Follow @Openwall on Twitter for new release announcements and other news
Homepage de Owl

Autres langages :
English, Russian

Concepts
Architectures
Environement de compilation
Instructions d'installation

Téléchargement (HTTP, FTP, rsync, anoncvs, CVSweb)

Change logs (en anglais seulement):
Changements dans la version courante
Changements dans 3.1-stable
Changements jusqu'à 3.1
Changements dans 3.0-stable
Changements jusqu'à 3.0
Changements dans 2.0-stable
Changements jusqu'à 2.0
Changements dans 1.1-stable
Changements jusqu'à 1.1
Changements jusqu'à 1.0
Changements dans 0.1-stable

Graphisme
Captures d'écran
Diapositives de présentation

Owl hébergement VPS

This file lists the major changes made between Owl releases. While some of the changes listed here may also be made to a stable branch, the complete lists of stable branch changes are included with those branches and as errata for the corresponding Owl releases only.

This is very far from an exhaustive list of changes. Small changes to individual packages won't be mentioned here unless they fix a security or a critical reliability problem. They are, however, mentioned in change logs for the packages themselves.

Security fixes have a "Severity" specified for the issue(s) being fixed. The three comma-separated metrics given after "Severity:" are: risk impact (low, medium, or high), attack vector (local, remote, or indirect), and whether the attack may be carried out at will (active) or not (passive). Please note that the specified risk impact is just that, it is not the overall severity, so other metrics are not factored into it. For example, a "high" impact "local, passive" issue is generally of lower overall severity than a "high" impact "remote, active" one - this is left up to our users to consider given their specific circumstances.

Per our current conventions, a Denial of Service (DoS) vulnerability is generally considered to have a "low" risk impact (even if it is a "remote, active" one, which is to be considered separately as it may make the vulnerability fairly critical under specific circumstances). Some examples of "medium" impact vulnerabilities would be persistent DoS (where the DoS effect does not go away with a (sub)system restart), data loss, bugs enabling non-critical information leaks, cryptographic signature forgeries, and/or sending of or accepting spoofed/forged network traffic (where such behavior was unexpected), as long as they would not directly allow for a "high" impact attack. Finally, a typical "high" impact vulnerability would allow for privilege escalation such as ability to execute code as another user ID than the attacker's (a "local" attack) or without "legitimately" having such an ability (a "remote" attack).

The metrics specified are generally those for a worst case scenario, however in certain cases ranges such as "none to low" or/and "local to remote" may be specified, referring to the defaults vs. a worst case yet "legitimate" custom configuration. In some complicated cases, multiple issues or attacks may be dealt with at once. When those differ in their severity metrics, we use slashes to denote the possible combinations. For example, "low/none to high, remote/local" means that we've dealt with issue(s) or attack(s) that are "low, remote" and those that are "none to high, local". In those tricky cases, we generally try to clarify the specific issue(s) and their severities in the description.

Changes made between Owl 3.0 and Owl 3.1.

2014/07/07	Package: glibc

Added OpenBSD 5.5+ $2b$ prefix support to crypt_blowfish (same as $2y$).

2014/07/07	Package: gnupg
SECURITY FIX	Severity: medium, local/indirect, passive

Updated to 1.4.18. Fixed since 1.4.13 are DoS via compressed data (CVE-2013-4402, CVE-2014-4617) and RSA side-channel vulnerabilities (CVE-2013-4242, CVE-2013-4576).

2014/07/07	Package: kernel
SECURITY FIX	Severity: none to high, local, active

Updated to 2.6.18-371.9.1.el5.028stab114.2, which contains security fixes for the floppy disk driver in case a /dev/fd* device is accessible to a non-trusted user (normally not the case on Owl). Added a hardening measure against the ptrace SYSRET vulnerability (CVE-2014-4699), which could allow for DoS or privilege escalation in x86_64 kernel builds running on Intel CPUs, even though RHEL5 kernels are currently understood to be unaffected. References:
https://openvz.org/Download/kernel/rhel5-testing/028stab114.2
https://rhn.redhat.com/errata/RHSA-2014-0740.html
http://www.openwall.com/lists/oss-security/2014/07/08/16
http://www.openwall.com/lists/oss-security/2014/07/08/9

2014/06/09	Package: kernel
SECURITY FIX	Severity: high, local, active

Updated to 2.6.18-371.8.1.el5.028stab113.1, which is based on RHEL 5.10, and contains numerous security fixes compared to the kernel revision we were using before. Disabled this new kernel revision's RDRAND support because it suffers from the security risks discussed after that code had been introduced into mainline kernels (in particular, get_random_bytes() could be less random under VMs). Enabled CPU frequency scaling, which is needed on some modern servers to enable Intel's Turbo Boost (enabling it in BIOS settings only is often not enough). To use it, load a module appropriate for your hardware (e.g., "modprobe acpi-cpufreq") and control the CPU frequency via sysfs (turbo is typically enabled by setting the frequency on all logical CPUs to be nominally 1 KHz higher than the CPU's highest non-turbo base frequency). References:
https://openvz.org/Download/kernel/rhel5-testing/028stab113.1
https://rhn.redhat.com/errata/RHSA-2014-0433.html
https://openvz.org/Download/kernel/rhel5/028stab112.3
https://rhn.redhat.com/errata/RHSA-2014-0285.html
https://rhn.redhat.com/errata/RHSA-2014-0108.html
https://openvz.org/Download/kernel/rhel5/028stab110.1
https://rhn.redhat.com/errata/RHSA-2013-1790.html
https://rhn.redhat.com/errata/RHSA-2013-1348.html
https://openvz.org/Download/kernel/rhel5/028stab108.1
https://rhn.redhat.com/errata/RHSA-2013-1166.html
https://openvz.org/Download/kernel/rhel5/028stab107.2
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2224
https://openvz.org/Download/kernel/rhel5/028stab107.1
https://rhn.redhat.com/errata/RHSA-2013-0747.html

