Module Name: src Committed By: snj Date: Mon Jun 29 23:36:37 UTC 2009
Modified Files: src/doc [netbsd-5-0]: CHANGES-5.0.1 Log Message: Tickets 843 and 844. To generate a diff of this commit: cvs rdiff -u -r1.1.2.27 -r1.1.2.28 src/doc/CHANGES-5.0.1 Please note that diffs are not public domain; they are subject to the copyright notices on the relevant files.
Modified files: Index: src/doc/CHANGES-5.0.1 diff -u src/doc/CHANGES-5.0.1:1.1.2.27 src/doc/CHANGES-5.0.1:1.1.2.28 --- src/doc/CHANGES-5.0.1:1.1.2.27 Sun Jun 28 19:54:18 2009 +++ src/doc/CHANGES-5.0.1 Mon Jun 29 23:36:37 2009 @@ -1,4 +1,4 @@ -# $NetBSD: CHANGES-5.0.1,v 1.1.2.27 2009/06/28 19:54:18 snj Exp $ +# $NetBSD: CHANGES-5.0.1,v 1.1.2.28 2009/06/29 23:36:37 snj Exp $ A complete list of changes from the NetBSD 5.0 release to the NetBSD 5.0.1 release: @@ -466,3 +466,37 @@ a possible theoretical attack involving >= 1 billion ammo. [dholland, ticket #834] +crypto/dist/ssh/cipher.c 1.22 +crypto/dist/ssh/cipher.h 1.3 +crypto/dist/ssh/packet.c 1.32 + + Add special handling for CBC cipher modes to make them appear + less favorable than CTR modes. Also, in order to avoid creating + oracles unnecessarily, change behavior in various situations + from "Drop connection" to "Ignore packets up to 256kB". This + affects CBC mode ciphers only. + [tonnerre, ticket #843] + +games/hack/extern.h 1.11 +games/hack/hack.do_name.c 1.9, 1.10 +games/hack/hack.eat.c 1.8 +games/hack/hack.end.c 1.12 via patch +games/hack/hack.fight.c 1.10 +games/hack/hack.h 1.13 via patch +games/hack/hack.invent.c 1.12, 1.13 +games/hack/hack.main.c 1.12, 1.13 +games/hack/hack.objnam.c 1.9 +games/hack/hack.options.c 1.9 +games/hack/hack.pri.c 1.11 +games/hack/hack.rip.c 1.10, 1.11 +games/hack/hack.shk.c 1.10 +games/hack/hack.topl.c 1.10, 1.11 +games/hack/hack.unix.c 1.12, 1.13 + + sprintf -> snprintf, plus some use of strlcpy/strlcat where + appropriate. + Fix two serious string-handling bugs (one exploitable, one + probably exploitable) and also add proper checking/paranoia in + several other places. + [dholland, ticket #844] +