---

1 Introduction

This errata document contains ``late-breaking news'' about FreeBSD 4.4-RELEASE. Before installing this version, it is important to consult this document to learn about any post-release discoveries or problems that may already have been found and fixed.

Any version of this errata document actually distributed with the release (for example, on a CDROM distribution) will be out of date by definition, but other copies are kept updated on the Internet and should be consulted as the ``current errata'' for this release. These other copies of the errata are located at http://www.FreeBSD.org/releases/, plus any sites which keep up-to-date mirrors of this location.

Source and binary snapshots of FreeBSD 4-STABLE also contain up-to-date copies of this document (as of the time of the snapshot).

For a list of all FreeBSD CERT security advisories, see http://www.FreeBSD.org/security/ or ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/.

---

2 Security Advisories

Support for per-user ~/.login_conf files (as documented in login.conf(5)) was disabled due to incorrect merging of local and global settings. This problem has been fixed in FreeBSD 4.5-RC.

A local root vulnerability in UUCP was corrected before the release of FreeBSD 4.4-RELEASE and documented in security advisory FreeBSD-SA-01:62. The release notes mentioned the correction, but not the security advisory, which was issued after the release date of 4.4-RELEASE.

A security hole in OpenSSH could allow users to execute code with arbitrary privileges if UseLogin yes was set, has been closed. Note that the default value of this setting is UseLogin no. For more information, including workarounds and bugfixes, see security advisory FreeBSD-SA-01:63.

The use of an insecure temporary directory by pkg_add(1) could permit a local attacker to modify the contents of binary packages while they were being installed. This hole has been closed. For more information, see security advisory FreeBSD-SA-02:01.

A race condition in pw(8), which could expose the contents of /etc/master.passwd, has been eliminated. For more information, including workarounds and bugfixes, see security advisory FreeBSD-SA-02:02.

A bug in k5su(8) could have allowed a process that had given up superuser privileges to regain them. This bug has been fixed. (See security advisory FreeBSD-SA-02:07.)

A race condition in the exec(3) system call, which could result in local users obtaining increased privileges, has been fixed. For more information, including bugfixes, see security advisory FreeBSD-SA-02:08.)

---

3 System Update Information

The handling of some types of comments in printcap(5) files is faulty. If a comment line ends in :\ (the characters normally used to indicate the continuation of a printer definition), the line following the comment will be parsed as a part of the previous printer definition.

One of the release notes refers to the net.inet.tcp.tcp_seq_genscheme sysctl variable for enabling improved compatability in TCP's initial sequence number generation algorithm. This variable was rendered unnecessary by the adoption of an algorithm based on RFC 1948, which restores proper operation in all cases while maintaining a high level of unpredictability in initial sequence numbers.

The tools/ directory of a FreeBSD CDROM distribution typically contains some DOS programs for i386 machines, such as fdimage.exe and fips.exe. This directory was inadvertently omitted from the initial 4.4-RELEASE ISO images generated by the FreeBSD Project. Corrected versions of the 4.4-install.iso and 4.4-mini.iso ISO images were regenerated on Saturday, 22 September 2001. For those who need these DOS-mode tools and do not wish to re-fetch the ISO images, the contents of the tools/ directory are available by anonymous FTP at ftp://ftp.FreeBSD.org/pub/FreeBSD/tools (many mirrors also have a copy of this directory).

One of the items in the release notes gave a workaround for hangs during PCCARD ejection, but gave the wrong syntax for the necessary command. The correct command line is:

    # pccardc power slot 0

On the i386, the minimum memory requirement for installing FreeBSD via sysinstall(8) is 16MB, with 4-8MB required to run FreeBSD with a pared-down kernel. The installation instructions in INSTALL.TXT (and other renditions thereof) cited somewhat lower figures.

A release note mentioned the merging of two libraries used for password authentication hashing, but listed their names incorrectly. The libraries that were merged were libscrypt and libdescrypt; the new unified library is called libcrypt.

A problem has been noted with an increasing number of device drivers that make heavy use of and, in some cases, can overflow, the kernel stack. This problem has an easily-identifable signature; processes randomly receive a SIGPROF signal and may die with the message ``Profiling time alarm''. For those users experiencing this problem, a workaround is to edit /src/sys/i386/include/param.h and change the line which reads:

    #define UPAGES  2

to read:

    #define UPAGES  3

It will be necessary to recompile the kernel and reboot for the change to take effect. This problem has been fixed in FreeBSD 4.5-RC.