2014/06/08	Package: openssl
SECURITY FIX	Severity: medium, remote, passive

Updated to 1.0.0m, which includes a fix for CCS Injection vulnerability (CVE-2014-0224) and more. References:
http://www.openwall.com/lists/oss-security/2014/06/05/18
https://www.openssl.org/news/secadv_20140605.txt
http://ccsinjection.lepidum.co.jp

2013/04/20 -
2013/07/08	Package: john

Merged into the tree many changes, most of them sponsored by Rapid7 under their Magnificent7 program, which have ultimately resulted in John the Ripper 1.8.0 release. The code in Owl was then updated some further, up to version 1.8.0.2. Reference:
http://www.openwall.com/lists/announce/2013/05/30/1

2013/06/05	Package: strace

Updated to 4.8.

2013/04/24	Package: passwdqc

Updated to 1.3.0.

2013/04/07	Package: kernel

Updated to 2.6.18-348.3.1.el5.028stab106.2. The only change from our previous kernel revision is OpenVZ's minor bugfix in NFS client code. Reference:
https://openvz.org/Download/kernel/rhel5/028stab106.2

2013/03/19	Package: kernel
SECURITY FIX	Severity: high, local/indirect, active/passive

Updated to 2.6.18-348.3.1.el5.028stab106.1. The corresponding RHEL5 kernel updates fix a number of vulnerabilities, CVE IDs for the relevant ones of which are referenced below. Most importantly, this fixes a PTRACE_SETREGS vs. process death race condition (CVE-2013-0871), which could allow a non-privileged local user to execute arbitrary code in the kernel and thus escalate their privileges to root, escape from an OpenVZ container, etc. (However, the risk probability might have been low due to the race being difficult to win.) References:
https://openvz.org/Download/kernel/rhel5-testing/028stab106.1
https://rhn.redhat.com/errata/RHSA-2013-0621.html
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0871
http://www.openwall.com/lists/oss-security/2013/02/15/16
https://rhn.redhat.com/errata/RHSA-2013-0594.html
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3400
http://www.openwall.com/lists/oss-security/2012/07/03/1
https://rhn.redhat.com/errata/RHSA-2013-0168.html
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1568
http://www.openwall.com/lists/oss-security/2012/03/20/4
https://rhn.redhat.com/errata/RHBA-2013-0006.html
https://rhn.redhat.com/errata/RHSA-2012-1540.html
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4508
http://www.openwall.com/lists/oss-security/2012/10/25/1
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3552
http://www.openwall.com/lists/oss-security/2012/08/31/11

2013/02/23	Package: glibc

Backported a fix for a TLS handling bug that manifested itself as an assertion failure on startup of some third-party program binaries, as reproduced with Mozilla's build of Firefox 17.0.1:
http://www.openwall.com/lists/owl-dev/2013/02/23/2

2013/02/22	Package: gnupg
SECURITY FIX	Severity: medium, indirect, passive

Updated to 1.4.13. This version fixes a memory corruption bug (CVE-2012-6085). The bug allowed an attacker to crash gpg(1) and corrupt the public keyring database file. Arbitrary code execution was not possible because the attacker cannot control the corrupted data. The corrupted data is stored in the keyring file, so the DoS effect is persistent, but the keyring can be manually restored by recovering from the pubring.gpg~ backup file (which is created by gpg(1) itself). References:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-6085
https://bugzilla.redhat.com/show_bug.cgi?id=891142
http://www.openwall.com/lists/oss-security/2013/01/01/6

2013/02/22	Package: kernel
SECURITY FIX	Severity: none to low, local/indirect, active/passive

Updated to 2.6.18-308.20.1.el5.028stab104.3. Enabled CONFIG_EFI_PARTITION=y (GUID Partition Table (GPT) support) and CONFIG_SOUND=m (the sound card driver subsystem) with the same set of drivers as in RHEL5. The corresponding RHEL5 kernel updates fix a divide-by-zero flaw in the ext4 filesystem code (CVE-2012-2100), which could be triggered via a corrupted ext4 filesystem. This is only a security issue if untrusted users are permitted to mount filesystems or/and when mounting filesystems from untrusted sources; other and worse attacks are likely possible in those cases, thereby making this one fix relatively unimportant. Red Hat has also fixed a flaw in the dl2k driver (CVE-2012-2313), which is not included in our kernel builds. References:
https://openvz.org/Download/kernel/rhel5-testing/028stab104.3
https://openvz.org/Download/kernel/rhel5-testing/028stab104.2
https://openvz.org/Download/kernel/rhel5-testing/028stab104.1
https://rhn.redhat.com/errata/RHSA-2012-1445.html
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2100
https://openvz.org/Download/kernel/rhel5-testing/028stab103.1
https://rhn.redhat.com/errata/RHSA-2012-1174.html

2012/08/18	Package: openssl
SECURITY FIX	Severity: none to medium, remote, passive to active

