Products Openwall GNU/*/Linux   server OS Linux Kernel Runtime Guard John the Ripper   password cracker Free & Open Source for any platform in the cloud Pro for Linux Pro for macOS Wordlists   for password cracking passwdqc   policy enforcement Free & Open Source for Unix Pro for Windows (Active Directory) yescrypt   KDF & password hashing yespower   Proof-of-Work (PoW) crypt_blowfish   password hashing phpass   ditto in PHP tcb   better password shadowing Pluggable Authentication Modules scanlogd   port scan detector popa3d   tiny POP3 daemon blists   web interface to mailing lists msulogin   single user mode login php_mt_seed   mt_rand() cracker Services Publications Articles Presentations Resources Mailing lists Community wiki Source code repositories (GitHub) Source code repositories (CVSweb) File archive & mirrors How to verify digital signatures OVE IDs What's new

Message-ID: <20040419000322.GA1594@openwall.com>
Date: Mon, 19 Apr 2004 04:03:22 +0400
From: Solar Designer <solar@...nwall.com>
To: announce@...ts.openwall.com, owl-users@...ts.openwall.com
Cc: lwn@....net
Subject: Linux 2.4.26-ow1, 2.0.40-ow1; new Owl ISO; Owl 1.1-stable

Hi,

This is to announce several updates to the Openwall Linux kernel patch
and to Openwall GNU/*/Linux (Owl), all of which occurred during the
past week.

There're two updated versions of the kernel patch, Linux 2.4.26-ow1
and 2.0.40-ow1.  Both are mere updates to the new kernel releases.

There're no known major security fixes added with Linux 2.4.26.
However, it may be worth noting that Linux 2.4.26 corrects information
leaks in ext3 and XFS journalling filesystems where arbitrary data
from system memory could get written into the journal.  The journal
file and the raw device are normally not readable to regular users,
hence this is only an issue for setups which are specifically trying
to ensure that no sensitive data ever hits disk media (e.g., by using
encrypted filesystems and disabling swap), but which at the same time
use non-encrypted ext3 or XFS filesystems for non-sensitive data.

Linux 2.0.40 (and thus 2.0.40-ow1), compared to Linux 2.0.39-ow3,
eliminates an information leak via ICMP messages.  This issue is more
serious than the one described above in that it affects almost all
setups and makes the potentially sensitive data directly available to
remote hosts, including over the Internet.

The kernel patches may be obtained at the usual location:

	http://www.openwall.com/linux/

Speaking of Owl, there's a new ISO image of Owl-current dated
2004/04/18.  This includes Linux 2.4.26-ow1 as the kernel and has
quite some userland packages updated since Owl 1.1.  A list of major
changes made in Owl-current is available at:

	http://www.openwall.com/Owl/CHANGES-current.shtml

The new Owl-current ISO may be downloaded from under
/pub/Owl/current/iso on the FTP mirrors listed at:

	http://www.openwall.com/Owl/DOWNLOAD.shtml

We're also starting to make available snapshots of Owl 1.1-stable
branch under /pub/Owl/1.1-stable on the FTP mirrors.  This branch
includes the post-release corrections to Owl 1.1, all of which are
documented in the change log available at:

	http://www.openwall.com/Owl/CHANGES-1.1-stable.shtml

-- 
Alexander Peslyak <solar@...nwall.com>
GPG key ID: B35D3598  fp: 6429 0D7E F130 C13E C929  6447 73C3 A290 B35D 3598
http://www.openwall.com - bringing security into open computing environments

Powered by blists - more mailing lists

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.