From owner-freebsd-security@FreeBSD.ORG Tue Sep 9 21:06:08 2008 Return-Path: Delivered-To: freebsd-security@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 90539106566B; Tue, 9 Sep 2008 21:06:08 +0000 (UTC) (envelope-from simon@nitro.dk) Received: from mx.nitro.dk (zarniwoop.nitro.dk [83.92.207.38]) by mx1.freebsd.org (Postfix) with ESMTP id 4F8DF8FC22; Tue, 9 Sep 2008 21:06:08 +0000 (UTC) (envelope-from simon@nitro.dk) Received: from arthur.nitro.dk (arthur.bofh [192.168.2.3]) by mx.nitro.dk (Postfix) with ESMTP id 2EAE41E8C0D; Tue, 9 Sep 2008 20:50:00 +0000 (UTC) Received: by arthur.nitro.dk (Postfix, from userid 1000) id 173AF5F06; Tue, 9 Sep 2008 22:50:00 +0200 (CEST) Date: Tue, 9 Sep 2008 22:49:59 +0200 From: "Simon L. Nielsen" To: Jeremy Chadwick Message-ID: <20080909204958.GA1203@arthur.nitro.dk> References: <20080908161818.GA72963@icarus.home.lan> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20080908161818.GA72963@icarus.home.lan> User-Agent: Mutt/1.5.18 (2008-05-17) Cc: freebsd-security@freebsd.org, Andrew Storms Subject: Re: Question on recent PHP VuXML info X-BeenThere: freebsd-security@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: "Security issues \[members-only posting\]" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 09 Sep 2008 21:06:08 -0000 On 2008.09.08 09:18:18 -0700, Jeremy Chadwick wrote: > On Mon, Sep 08, 2008 at 08:33:49AM -0700, Andrew Storms wrote: > > Not sure if this is the correct place for VuXML questions, but the FreeBSD > > VuXML list ( http://lists.freebsd.org/pipermail/freebsd-vuxml/) looks pretty > > dead given the last update was in 2007 according to the archives. > > > > We were previously tracking this entry, which pretty much sat for a while > > without an applicable upgradeable resolution available. While I haven't looked into the details of this particular entry, Jille and Jeremy did that well, I just want to take this opportunity to point out that "safe_mode" is broken... From the particular entry: It should be noted that this vulnerability is not considered to be serious by the FreeBSD Security Team, since safe_mode and open_basedir are insecure by design and should not be relied upon. We (secteam) have seriously debated if it was worth documenting "safe_mode" issues at all, but the compromise was just to add something similar to the above text. -- Simon L. Nielsen FreeBSD Security Team