Updated to 1.0.0j. This release corrects a buffer over-read flaw in the handling of CBC mode ciphersuites in DTLS. No DTLS-using programs are included in Owl, so it'd take a third-party program to make this flaw actually triggerable on Owl. References:
https://www.openssl.org/news/secadv_20120510.txt
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2333

2012/08/18	Package: xinetd
SECURITY FIX	Severity: none to medium, remote, active

Updated to 2.3.15, which corrects an access control bypass vulnerability in the normally disabled tcpmux service. References:
http://www.openwall.com/lists/oss-security/2012/05/09/5
https://bugzilla.redhat.com/show_bug.cgi?id=790940
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0862

2012/08/18	Package: kernel
SECURITY FIX	Severity: low, local, active

Updated to 2.6.18-308.11.1.el5.028stab102.1. The corresponding RHEL5 kernel update fixes a flaw in the epoll subsystem, which could be used for a local DoS attack. Other security flaws reported as fixed in the release notes referenced below do not affect Owl's builds of the kernel (they're in Xen and extended taskstats functionality, which we do not include). References:
https://openvz.org/Download/kernel/rhel5-testing/028stab102.1
https://rhn.redhat.com/errata/RHSA-2012-1061.html
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3375
https://openvz.org/Download/kernel/rhel5-testing/028stab101.1

2012/08/14	Package: glibc

Corrected the processing of '\x80' characters in extended DES-based crypt(3) hashes. A related issue affecting traditional DES-based crypt(3) hashes is known as CVE-2012-2143 in other projects using the same FreeSec code, but luckily in Owl we've been using this code only for the extended hashes (continuing to use upstream glibc's UFC-crypt for traditional ones), and these were only affected in terms of compatibility (with BSD/OS and certain other implementations), but not security. Hence, this is not a security fix.

2012/08/14	Package: slang

Dropped S-Lang from Owl. We never made use of it in Owl itself.

2012/08/14	Package: binutils

Updated to 2.23.51.0.1.

2012/07/23	Package: tcsh

Updated to 6.18.01.

2012/05/12	Package: binutils

Updated to 2.22.52.0.1.

2012/05/08	Package: syslinux

Updated to 4.05.

2012/05/08	Package: lftp

Updated to 4.3.6. Corrected an assertion failure with torrent peer id generation when the lftp PID is above 65535. Added a patch proposed by upstream to always obtain and report exact file timestamps.

2012/05/06	Package: openssl
SECURITY FIX	Severity: medium/high, remote/indirect, active/passive

Updated to 1.0.0i, which corrects numerous vulnerabilities discovered since 1.0.0d (the version we had in Owl-current before). The attack vectors and worst case impact of these vulnerabilities vary. The ASN1 BIO vulnerability (CVE-2012-2110) discovered by Tavis Ormandy of Google Security Team and patched specifically in the 1.0.0i release in April potentially allows for arbitrary code execution, but is not triggerable via OpenSSL's SSL/TLS code, whereas worst case impact of other vulnerabilities corrected with this update is lower. References:
https://www.openssl.org/news/secadv_20120419.txt
http://lists.openwall.net/full-disclosure/2012/04/19/4
http://www.openwall.com/lists/oss-security/2012/04/22/2
http://www.openwall.com/lists/oss-security/2012/04/22/3
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2110
https://www.openssl.org/news/secadv_20120312.txt
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0884
https://www.openssl.org/news/secadv_20120104.txt
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4108
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4576
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4577
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4619
https://www.openssl.org/news/secadv_20110906.txt
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3207

2012/05/06	Package: kernel
SECURITY FIX	Severity: low to high, local, active

Updated to 2.6.18-308.4.1.el5.028stab100.2, which includes a fix for excessive in-kernel CPU time consumption when creating large nested epoll structures (CVE-2011-1083) as reported by Nelson Elhage. Corrected an Owl-specific mm (memory) leak and a reference count overflow possibility (with non-obvious impact) that was inadvertently introduced in 2.6.18-274.18.1.el5.028stab098.1.owl1 and which could be triggered on i686 (not x86_64) on read attempts from /proc/<pid>/*maps by other than the same program instance that opened these special files. Reverted the dmesg_restrict sysctl tri-state feature in favor of the approach taken by OpenVZ. References:
https://openvz.org/Download/kernel/rhel5-testing/028stab100.2
https://openvz.org/Download/kernel/rhel5-testing/028stab099.4
https://openvz.org/Download/kernel/rhel5/028stab099.3
https://rhn.redhat.com/errata/RHSA-2012-0150.html
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1083
http://www.openwall.com/lists/oss-security/2011/03/02/1
http://www.openwall.com/lists/oss-security/2011/03/02/2
https://bugs.openvz.org/browse/OVZ-5328

2012/05/02	Package: strace

Updated to 4.7.

2012/04/22	Package: hdparm

Updated to 9.39, added packaging of the wiper.sh script (SSD trimming).

2012/03/03	Package: gcc

Updated to 4.6.3.

