Date: Wed, 25 Jul 2001 21:58:18 -0700 From: Kris Kennaway <kris@obsecurity.org> To: John Merryweather Cooper <jmcoopr@webmail.bmi.net> Cc: freebsd-ports@FreeBSD.ORG Subject: Re: ports/29112: Potential security issues in Balsa & Encompass Message-ID: <20010725215817.A46076@xor.obsecurity.org> In-Reply-To: <200107241840.f6OIe1Y15114@freefall.freebsd.org>; from jmcoopr@webmail.bmi.net on Tue, Jul 24, 2001 at 11:40:01AM -0700 References: <200107241840.f6OIe1Y15114@freefall.freebsd.org>
next in thread | previous in thread | raw e-mail | index | archive | help
--8t9RHnE3ZwKMSgU+
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable
On Tue, Jul 24, 2001 at 11:40:01AM -0700, John Merryweather Cooper wrote:
> The following reply was made to PR ports/29112; it has been noted by GNAT=
S.
>=20
> From: John Merryweather Cooper <jmcoopr@webmail.bmi.net>
> To: freebsd-gnats-submit@FreeBSD.org, quik@quikbox.ca
> Cc: =20
> Subject: Re: ports/29112: Potential security issues in Balsa & Encompass
> Date: Tue, 24 Jul 2001 11:36:42 -0700
>=20
> Well, the problem is NOT in any of Balsa's source code. I've grepped,=
=20
> eye-balled, head-banged, etc. the entire source code and I can conclude:
This is almost certainly due to a linker bug which triggers all of the
possible warnings in libc{_r} if you link incorrectly against the
library. I wish someone would track it down and fix it :-)
> 1) setkey(3), des_setkey(3), encrypt(3), and des_cipher(3) reside in=20
> libcipher--correct me if I'm wrong, but this is a US-only library (at
> least legally). Since S/MIME is not currently implemented (but there
> are plans to do so for Balsa), lacking these functions produces the
> warnings--but does not appear to affect function--
> =20
> 2) mktemp() is not used anywhere in Balsa. Balsa "rolls it's own"
> mktemp which resides in libmutt. There maybe a performance advantage
> to using mkstemp() as a replacement (I will verify this)--
AIEEEE..all code which rolls its own "better" tempfile creation code
must die. 95% of the implementations I've seen get it wrong.
Kris
--8t9RHnE3ZwKMSgU+
Content-Type: application/pgp-signature
Content-Disposition: inline
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.6 (FreeBSD)
Comment: For info see http://www.gnupg.org
iD8DBQE7X6NoWry0BWjoQKURAiowAJ49XJgYohyZ6CUSfE2lZPDU6E4qxQCfXn7U
s9gabBhasBpqbkvFrUBseD0=
=FQUN
-----END PGP SIGNATURE-----
--8t9RHnE3ZwKMSgU+--
To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-ports" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20010725215817.A46076>