From owner-freebsd-security Thu Feb 26 21:46:13 1998 Return-Path: Received: (from majordom@localhost) by hub.freebsd.org (8.8.8/8.8.8) id VAA24094 for freebsd-security-outgoing; Thu, 26 Feb 1998 21:46:13 -0800 (PST) (envelope-from owner-freebsd-security@FreeBSD.ORG) Received: from dingo.cdrom.com (dingo.cdrom.com [204.216.28.145]) by hub.freebsd.org (8.8.8/8.8.8) with ESMTP id VAA24048; Thu, 26 Feb 1998 21:45:48 -0800 (PST) (envelope-from mike@dingo.cdrom.com) Received: from dingo.cdrom.com (localhost [127.0.0.1]) by dingo.cdrom.com (8.8.8/8.8.5) with ESMTP id VAA26437; Thu, 26 Feb 1998 21:43:51 -0800 (PST) Message-Id: <199802270543.VAA26437@dingo.cdrom.com> X-Mailer: exmh version 2.0zeta 7/24/97 To: Cy Schubert - ITSD Open Systems Group cc: tqbf@secnet.com, freebsd-security@FreeBSD.ORG, security-officer@FreeBSD.ORG Subject: Re: OpenBSD Security Advisory: mmap() Problem In-reply-to: Your message of "Thu, 26 Feb 1998 20:23:06 PST." <199802270423.UAA01955@cwsys.cwsent.com> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Date: Thu, 26 Feb 1998 21:43:49 -0800 From: Mike Smith Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk > I've ported this patch to FreeBSD 2.2.5R. XIG's Accelerated X server > crashes trying to access the VT. To get the XIG Accelerated X server > to work I've modified the patch to allow superuser to access to > character devices. I'm not sure what other applications could break > because of the originally posted patch or my modified patch, so > additional study needs to be done. This modification effectively defeats much of the actual usefulness of the patch. The bug is a second-order security risk in that an attacker must already have obtained at least group kmem before she can take advantage of it. I don't (at this point) think that we want to go ahead with this until we hear from XIG. -- \\ Sometimes you're ahead, \\ Mike Smith \\ sometimes you're behind. \\ mike@smith.net.au \\ The race is long, and in the \\ msmith@freebsd.org \\ end it's only with yourself. \\ msmith@cdrom.com To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe security" in the body of the message