2012/02/25	Package: kernel
SECURITY FIX	Severity: low/low to high, remote/local, active

Updated to 2.6.18-274.18.1.el5.028stab098.1, which fixes an IGMP remote DoS over LAN (CVE-2012-0207), two ext4 filesystem local DoS flaws (CVE-2011-3638, CVE-2011-4086), and a flaw in handling of robust list pointers of user-space held futexes across execve(2) calls (CVE-2012-0028), which could be used for privilege escalation via a SUID/SGID program that is multi-threaded or/and has a memory-mapped device, file, or shared memory segment (Owl does not include such SUID/SGID programs). Introduced the previously missed RLIMIT_NPROC check into fs/compat.c: compat_do_execve() (used by 32-bit program binaries on 64-bit kernel). Introduced protection against unintended self-read by a SUID/SGID program of /proc/<pid>/mem and /proc/<pid>/*maps files, based on approaches taken in recent grsecurity patches. Made the kernel.dmesg_restrict sysctl tri-state and container-aware. Enabled CONFIG_NFSD=m, CONFIG_CIFS=m, CONFIG_NET_SCHED=y, CONFIG_NET_RADIO=y, CONFIG_PCCARD=m and lots of WiFi drivers as modules. References:
https://openvz.org/Download/kernel/rhel5/028stab098.1
https://rhn.redhat.com/errata/RHSA-2012-0107.html
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0207
https://womble.decadent.org.uk/blog/igmp-denial-of-service-in-linux-cve-2012-0207.html
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=654876
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3638
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4086
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0028
http://www.openwall.com/lists/oss-security/2012/01/04/18
http://www.openwall.com/lists/oss-security/2012/05/08/1
https://bugzilla.redhat.com/show_bug.cgi?id=771764
http://www.openwall.com/lists/oss-security/2012/02/08/2

2012/02/18	Package: glibc

Enabled building of UTF-8 locales by default (adds 6.5 MB to glibc .rpm package size and 36 MB to installed system size on a filesystem with 4 KB blocks, unfortunately).

2012/02/12 -
2012/02/18	Package: gcc; Owl/build/.rpmmacros

Enabled -Wl,-z,relro and -Wl,-z,now by default as a security hardening measure, rebuilt all packages. In most cases the performance impact is non-existent or negligible. To disable these options (for whatever reason), pass -Wl,-z,norelro and -Wl,-z,lazy to gcc, respectively. Note: ld(1) still uses -z norelro and -z lazy by default; only gcc's defaults are changed. (We already had -Wl,-z,relro in Owl/build/.rpmmacros since 2011/11/04; now that change is reverted in favor of gcc's change of default, and we've also added -Wl,-z,now.) References:
http://isisblogs.poly.edu/2011/06/01/relro-relocation-read-only/
http://tk-blog.blogspot.com/2009/02/relro-not-so-well-known-memory.html

2012/01/25	Package: kernel
SECURITY FIX	Severity: low to high, local, active

Updated to 2.6.18-274.17.1.el5.028stab097.1. Of the security issues mentioned in the Red Hat advisory referenced below, 5 are relevant to Owl's build of the kernel. Their relevance to and impact on specific Owl installs varies. Specifically, access to some /proc/<pid>/* special files was not revoked on invocation of a SUID/SGID program, which allowed for an ASLR bypass (easier exploitation of certain kinds of other security flaws if present) as well as for an additional and unintended way to interact with the program (e.g. causing it to fail with a file lock held). Since Owl does not have any SUID binaries by default (only having some SGIDs), the impact of this flaw on default installs of Owl was greatly reduced. The remaining 4 flaws fixed with this update are either reliably known or currently understood to be limited to local denial of service (DoS), one of them requires that a specially-crafted corrupted ext3 or ext4 filesystem be mounted, and two are in the NFS client and thus require an NFS mount to be present and accessible to a local attacker. Please refer to the CVE IDs and other references below for more detail. References:
https://openvz.org/Download/kernel/rhel5-testing/028stab097.1
https://rhn.redhat.com/errata/RHSA-2012-0007.html
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1020
http://www.halfdog.net/Security/2011/SuidBinariesAndProcInterface/
http://lists.openwall.net/linux-kernel/2011/02/07/416
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3637
http://www.openwall.com/lists/oss-security/2012/02/06/1
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4132
http://www.openwall.com/lists/oss-security/2012/02/06/2
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4324
http://www.openwall.com/lists/oss-security/2012/02/06/3
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4325
http://www.openwall.com/lists/oss-security/2012/02/06/4

2011/12/27	Package: kernel
SECURITY FIX	Severity: medium, local, passive

Updated to 2.6.18-274.12.1.el5.028stab096.1, enabled build of the VIA Rhine NIC driver (as a module). Although the corresponding RHEL update fixed multiple vulnerabilities, only the taskstats io infoleak (CVE-2011-2494) is relevant to Owl kernel builds. References:
https://openvz.org/Download/kernel/rhel5-testing/028stab096.1
https://rhn.redhat.com/errata/RHSA-2011-1479.html
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2494
http://www.openwall.com/lists/oss-security/2011/06/24/6
http://www.openwall.com/lists/oss-security/2011/09/21/1

2011/12/27	Package: hardlink

Fixed a bug in a code path triggered on error.

