The recent diffutils 2.8.7 import was fixed.
322
323		20080703:
324	<	Correct problem with pcc and DESTDIR that affected creating live cds
325	<	and jails.
324	>	pcc was not installed properly when setting DESTDIR for live cds,
325	>	or posibly jails.
326
118	–	sysinstall would incorrectly truncate DHCP info when configuring
119	–	ipv4 networking.  This was the result of a bad patch several months
120	–	ago.  Fix this error.  Found via testing a snapshot.
121	–
327		20080627:
328		Add firmware(9), WEP, CCMP, TKIP to GENERIC.
329
#	Line 128 | Line 333 | Items affecting the mports and packages system can be
333
334		pcc connected to the build on i386. (alternative compiler)
335
336	<	20080613:
132	<	Begin work for MidnightBSD 0.2-PRERELEASE
336	>	ath added to GENERIC.  (Atheros wireless NICs) on amd64/i386
337
338		20080528:
339		Sendmail 8.14.3
#	Line 693 | Line 897 | Contact Warner Losh if you have any questions about yo
897		this document.
898
899		$FreeBSD: src/UPDATING,v 1.416.2.18 2006/02/22 11:51:57 yar Exp $
900	<	$MidnightBSD: src/UPDATING,v 1.38.2.18 2009/05/21 23:11:43 laffer1 Exp $
900	>	$MidnightBSD: src/UPDATING,v 1.94.2.4 2010/11/11 13:32:34 laffer1 Exp $

Diff Legend

–	Removed lines
+	Added lines
<	Changed lines
>	Changed lines