From owner-freebsd-security Tue Jan 15 8:22:45 2002 Delivered-To: freebsd-security@freebsd.org Received: from citusc17.usc.edu (citusc17.usc.edu [128.125.38.177]) by hub.freebsd.org (Postfix) with ESMTP id 39BEA37B41F for ; Tue, 15 Jan 2002 08:22:32 -0800 (PST) Received: (from kris@localhost) by citusc17.usc.edu (8.11.6/8.11.4) id g0FGMGq00819; Tue, 15 Jan 2002 08:22:17 -0800 (PST) (envelope-from kris) Date: Tue, 15 Jan 2002 08:22:16 -0800 From: Kris Kennaway To: Alfred Perlstein Cc: Buliwyf McGraw , freebsd-security@FreeBSD.ORG Subject: Re: gets() is unsafe Message-ID: <20020115082216.A792@citusc17.usc.edu> References: <20020114151955.I26067@elvis.mu.org> Mime-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-md5; protocol="application/pgp-signature"; boundary="/9DWx/yDrRhgMJTb" Content-Disposition: inline User-Agent: Mutt/1.2.5i In-Reply-To: <20020114151955.I26067@elvis.mu.org>; from bright@mu.org on Mon, Jan 14, 2002 at 03:19:55PM -0800 Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.org --/9DWx/yDrRhgMJTb Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Mon, Jan 14, 2002 at 03:19:55PM -0800, Alfred Perlstein wrote: > * Buliwyf McGraw [020114 14:49] wrote: > >=20 > > Hi... i was installing several applications (php,xmms,etc) on my > > FreeBSD 4.4 server and i got the next message a lot of times when > > i was compiling: > >=20 > > /usr/lib/compat/libc.so.3: warning: mktemp() possibly used unsafely; > > consider using mkstemp() > > /usr/lib/compat/libc.so.3: warning: tmpnam() possibly used unsafely; > > consider using mkstemp() > > /usr/lib/compat/libc.so.3: warning: this program uses gets(), which is > > unsafe. > > /usr/lib/compat/libc.so.3: WARNING! setkey(3) not present in the syste= m! > > /usr/lib/compat/libc.so.3: WARNING! des_setkey(3) not present in the > > system! > > /usr/lib/compat/libc.so.3: WARNING! encrypt(3) not present in the syst= em! > > /usr/lib/compat/libc.so.3: WARNING! des_cipher(3) not present in the > > system! > > /usr/lib/compat/libc.so.3: warning: this program uses f_prealloc(), whi= ch > > is not recommended. > >=20 > > I want to fix this... what i can do? > > Thanks for any help. >=20 > Read the manpages, use the "Safer" version of the functions. No, this is a FAQ; it's a bug in the linker which causes it to trip every single _warn_references() in the library when it links to libc, regardless of whether the program actually uses the functions in question. Kris --/9DWx/yDrRhgMJTb Content-Type: application/pgp-signature Content-Disposition: inline -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.6 (FreeBSD) Comment: For info see http://www.gnupg.org iD8DBQE8RFc3Wry0BWjoQKURAs5kAJ9EsNbWKiRn6CK2d4CkZigmqHySiQCg+n1I F5y0wNYgaku84gFANF+JpSo= =I5gP -----END PGP SIGNATURE----- --/9DWx/yDrRhgMJTb-- To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message