2011/11/27	Package: kernel
SECURITY FIX	Severity: low to medium, local/remote, active

Updated to -274.7.1.el5.028stab095.1, which contains fixes for multiple local and remote DoS vulnerabilities, including via triggering an ext4 filesystem implementation bug with writes into the last block of a file in certain special circumstances, mremap(2) syscall, receiving of a specially crafted packet when GRO is enabled, receiving of a specially crafted packet on a bridge device, and via clock_gettime(2) syscall. This kernel revision also improves the randomness of IPv4 sequence numbers by moving from a 24-bit random component generated using MD4 plus a timer-based component to the full 32-bit numbers generated using MD5. Owl is not affected by the rest of vulnerabilities reported in the referenced Red Hat advisory as we don't build the corresponding components. Also included with this update is an OpenVZ fix of "loosing socket permissions in /dev with udev+tmpfs during CT restore (live migration)", which may be relevant to certain non-Owl OpenVZ containers being live-migrated on Owl host systems. Finally, we've changed the default for CONFIG_PCNET32 from =m to =y for ease of use under VMware, which emulates NIC of this type by default. References:
https://openvz.org/Download/kernel/rhel5/028stab095.1
https://rhn.redhat.com/errata/RHSA-2011-1386.html
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2695
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2696
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2723
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2942
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3209
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3188

2011/11/23	Package: john

John the Ripper has been enhanced in numerous ways, most notably gaining OpenMP parallelization for more hash types, resulting in its 1.7.9 release, which is also part of Owl (as usual). The Owl package of John the Ripper now actually has OpenMP parallelization and support for Intel AVX and AMD XOP enabled due to our move to GCC 4.6.x. It also includes transparent fallback to non-OpenMP and/or pre-AVX program binaries when the thread count would be 1 (such as because the system only has one logical CPU) or when running on a CPU not supporting AVX, respectively. Reference:
http://www.openwall.com/lists/john-users/2011/11/23/2

2011/10/29	Packages: syslinux, owl-cdrom; Owl/build/*

Packaged SYSLINUX - a collection of boot loaders - and moved from LILO to ISOLINUX for the ISO-9660 images generated by "make iso".

2011/10/29	Package: gcc

Updated to 4.6.2.

2011/10/26	Package: tzdata

Updated to 2011m.

2011/10/26	Package: owl-startup

Added VLAN support (patch by Piotr Meyer).

2011/10/24	Package: pam
SECURITY FIX	Severity: none to high, local, active

Applied upstream fixes for two vulnerabilities in pam_env. This module is not in use on default installs of Owl, and it never was, hence there was no impact for default installs. References:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3148
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3149

2011/10/24	Packages: gcc, gmp, libmpc, mpfr

Updated GCC to 4.6.1. Packaged GMP, MPC, and MPFR - arbitrary precision arithmetic libraries, which are required by the new GCC version.

2011/10/15	Package: tzdata

Updated to 2011l. Reduced installed package size via use of hardlinks.

2011/10/15	Package: hardlink

New package: a program to consolidate duplicate files via hardlinks.

2011/10/10	Package: rpm
SECURITY FIX	Severity: high, indirect, passive

Applied a fix for crash and potential arbitrary code execution when processing a malformed/malicious package file. Although an RPM package can, by design, execute arbitrary code when installed or even during installation, this issue would potentially allow a specially-crafted RPM package to execute arbitrary code when the package metadata is merely queried, including for digital signature verification. Note that for Owl RPM packages we do not rely on RPM's support for signatures; instead, we sign *.mtree files. Please continue to verify detached GnuPG signatures that we provide for such files with gpg(1), and then verify RPM package files against the message digests found in *.mtree files with mtree(8) (both of these tools are part of Owl). This kind of verification was unaffected by this RPM issue. Please note that use of RPM on untrusted package files, even if just to verify a signature, remains risky despite of this recent fix: RPM package format and processing are complicated, so further issues of this kind are likely. References:
http://www.openwall.com/lists/oss-security/2011/09/27/3
https://rhn.redhat.com/errata/RHSA-2011-1349.html
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3378

2011/10/10	Package: SysVinit

Applied a patch to set the shell name to /bin/bash, not /bin/sh, such that colored ls output is enabled on our LiveCD.

2011/10/09	Packages: kernel, vzctl
SECURITY FIX	Severity: low, local, active

Updated the kernel to 2.6.18-274.3.1.el5.028stab094.3 (OpenVZ's latest stable from their RHEL 5 based branch, now rebased on RHEL 5.7's). Restricted permissions on /proc/slabinfo as a security hardening measure. Moved some OpenVZ features to modules like it is done in OpenVZ's official kernel builds. Changed CONFIG_UDF_FS=y to =m. Changed CONFIG_BLK_DEV_CRYPTOLOOP and most CONFIG_CRYPTO_* from =y to =m. On x86_64, changed CONFIG_PCNET32 and CONFIG_FORCEDETH (these are some of the 100 Mbps NIC drivers) from =y to =m. Of the 100 Mbps NIC drivers, we're leaving only those for Intel, Realtek, and NE2000-compatible PCI NICs built into the kernel on x86_64 now. Set CONFIG_SCSI_AIC94XX=y and CONFIG_BLK_CPQ_CISS_DA=y (the latter was already =y on i686, now it is =y on x86_64 as well). Although we reference two Red Hat security advisories below, none of the worse than local DoS issues listed in those advisories affect our previous kernel builds, either because we do not build the affected components, or in case of CVE-2011-2495 because we already had the permissions on /proc/PID/io restricted before Owl 3.0 release. References:
https://openvz.org/Download/kernel/rhel5/028stab094.3
https://rhn.redhat.com/errata/RHSA-2011-1212.html
https://openvz.org/Download/kernel/rhel5/028stab093.2
https://rhn.redhat.com/errata/RHSA-2011-1065.html
http://www.openwall.com/lists/kernel-hardening/2011/09/27/3

2011/10/09	Packages: tzdata, glibc; Owl/build/installorder.conf

Moved timezone data files from glibc to new package tzdata, updated it to version 2011k.

