From owner-freebsd-arch Thu Jul 19 16:37:53 2001 Delivered-To: freebsd-arch@freebsd.org Received: from obsecurity.dyndns.org (adsl-63-207-60-215.dsl.lsan03.pacbell.net [63.207.60.215]) by hub.freebsd.org (Postfix) with ESMTP id 387BD37B401; Thu, 19 Jul 2001 16:37:49 -0700 (PDT) (envelope-from kris@obsecurity.org) Received: by obsecurity.dyndns.org (Postfix, from userid 1000) id 60B8866C4D; Thu, 19 Jul 2001 16:37:39 -0700 (PDT) Date: Thu, 19 Jul 2001 16:37:38 -0700 From: Kris Kennaway To: David O'Brien Cc: Kris Kennaway , Mike Heffner , arch@FreeBSD.ORG Subject: Re: Importing lukemftpd Message-ID: <20010719163738.A75143@xor.obsecurity.org> References: <20010717103604.B79329@xor.obsecurity.org> <20010719112221.A84356@dragon.nuxi.com> <20010719123119.B44746@xor.obsecurity.org> <20010719155811.C90326@dragon.nuxi.com> Mime-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-md5; protocol="application/pgp-signature"; boundary="T4sUOijqQbZv57TR" Content-Disposition: inline User-Agent: Mutt/1.2.5i In-Reply-To: <20010719155811.C90326@dragon.nuxi.com>; from obrien@FreeBSD.ORG on Thu, Jul 19, 2001 at 03:58:11PM -0700 Sender: owner-freebsd-arch@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.ORG --T4sUOijqQbZv57TR Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Thu, Jul 19, 2001 at 03:58:11PM -0700, David O'Brien wrote: > On Thu, Jul 19, 2001 at 12:31:20PM -0700, Kris Kennaway wrote: > > On Thu, Jul 19, 2001 at 11:22:21AM -0700, David O'Brien wrote: > >=20 > > > Index: Makefile > > > =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D > > > RCS file: /home/ncvs/src/usr.bin/ftp/Makefile,v > >=20 > > BTW, feel free to commit the ftp client whenever you feel like it, > > since there aren't serious security issues at stake there. >=20 > There aren't?? I am downloading data from a possibly hostile site. > They could easily try to buffer overflow the client. Just as much a > possible security vulnerability as we saw the the buffer overflows in > fetchmail. Yes, but a client-side vulnerability is not the same class of vulnerability as a daemon which installed by default on all FreeBSD systems. If the code worries you, a security audit would be much appreciated. Thanks. Kris --T4sUOijqQbZv57TR Content-Type: application/pgp-signature Content-Disposition: inline -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.6 (FreeBSD) Comment: For info see http://www.gnupg.org iD8DBQE7V29BWry0BWjoQKURAm4DAKCmbGQ0+uRGcpZyArMu/xeJO6d/NQCgq5+T Xr6E+BdR94TGqdzQB5l7x/A= =nSMu -----END PGP SIGNATURE----- --T4sUOijqQbZv57TR-- To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-arch" in the body of the message