Date: Tue, 15 Jan 2002 08:22:16 -0800 From: Kris Kennaway <kris@FreeBSD.ORG> To: Alfred Perlstein <bright@mu.org> Cc: Buliwyf McGraw <buliwyf@libertad.univalle.edu.co>, freebsd-security@FreeBSD.ORG Subject: Re: gets() is unsafe Message-ID: <20020115082216.A792@citusc17.usc.edu> In-Reply-To: <20020114151955.I26067@elvis.mu.org>; from bright@mu.org on Mon, Jan 14, 2002 at 03:19:55PM -0800 References: <Pine.BSF.4.43.0201141750380.93171-100000@libertad.univalle.edu.co> <20020114151955.I26067@elvis.mu.org>
next in thread | previous in thread | raw e-mail | index | archive | help
--/9DWx/yDrRhgMJTb Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Mon, Jan 14, 2002 at 03:19:55PM -0800, Alfred Perlstein wrote: > * Buliwyf McGraw <buliwyf@libertad.univalle.edu.co> [020114 14:49] wrote: > >=20 > > Hi... i was installing several applications (php,xmms,etc) on my > > FreeBSD 4.4 server and i got the next message a lot of times when > > i was compiling: > >=20 > > /usr/lib/compat/libc.so.3: warning: mktemp() possibly used unsafely; > > consider using mkstemp() > > /usr/lib/compat/libc.so.3: warning: tmpnam() possibly used unsafely; > > consider using mkstemp() > > /usr/lib/compat/libc.so.3: warning: this program uses gets(), which is > > unsafe. > > /usr/lib/compat/libc.so.3: WARNING! setkey(3) not present in the syste= m! > > /usr/lib/compat/libc.so.3: WARNING! des_setkey(3) not present in the > > system! > > /usr/lib/compat/libc.so.3: WARNING! encrypt(3) not present in the syst= em! > > /usr/lib/compat/libc.so.3: WARNING! des_cipher(3) not present in the > > system! > > /usr/lib/compat/libc.so.3: warning: this program uses f_prealloc(), whi= ch > > is not recommended. > >=20 > > I want to fix this... what i can do? > > Thanks for any help. >=20 > Read the manpages, use the "Safer" version of the functions. No, this is a FAQ; it's a bug in the linker which causes it to trip every single _warn_references() in the library when it links to libc, regardless of whether the program actually uses the functions in question. Kris --/9DWx/yDrRhgMJTb Content-Type: application/pgp-signature Content-Disposition: inline -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.6 (FreeBSD) Comment: For info see http://www.gnupg.org iD8DBQE8RFc3Wry0BWjoQKURAs5kAJ9EsNbWKiRn6CK2d4CkZigmqHySiQCg+n1I F5y0wNYgaku84gFANF+JpSo= =I5gP -----END PGP SIGNATURE----- --/9DWx/yDrRhgMJTb-- To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20020115082216.A792>