2011/09/07	Owl/build/{install*.sh,installorder.conf}

Support for optional package tags has been added to installorder.conf and made use of in install*.sh scripts. Currently supported are: "D:" - CD only; "d:" - exclude from CD; "E:" - exclude from CD and OpenVZ container templates; "H:" - host only (exclude from OpenVZ container templates).

2011/09/07	Package: owl-etc

Added /etc/owl-release (with "Owl-current post-3.0" in it).

2011/09/07	Package: owl-dev

Create /dev/sd* devices for 16 disks, not just 8 like we did before.

2011/07/27	Package: kernel
SECURITY FIX	Severity: none to high, local, active

Updated to 2.6.18-238.19.1.el5.028stab092.2. Enabled CONFIG_BONDING=m in both i686 and x86_64 kernels, enabled CONFIG_BLK_CPQ_CISS_DA=m in the x86_64 kernel (i686 already had it at "=y"). Applied a patch adding limited support for LSISAS8208ELP (PCI device id 0x0059), which provides access to individual hard drives. Moved the RLIMIT_NPROC check from set_user() to execve(2) and adjusted set_user() so that it can't fail. These changes were desirable to address missing setuid(2) return value check vulnerabilities in user-space programs. References:
https://openvz.org/Download/kernel/rhel5/028stab092.2
https://openvz.org/Download/kernel/rhel5/028stab091.1
https://rhn.redhat.com/errata/RHSA-2011-0927.html
https://rhn.redhat.com/errata/RHSA-2011-0833.html
https://bugs.gentoo.org/show_bug.cgi?id=325805
https://bugs.gentoo.org/attachment.cgi?id=236721
https://forums.gentoo.org/viewtopic-t-731366.html
http://www.openwall.com/lists/kernel-hardening/2011/07/12/1

2011/07/25	Package: rpm
SECURITY FIX	Severity: none to high, local, passive

Added a patch to remove unsafe file permissions (chmod'ing files to 0) on package removal or upgrade to prevent continued access to such files via hard-links possibly created by a user. References:
http://www.openwall.com/lists/oss-security/2011/07/25/1
http://www.openwall.com/lists/oss-security/2010/06/02/2
https://bugzilla.redhat.com/show_bug.cgi?id=125517
https://bugzilla.redhat.com/show_bug.cgi?id=598775
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-4889
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2059

2011/06/21 -
2011/07/17	Packages: glibc, pam, shadow-utils, tcb
SECURITY FIX	Severity: high, remote, active

crypt_blowfish has been updated to version 1.1 (and then to 1.2), which fixes the 8-bit character handling bug and adds 8-bit test vectors and a quick self-test on every password hash computation. The impact of this bug was that most (but not all) passwords containing non-ASCII characters with the 8th bit set were hashed incorrectly, resulting in password hashes incompatible with those of OpenBSD's original implementation of bcrypt. What's worse, in some cases (but not in all) one, two, or three characters immediately preceding the 8-bit characters were ignored by the password hash computation. Thus, many passwords containing characters with the 8th bit set were significantly easier to crack than it was previously expected. This primarily applies to offline attacks against the password hashes (if the hashes are leaked or stolen), but in rare extreme cases it might also apply to remote password guessing attacks. In practice, passwords with non-ASCII characters are relatively uncommon and are typically more complicated than average, so they're unlikely to be an attractive target for attacks, despite of the weakness that this bug exposes them to. Yet the risk is there. With this glibc update, existing users' passwords containing characters with the 8th bit set will mostly stop working, because the hashes will be computed correctly and not match the incorrectly computed hashes recorded in the system. In order to allow users to log in after the upgrade even if they have a potentially affected password, the newly introduced backwards compatibility hash encoding prefix of "$2x$" may be used. Such password hashes should only be used during a transition period; when passwords are changed and hashed using the correct algorithm, another newly introduced "$2y$" prefix is used. After installation of this glibc update, login services such as sshd(8) should be restarted ("service sshd restart" and so on) in order for users' newly changed passwords (with the "$2y$" prefix on the hash encodings) to be recognized. References:
http://www.openwall.com/lists/announce/2011/06/21/1
http://www.openwall.com/lists/oss-security/2011/06/24/1
http://www.openwall.com/lists/oss-security/2011/06/29/16
http://www.openwall.com/lists/john-dev/2011/07/06/15
http://www.openwall.com/lists/oss-security/2011/07/07/9
http://www.openwall.com/lists/oss-security/2011/07/08/1
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2483

2011/06/22	Package: john

In an effort sponsored by Rapid7, the bitslice DES S-box expressions have been replaced with those generated by Roman Rusakov specifically for John the Ripper. The corresponding assembly code for x86 with MMX, SSE2, and for x86-64 with SSE2 has been re-generated. Support for bcrypt hashes of passwords containing characters with the 8th bit set has been corrected. (The old buggy behavior may be enabled per-hash, using the "$2x$" prefix.) The external mode virtual machine's performance has been improved. This update of John the Ripper has also been released separately from Owl as version 1.7.8. References:
http://www.openwall.com/lists/john-users/2011/06/22/1
https://www.rapid7.com

2011/06/09	Package: lilo

Updated to 23.2.

