Date: Thu, 19 Jul 2001 16:37:38 -0700 From: Kris Kennaway <kris@obsecurity.org> To: David O'Brien <obrien@FreeBSD.ORG> Cc: Kris Kennaway <kris@obsecurity.org>, Mike Heffner <mheffner@vt.edu>, arch@FreeBSD.ORG Subject: Re: Importing lukemftpd Message-ID: <20010719163738.A75143@xor.obsecurity.org> In-Reply-To: <20010719155811.C90326@dragon.nuxi.com>; from obrien@FreeBSD.ORG on Thu, Jul 19, 2001 at 03:58:11PM -0700 References: <XFMail.20010716212454.mheffner@novacoxmail.com> <20010717103604.B79329@xor.obsecurity.org> <20010719112221.A84356@dragon.nuxi.com> <20010719123119.B44746@xor.obsecurity.org> <20010719155811.C90326@dragon.nuxi.com>
next in thread | previous in thread | raw e-mail | index | archive | help
--T4sUOijqQbZv57TR Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Thu, Jul 19, 2001 at 03:58:11PM -0700, David O'Brien wrote: > On Thu, Jul 19, 2001 at 12:31:20PM -0700, Kris Kennaway wrote: > > On Thu, Jul 19, 2001 at 11:22:21AM -0700, David O'Brien wrote: > >=20 > > > Index: Makefile > > > =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D > > > RCS file: /home/ncvs/src/usr.bin/ftp/Makefile,v > >=20 > > BTW, feel free to commit the ftp client whenever you feel like it, > > since there aren't serious security issues at stake there. >=20 > There aren't?? I am downloading data from a possibly hostile site. > They could easily try to buffer overflow the client. Just as much a > possible security vulnerability as we saw the the buffer overflows in > fetchmail. Yes, but a client-side vulnerability is not the same class of vulnerability as a daemon which installed by default on all FreeBSD systems. If the code worries you, a security audit would be much appreciated. Thanks. Kris --T4sUOijqQbZv57TR Content-Type: application/pgp-signature Content-Disposition: inline -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.6 (FreeBSD) Comment: For info see http://www.gnupg.org iD8DBQE7V29BWry0BWjoQKURAm4DAKCmbGQ0+uRGcpZyArMu/xeJO6d/NQCgq5+T Xr6E+BdR94TGqdzQB5l7x/A= =nSMu -----END PGP SIGNATURE----- --T4sUOijqQbZv57TR-- To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-arch" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20010719163738.A75143>