Tarsnap 1.0.36

[Colin Percival <cperciva@tarsnap.com>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hi all,

Tarsnap 1.0.36 is now available.  Due to the presence of security fixes (and
some fairly significant bug fixes) upgrading is strongly recommended.  This
new version brings:

1. SECURITY FIX: When constructing paths of objects being archived, a buffer
could overflow by one byte upon encountering 1024, 2048, 4096, etc. byte
paths. Theoretically this could be exploited by an unprivileged user whose
files are being archived; I do not believe it is exploitable in practice,
but I am offering a $1000 bounty for the first person who can prove me wrong:
http://www.daemonology.net/blog/2015-08-21-tarsnap-1000-exploit-bounty.html

2. SECURITY FIX: An attacker with a machine's write keys, or with read keys
and control of the tarsnap service, could make tarsnap allocate a large
amount of memory upon listing archives or reading an archive the attacker
created; on 32-bit machines, tarsnap can be caused to crash under the
aforementioned conditions.

3. BUG FIX: Tarsnap no longer crashes if its first DNS lookup fails.

4. BUG FIX: Tarsnap no longer exits with "Callbacks uninitialized" when
running on a dual-stack network if the first IP stack it attempts fails to
connect.

5. tarsnap now avoids opening devices nodes on linux if it is instructed to
archive /dev/.  This change may prevent "watchdog"-triggered reboots.

6. tarsnap -c --dry-run can now run without a keyfile, allowing users to
predict how much Tarsnap will cost before signing up.

7. tarsnap now has bash completion scripts.

8. tarsnap now takes a --retry-forever option.

9. tarsnap now automatically detects and uses AESNI and SSE2.

As usual, there are also many minor build fixes, harmless bug fixes, and code
refactoring / cleanup changes.  For a full listing of changes, consult the
tarsnap git repository: https://github.com/Tarsnap/tarsnap

The new release is available from the usual location:
  https://www.tarsnap.com/download.html

- -- 
Colin Percival
Security Officer Emeritus, FreeBSD | The power to serve
Founder, Tarsnap | www.tarsnap.com | Online backups for the truly paranoid
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iEYEARECAAYFAlXXLMYACgkQOM7KaQxqam5MdgCgmJHivc8uUqWxsQZdKQRBUDgV
/AwAn1MNfODxMY/fbU3awjRuc0Ur4SCC
=WreA
-----END PGP SIGNATURE-----