2011/05/03	Package: kernel
SECURITY FIX	Severity: none to low, local, active

Updated to 2.6.18-238.9.1.el5.028stab089.1. This fixes obscure security issues: kernel panic by unprivileged user via NFSv4 (CVE-2011-1090) and NULL pointer dereference in GRO code (CVE-2011-1478). It fixes non-security issues with page tables accounting, AMD Bulldozer boot process, OOM killer, and CPU stats bugs. It also introduces numerous features. References:
https://openvz.org/Download/kernel/rhel5/028stab089.1
https://openvz.org/Download/kernel/rhel5/028stab085.5
https://rhn.redhat.com/errata/RHSA-2011-0429.html
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1090
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1478

2011/05/03	Package: rpm

Fixed a regression in %patch introduced in the previous release. Thanks to Chris Bopp for reporting the bug. Reference:
http://www.openwall.com/lists/owl-dev/2011/05/02/1

2011/05/03	Package: iproute2

Updated to 2.6.38.

2011/05/03	Package: iputils

Updated to s20101006.

2011/04/27	Package: john

Made numerous enhancements to John the Ripper, resulting in its 1.7.7 release, which is also part of Owl (as usual). Reference:
http://www.openwall.com/lists/john-users/2011/04/28/1

2011/04/02	Package: kernel

Updated to 2.6.18-238.5.1.el5.028stab085.3, which is now marked as "RHEL5 stable". This fixes a kernel Oops caused by nfsd. Also fixed an Owl-specific x86_64 gettimeofday(2) VDSO issue, which manifested itself in some 64-bit programs inside containers with some Linux distributions (not Owl) crashing with SIGSEGV. The issue was new with -238 kernels (thus, it was not present in Owl 3.0, nor in 3.0-stable). References:
https://openvz.org/Download/kernel/rhel5/028stab085.3
https://bugs.openvz.org/browse/OVZ-4946

2011/03/21	Package: kernel
SECURITY FIX	Severity: none to medium, local, active

Backported fixes for information leaks in Netfilter modules: arp_tables (CVE-2011-1170), ip_tables (CVE-2011-1171), ip6_tables (CVE-2011-1172), and ipt_CLUSTERIP. One must have CAP_NET_ADMIN to exploit these issues (e.g. in-container root may trigger the leak). The default Owl installation is vulnerable to the infoleak in ip_tables only as we don't ship other Netfilter modules nor have IPv6 enabled. References:
http://www.openwall.com/lists/oss-security/2011/03/18/15
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1170
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1171
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1172

2011/03/17	Package: nmap

Updated to 5.51.

2011/03/15	Package: strace

Updated to 4.6.

2011/03/14	Package: iptables

Changed the default for IPTABLES_STATUS_ARGS to "-nv". Most importantly, this disables the (risky and slow) reverse DNS lookups with "service iptables status".

2011/03/12	Package: kernel
SECURITY FIX	Severity: low, local/remote, active

Updated the kernel to OpenVZ's latest from their "RHEL5 testing" branch (238.5.1.el5.028stab085.2) fixing a rare kernel panic with sysfs virtualization, a potential livelock in dirty pages balancing, and a bug in CFQ. The new RHEL5 kernel revision that this OpenVZ kernel is based on fixes a flaw in the garbage collector for AF_UNIX sockets (CVE-2010-4249, local DoS) and a flaw in handling of received packets exceeding the buffer limit (CVE-2010-4251, remote DoS). (It also includes a fix for CVE-2010-4655, but it was already included in our 2011/01/28 update.) Fixed an Owl-current specific bug in checksum calculation of fragmented ICMP echo request datagrams (reported by Piotr Meyer). Disabled the eepro100 driver in favor of e100. References:
https://openvz.org/Download/kernel/rhel5-testing/028stab085.2
https://openvz.org/Download/kernel/rhel5-testing/028stab085.1
https://rhn.redhat.com/errata/RHSA-2011-0303.html
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4249
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4251
http://www.openwall.com/lists/owl-users/2011/03/06/1
http://www.openwall.com/lists/owl-users/2011/03/05/3

2011/03/02	Package: vsftpd
SECURITY FIX	Severity: none to low, remote, active

Updated to 2.3.4. This release corrects a DoS vulnerability discovered by Maksymilian Arciemowicz where an attacker permitted to login to an FTP server would be able to cause the vsftpd child process(es) spawned for their session(s) to consume excessive amounts of CPU time. If the attack is carried out on a sufficient number of FTP sessions (possibly from multiple source IP addresses to exceed a possible per-source limit), the FTP service would become unavailable and other services of the system would be greatly impacted. References:
http://securityreason.com/achievement_securityalert/95
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0762

2011/02/24	Packages: openssl, openssh

Updated OpenSSL to 1.0.0d.

2011/02/18	Package: patchutils

Updated to 0.3.2.

2011/02/10	Package: kernel

Updated the kernel to OpenVZ's latest from their "RHEL5 testing" branch (238.1.1.el5.028stab084.3), which includes updated fix for the x86_64 VDSO bug (the fix in 028stab084.1 was incomplete) and fix for optimized kmem accounting bug. Enabled Ethernet bridge support, PPP_MPPE, and ULOG netfilter target. For more info, see the changelog for the kernel package. References:
https://openvz.org/Download/kernel/rhel5-testing/028stab084.3
https://bugs.openvz.org/browse/OVZ-4893

2011/02/09	Package: patch
SECURITY FIX	Severity: high, indirect, passive

Backported a fix for CVE-2010-4651. The patch utility allowed ".." in pathnames, and it also allowed absolute pathnames, either of which could allow an attacker to create or modify arbitrary files outside of the intended directory tree using a specially-crafted patch file. Our partial fix of 2011/02/02 did not address the absolute pathname case. References:
https://bugzilla.redhat.com/show_bug.cgi?id=667529
http://www.openwall.com/lists/oss-security/2011/01/05/10
http://lists.gnu.org/archive/html/bug-patch/2010-12/msg00000.html
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4651

2011/02/05	Packages: usb_modeswitch, usb_modeswitch-data

New packages: usb_modeswitch is a mode switching tool for controlling "flip flop" (multiple device) USB gear. usb_modeswitch-data contains the data files for usb_modeswitch.

