From owner-freebsd-security Fri Jul 10 21:08:06 1998 Return-Path: Received: (from majordom@localhost) by hub.freebsd.org (8.8.8/8.8.8) id VAA21669 for freebsd-security-outgoing; Fri, 10 Jul 1998 21:08:06 -0700 (PDT) (envelope-from owner-freebsd-security@FreeBSD.ORG) Received: from super-g.inch.com (super-g.com [207.240.140.161]) by hub.freebsd.org (8.8.8/8.8.8) with ESMTP id VAA21664 for ; Fri, 10 Jul 1998 21:08:05 -0700 (PDT) (envelope-from spork@super-g.com) Received: from localhost (localhost [127.0.0.1]) by super-g.inch.com (8.8.8/8.8.5) with SMTP id AAA14526; Sat, 11 Jul 1998 00:07:50 -0400 (EDT) Date: Sat, 11 Jul 1998 00:07:50 -0400 (EDT) From: spork X-Sender: spork@super-g.inch.com To: Joao Paulo Caldas Campello cc: freebsd-security@FreeBSD.ORG Subject: Re: About (another?) popper bug In-Reply-To: Message-ID: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org I'm curious if anyone else is seeing some odd behaviour in qpopper 2.52. I built it using the port, but changed two things before the build step, I set it to "SERVER_MODE" and removed "KEEP_TEMP_DROP". By default, BULLDB is enabled. If you take a look at /your/bulldb/dir/bulldb.db, does anyone else see some odd things in there (looking at it with 'strings')? I see lots of master.passwd fragments, including encrypted passwords. Granted, the file is readable only by root, but it seems odd that that info should be in there and it makes me a bit nervous. Ideas? I'm working on getting cucipop to build with the db 2.x support, but in the meantime we're sticking with qpopper... Thanks, Charles Charles Sprickman spork@super-g.com ---- On Fri, 10 Jul 1998, Joao Paulo Caldas Campello wrote: > Hi all, > > The last days i've seen some messages about an exploitable bug in > popper, but I couldn't locate the original message, certainly `cause I was > not yet subscribed in the list... If some good soul could send me any > information about this bug - how may i test if it's exploitable in my > FreeBSD system (2.2.6-RELEASE), and how may i fix that - i would be very > pleased. > > thanks, > > J. Paulo > Director of Internet Dept. > Neo Planos High School > > > To Unsubscribe: send mail to majordomo@FreeBSD.org > with "unsubscribe security" in the body of the message > To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe security" in the body of the message