Lucas Holt | 17 Mar 13:38 2016
Gravatar

MidnightBSD 0.7.6 RELEASE

MidnightBSD 0.7.6 RELEASE

OpenSSH doesn't have the luck of the Irish.

Fix a security issue with OpenSSH X11 forwarding that can allow an attacker
run shell commands on the call to xauth.

Lucas Holt
Luke <at> FoolishGames.com
________________________________________________________
MidnightBSD.org (Free OS)
JustJournal.com (Free blogging)
Lucas Holt | 15 Jan 03:36 2016
Gravatar

MidnightBSD 0.7.3 RELEASE

An update for MidnightBSD is now available from SVN, 0.7.3 RELEASE. 

This release includes the following security fixes:

	OpenSSL

	The signature verification routines will crash with a NULL pointer dereference
	if presented with an ASN.1 signature using the RSA PSS algorithm and absent
	mask generation function parameter. [CVE-2015-3194]

	When presented with a malformed X509_ATTRIBUTE structure, OpenSSL will leak
	memory. [CVE-2015-3195]

	If PSK identity hints are received by a multi-threaded client then the values
	are incorrectly updated in the parent SSL_CTX structure.  [CVE-2015-3196]
	
	linuxolator

	A programming error in the Linux compatibility layer setgroups(2) system
	call can lead to an unexpected results, such as overwriting random kernel
	memory contents.

	A programming error in the handling of Linux futex robust lists may result
	in incorrect memory locations being accessed.

	0.7.2 RELEASE
	Fix a security issue with bsnmpd configuration file installation.

	TCP MD5 signature denial of service

(Continue reading)

Lucas Holt | 20 Sep 03:00 2015
Gravatar

MidnightBSD 0.7 RELEASE

I’m happy to announce the availability of MidnightBSD 0.7 RELEASE.  You can download it from the
MidnightBSD website at http://www.midnightbsd.org/

0.7-RELEASE NOTES

Security
Enhancements
Removed Features
New Software Versions
mports & package tools

This release is primarily for stabilization, ZFS and mport package tool enhancements. 

Upgrading from source:
	When upgrading from 0.6, you will need to install
	src/kerberos5/lib/libroken before building world.

This release is dedicated to Midnight the cat. He passed away this year after a battle with cancer. 

Security

expat
Multiple integer overflows have been discovered in the XML_GetBuffer() function in the expat library.

kernel
fix a security issue on amd64 where the GS segment CPU register can be changed via
userland value in kernel mode by using an IRET with #SS or #NP exceptions.

TCP Reassembly resource exhaustion bug:
There is a mistake with the introduction of VNET, which converted the
(Continue reading)

Lucas Holt | 29 Jul 02:57 2015
Gravatar

MidnightBSD 0.6.4 and 0.7 security

MidnightBSD 0.6.4 RELEASE fixes OpenSSH and TCP reassembly exhaustion issues.

CVE-2015-1417 (TCP), CVE-2014-2653 and CVE-2015-5600 (OpenSSH) affect MidnightBSD 0.5-0.7

MidnightBSD 0.7 CURRENT includes the security patches, a move to bsdpatch,, Heimdal 1.5.2, 
cpucontrol (via CPU support) and OpenSSL 1.0.1o.

Lucas Holt
Luke <at> FoolishGames.com
________________________________________________________
MidnightBSD.org (Free OS)
JustJournal.com (Free blogging)

_______________________________________________
Midnightbsd-users mailing list
Midnightbsd-users <at> stargazer.midnightbsd.org
http://www.midnightbsd.org/mailman/listinfo/midnightbsd-users
Lucas Holt | 12 Jun 20:38 2015
Gravatar

MidnightBSD 0.6.1 RELEASE

MidnightBSD 0.6.1 RELEASE fixes several security issues with OpenSSL.

It updates the system to OpenSSL 0.9.8zg.

Users of 0.6 or 07-CURRENT should update their systems via SVN.

You can read more about the issues via the OpenSSL website:
https://www.openssl.org/news/secadv_20150611.txt

Lucas Holt
Luke <at> FoolishGames.com
________________________________________________________
MidnightBSD.org (Free OS)
JustJournal.com (Free blogging)
Lucas Holt | 27 Apr 05:17 2015
Gravatar

MidnightBSD 0.6 RELEASE

0.6-RELEASE NOTES

This release is primarily a security fix and mport package tool release. 