2011/02/05	Package: libusb-compat

New package: libusb-compat is a compatibility layer allowing applications written for libusb-0.1 to work with libusb-1.0. It is needed for usb_modeswitch.

2011/02/05	Package: kernel

Updated to upstream's "fixed fix for paging accounting". The incomplete fix introduced with our 2011/02/04 update could have caused trouble with 32-bit x86 kernels. Reference:
https://bugs.openvz.org/browse/OVZ-4891

2011/02/05	Package: shadow-utils

Added USERNAME_RELAXED and GROUPNAME_RELAXED options to /etc/login.defs, which, if changed to "yes", will allow capital letters to be used in new usernames and/or group names, respectively.

2011/02/04	Package: kernel

Updated the kernel to OpenVZ's latest from their "RHEL5 testing" branch (238.1.1.el5.028stab084.1), which includes updated atl1 driver (Attansic L1 Gigabit Ethernet). Enabled VDSO on x86_64 (the actual bug was believed to be fixed in 028stab084.1). Applied upstream's initial "fix for non-4levels page tables acct" (the bug was introduced in 084.1, so we did not have it before). References:
https://openvz.org/Download/kernel/rhel5-testing/028stab084.1
https://bugs.openvz.org/browse/OVZ-4891

2011/02/02	Package: patch

Backported a partial fix for CVE-2010-4651. Since the fix turned out to be incomplete, this change is not actually fixing CVE-2010-4651 yet.

2011/01/31 -
2011/02/01	Packages: kernel, iputils, owl-etc, owl-startup

Added support for non-raw ICMP sockets to the kernel and made use of said support in ping(1). References:
http://lwn.net/Articles/420799/
http://openwall.info/wiki/people/segoon/ping

2011/01/30	Package: vconfig

New package: vconfig is a user mode program to add and remove 802.1q VLAN virtual devices from Ethernet devices.

2011/01/29	Package: kernel

Dealt with two known critical x86_64 specific bugs introduced in 2.6.18-238.1.1.el5.028stab083.1, applying a fix for one of them (bootup on systems with more than 8 logical CPUs) and working around the other (VDSO, which is now temporarily disabled on x86_64, to be re-enabled with the next kernel update). Reference:
https://openvz.org/Download/kernel/rhel5-testing/028stab083.1

2011/01/29	Package: nmap

Updated to 5.50.

2011/01/28	Package: usbutils

New package: usbutils contains the lsusb utility for inspecting the devices connected to the USB bus.

2011/01/28	Package: libusb1

New package: libusb is a library providing access to USB devices.

2011/01/28	Package: kernel
SECURITY FIX	Severity: none to medium, local, active

Updated to OpenVZ's 2.6.18-238.1.1.el5.028stab083.1. Fixed a potential information leak in net/core/ethtool.c: ethtool_get_regs() - this was the portion of CVE-2010-4655 relevant to RHEL5 kernels. According to our analysis, this issue did not affect installs with default OpenVZ container settings, but it could affect systems where a network device was passed into an OpenVZ container by an administrator. Made numerous kernel configuration changes (enabled extra drivers, moved some to modules), documented the changes (and the rationale behind them) in the change log for the kernel package. (The important and relevant ones of the security fixes described in the Red Hat security advisories referenced below were already included in our previous kernel revision (in Owl 3.0) with our own backports from a "testing" Red Hat kernel.) References:
https://openvz.org/Download/kernel/rhel5-testing/028stab083.1
https://rhn.redhat.com/errata/RHSA-2011-0163.html
https://openvz.org/Download/kernel/rhel5-testing/028stab082.1
https://rhn.redhat.com/errata/RHSA-2011-0004.html
http://www.openwall.com/lists/oss-security/2011/01/28/1
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4655

2011/01/27	Package: bridge-utils

New package: bridge-utils is a tool for configuring the Linux Ethernet bridge.

2011/01/27	Package: pv

New package: PV ("Pipe Viewer") is a tool for monitoring the progress of data through a pipeline.

2011/01/27	Package: ethtool

New package: ethtool is an utility for controlling network drivers and hardware, particularly for wired Ethernet devices.

2011/01/25	Package: e2fsprogs

Updated to 1.41.14.

2011/01/24	Package: owl-startup

Added "-s 131072" to the dmesg invocation in rc.sysinit. Without this change, /var/run/dmesg.boot was often incomplete.

2011/01/24	Package: lilo

Updated to 23.1.

2011/01/24	Package: vim

Moved a few syntax highlighting related files from the vim-syntax to the vim-enhanced subpackage to correct a packaging error where some files in vim-enhanced were dependent upon files from vim-syntax, which is not installed by default.

$Owl: Owl/doc/CHANGES-3.1,v 1.132 2018/05/23 19:23:53 solar Exp $