From owner-freebsd-hackers  Tue Apr 24 12:22:18 2001
Delivered-To: freebsd-hackers@freebsd.org
Received: from fledge.watson.org (fledge.watson.org [204.156.12.50])
	by hub.freebsd.org (Postfix) with ESMTP id 3023237B423
	for <freebsd-hackers@FreeBSD.ORG>; Tue, 24 Apr 2001 12:22:01 -0700 (PDT)
	(envelope-from arr@watson.org)
Received: from localhost (arr@localhost)
	by fledge.watson.org (8.11.3/8.11.3) with SMTP id f3OJM5w20392;
	Tue, 24 Apr 2001 15:22:09 -0400 (EDT)
	(envelope-from arr@watson.org)
Date: Tue, 24 Apr 2001 15:22:05 -0400 (EDT)
From: "Andrew R. Reiter" <arr@watson.org>
To: Kris Kennaway <kris@obsecurity.org>
Cc: Rich Morin <rdm@cfcl.com>, freebsd-hackers@FreeBSD.ORG
Subject: Re: automated checking of Security Advisories
In-Reply-To: <20010424121130.C89819@xor.obsecurity.org>
Message-ID: <Pine.NEB.3.96L.1010424151816.20031B-100000@fledge.watson.org>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: owner-freebsd-hackers@FreeBSD.ORG
Precedence: bulk
X-Loop: FreeBSD.ORG

On Tue, 24 Apr 2001, Kris Kennaway wrote:

> 
> pkg_version may be a logical place to stick this functionality since
> it already has code for parsing version numbers.

Ya... I think it would be wise to somehow include validating of the
security advisories too when doing these checks.  Im not sure how this
tool will know which packages are vulnerable (Im assuming a config file of
sorts), but it would be a smart thing to include some pgp key validation
of each of the advisory vulns the tool is looking for.

Just a small thing... :-)
> 
> Kris
> 

*-------------.................................................
| Andrew R. Reiter 
| arr@fledge.watson.org
| "It requires a very unusual mind
|   to undertake the analysis of the obvious" -- A.N. Whitehead


To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-hackers" in the body of the message