Skip site navigation (1)Skip section navigation (2)
Date:      Mon, 11 Mar 2002 18:59:24 -0500
From:      Alan Eldridge <alane@geeksrus.net>
To:        Brooks Davis <brooks@one-eyed-alien.net>
Cc:        FreeBSD Stable List <freebsd-stable@FreeBSD.ORG>
Subject:   Re: zlib security advisory
Message-ID:  <20020311235924.GA70842@wwweasel.geeksrus.net>
In-Reply-To: <20020311155230.A24573@Odin.AC.HMC.Edu>
References:  <20020311233900.GC70667@wwweasel.geeksrus.net> <20020311155230.A24573@Odin.AC.HMC.Edu>

next in thread | previous in thread | raw e-mail | index | archive | help
On Mon, Mar 11, 2002 at 03:52:30PM -0800, Brooks Davis wrote:
>On Mon, Mar 11, 2002 at 06:39:00PM -0500, Alan Eldridge wrote:
>> Redhat just announced a security problem is zlib which affects, oh,
>> half the bloody world of network programs. A CERT advisory is expected
>> to follow. Do we have a patch, or should I work one up based on
>> RedHat's?
>> 
>> http://www.linuxsecurity.com/advisories/redhat_advisory-1963.html
>
>The updated zlib has been commited to current stable will presumably
>follow shortly.  Additionaly, phk says that the FreeBSD malloc should
>not be vulnerable to exploits of this type.  It will produce a warning
>and either continue or exit depending on your malloc flags.

FWIW RH notes several things that either have their own copy of zlib
that needs to be patched or that statically link and so need to be rebuilt.

Has anyone produced such a list for FBSD, or is it not applicable to us?

I suppose, to be safe, an inventory of ports needs to be done, too. Urk.
 
-- 
Alan Eldridge
"Dave's not here, man."

To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-stable" in the body of the message




Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20020311235924.GA70842>