---

2.1 Kernel Changes

A new in-kernel cryptographic framework (see crypto(4) and crypto(9)) has been imported from OpenBSD. It provides a consistent interface to hardware and software implementations of cryptographic algorithms for use by the kernel and access to cryptographic hardware for user-mode applications. Hardware device drivers are provided to support hifn-based cards ( hifn(4)) and Broadcom-based cards ( ubsec(4)).

The uftdi(4) driver, to support FTDI USB-to-serial devices, has been added.

---

2.2 Security Advisories

Buffer overflows in kadmind(8) and k5admin have been corrected. More details can be found in security advisory FreeBSD-SA-02:40.

Multiple vulnerabilities in BIND have been fixed, as described in FreeBSD-SA-02:43.

A file descriptor leak in the fpathconf(2) system call, which could allow a local user to crash the system or cause a privilege escalation, has been fixed. More details can be found in security advisory FreeBSD-SA-02:44.

A remotely exploitable vulnerability in CVS has been corrected with the import of version 1.11.5. More details can be found in security advisory FreeBSD-SA-03:01.

A timing-based attack on OpenSSL, which could allow a very powerful attacker access to plaintext under certain circumstances, has been prevented via an upgrade to OpenSSL 0.9.7. See security advisory FreeBSD-SA-03:02 for more details.

The security and performance of the ``syncookies'' feature has been improved to decrease the chance of an attacker being able to spoof connections. More details are given in security advisory FreeBSD-SA-03:03.

A remotely-exploitable buffer overflow vulnerability in sendmail has been fixed by updating sendmail to version 8.12.8. For more details, see security advisory FreeBSD-SA-03:04.

A bounds-checking bug in the XDR implementation, which could allow a remote attacker to cause a denial-of-service, has been fixed. For more details see security advisory FreeBSD-SA-03:05.

Two recently-publicized flaws in OpenSSL have been corrected. For more details, see security advisory FreeBSD-SA-03:06.

---

2.3 Userland Changes

burncd(8) now accepts a value of max for its -s option to set the drive's maximum write speed.

cdcontrol(1) now supports a speed command to set the maximum speed to be used by the drive (the maximum possible speed can be selected setting the speed to max).

The compat4x distribution now includes the libcrypto.so.2 and libssl.so.2 libraries from FreeBSD 4.7-RELEASE.

The fwcontrol(8) utility has been added to help users access and control the FireWire subsystem.

ftpd(8) now supports a -h option to disable printing any host-specific information, such as the ftpd(8) version or hostname, in server messages.

ftpd(8) now supports a -P option to specify a port on which to listen in daemon mode. The default data port number is now set to be one less than the control port number, rather than being hard-coded.

ftpd(8) now supports an extended format of the /etc/ftpchroot file. Please refer to the ftpchroot(5) manpage, which is now available, for details.

ftpd(8) now supports login directory pathnames that specify simultaneously a directory for chroot(2) and that to change to in the chrooted environment. The /./ separator is used for this purpose, like in other FTP daemons having this feature. It may be used in both ftpchroot(5) and passwd(5).

The getconf(1) utility has been added. It prints the values of POSIX or X/Open path or system configuration variables.

ipfw(8) now supports enable and disable commands to control various aspects of the operation of ipfw(4) (including enabling and disabling the firewall itself). These provide a more convenient and visible interface than the existing sysctl variables.

make(1) now supports a -C flag to change to a given directory before building its target(s).

mount_nfs(8) now supports a -c to avoid doing a connect(2) for UDP mount points. This option must be used if the server does not reply to requests from the standard NFS port number 2049 or if it replies to requests using a different IP address (which can occur if the server is multi-homed). Setting the vfs.nfs.nfs_ip_paranoia sysctl to 0 will make this option the default.

newsyslog(8) now supports a W flag to force previously-started compression jobs for an entry (or group of entries specified with the G flag) to finish before beginning a new one. This feature is designed to prevent system overloads caused by starting several compression jobs on big files simultaneously.

The pathchk(1) utility, which checks pathnames for validity or portability between POSIX systems, has been added.

pw(8) can now add a user whose name ends with a $ character; this change is intended to help administration of Samba services.

rarpd(8) now accepts a -t flag to specify an alternative directory to /tftpboot.

The base64 capabilities of uuencode(1) and uudecode(1) can now be automatically enabled by invoking these utilities as b64encode(1) and b64decode(1) respectively.

The definitions of the standard file streams (stdin, stdout, and stderr) have changed so that they are no longer compile-time constants. Some older binaries may require updated 3.X compatability libraries (for example, by setting COMPAT3X=yes for a buildworld/installworld).

---

2.4 Release Engineering and Integration

The supported release of GNOME has been updated to 2.2.

The supported release of KDE has been updated to 3.1.

The supported release of XFree86 has been updated to 4.3.0.