Security

OpenSSL: 
The receipt of a specifically crafted DTLS handshake message may cause OpenSSL
to consume large amounts of memory. [CVE-2014-3506]

The receipt of a specifically crafted DTLS packet could cause OpenSSL to leak
memory. [CVE-2014-3507]

A flaw in OBJ_obj2txt may cause pretty printing functions such as
X509_name_oneline, X509_name_print_ex et al. to leak some information from
the stack. [CVE-2014-3508]

OpenSSL DTLS clients enabling anonymous (EC)DH ciphersuites are subject to
a denial of service attack. [CVE-2014-3510]

TCP SYN:
When a segment with the SYN flag for an already existing connection arrives,
the TCP stack tears down the connection, bypassing a check that the
sequence number in the segment is in the expected window.

Fix several security vulnerabilities in routed, rtsold, and namei with respect to Capsicum sandboxes
looking up nonexistent path names and leaking memory.

The input path in routed(8) will accept queries from any source and attempt to answer them.  However, the
output path assumes that the destination address for the response is on a directly connected network.
(Continue reading)

Lucas Holt | 8 Apr 03:40 2015
Gravatar

MidnightBSD security update 0.5.11-RELEASE

MidnightBSD 0.6-CURRENT & 0.5.11-RELEASE now contain fixes for two security issues. Users are advised to
update and build a new kernel.

The previous fix for IGMP had an overflow issue. This has been corrected.

ipv6: The Neighbor Discover Protocol allows a local router to advertise a
suggested Current Hop Limit value of a link, which will replace
Current Hop Limit on an interface connected to the link on the MidnightBSD
system.

Obtained from: FreeBSD

Lucas Holt
Luke <at> FoolishGames.com
________________________________________________________
MidnightBSD.org (Free OS)
JustJournal.com (Free blogging)

_______________________________________________
Midnightbsd-users mailing list
Midnightbsd-users <at> stargazer.midnightbsd.org
http://www.midnightbsd.org/mailman/listinfo/midnightbsd-users
Lucas Holt | 25 Feb 15:46 2015
Gravatar

MidnightBSD 0.5.9-RELEASE

        0.5.9 RELEASE

        Fix two security vulnerabilities.

        1. BIND servers which are configured to perform DNSSEC validation and which
        are using managed keys (which occurs implicitly when using
        "dnssec-validation auto;" or "dnssec-lookaside auto;") may exhibit
        unpredictable behavior due to the use of an improperly initialized
        variable.

        CVE-2015-1349

        2. An integer overflow in computing the size of IGMPv3 data buffer can result
        in a buffer which is too small for the requested operation.

        This can result in a DOS attack.

Lucas Holt
Luke <at> FoolishGames.com
________________________________________________________
MidnightBSD.org (Free OS)
JustJournal.com (Free blogging)
Lucas Holt | 11 Dec 14:35 2014
Gravatar

MidnightBSD 0.5.7-RELEASE

MidnightBSD 0.5.7 RELEASE includes a security fix for file(1) and libmagic that prevents a DOS attack
against any program using libmagic. 

Users can get the latest version from the 0.5 stable branch in subversion.

At a minimum, users should rebuild file(1) and libmagic.

Lucas Holt
Luke <at> FoolishGames.com
________________________________________________________
MidnightBSD.org (Free OS)
JustJournal.com (Free blogging)
Lucas Holt | 22 Oct 14:30 2014
Gravatar

MidnightBSD 0.5.3-RELEASE

MidnightBSD 0.5.3-RELEASE is now available via subversion. 

Fix several security vulnerabilities in OpenSSL, routed, rtsold,
and namei with respect to Capsicum sandboxes looking up
nonexistent path names and leaking memory.

OpenSSL update adds some workarounds for the recent
poodle vulnerability reported by Google.

The input path in routed(8) will accept queries from any source and
attempt to answer them.  However, the output path assumes that the
destination address for the response is on a directly connected
network.

Due to a missing length check in the code that handles DNS parameters,
a malformed router advertisement message can result in a stack buffer
overflow in rtsold(8).

In addition, we've released 0.5.2-RELEASE ISOs on the FTP server for both amd64 and i386. 
We plan to do rollup security releases periodically.

Lucas Holt
Luke <at> FoolishGames.com
________________________________________________________
MidnightBSD.org (Free OS)
JustJournal.com (Free blogging)
Dale Scott | 19 Oct 06:06 2014
Picon
Gravatar

how do you start the desktop gui (new user)

Hi there, I'm a new user. I did a new install from the 0.5.2 x386 ISO in a
VirtualBox vm on Win7. After the install, requested the graphics interface
when asked, saw a bunch of stuff downloaded, restarted as requested, and
still get a command line login. What am I missing? Is something not working?
How do I start the desktop?

Thanks,
Dale

Gmane