From owner-freebsd-security@FreeBSD.ORG Sat Oct 4 09:08:17 2003 Return-Path: Delivered-To: freebsd-security@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 5915B16A4B3; Sat, 4 Oct 2003 09:08:17 -0700 (PDT) Received: from transport.cksoft.de (transport.cksoft.de [62.111.66.27]) by mx1.FreeBSD.org (Postfix) with ESMTP id 4D06443FE3; Sat, 4 Oct 2003 09:08:13 -0700 (PDT) (envelope-from bzeeb-lists@lists.zabbadoz.net) Received: from localhost (localhost [127.0.0.1]) by transport.cksoft.de (Postfix) with ESMTP id 44CE11FF91F; Sat, 4 Oct 2003 18:08:12 +0200 (CEST) Received: by transport.cksoft.de (Postfix, from userid 66) id 113941FF91E; Sat, 4 Oct 2003 18:08:11 +0200 (CEST) Received: by mail.int.zabbadoz.net (Postfix, from userid 1060) id 8D624155A7; Sat, 4 Oct 2003 16:08:00 +0000 (UTC) Received: from localhost (localhost [127.0.0.1]) by mail.int.zabbadoz.net (Postfix) with ESMTP id 833AC153E9; Sat, 4 Oct 2003 16:08:01 +0000 (UTC) Date: Sat, 4 Oct 2003 16:08:01 +0000 (UTC) From: "Bjoern A. Zeeb" X-X-Sender: bz@e0-0.zab2.int.zabbadoz.net To: "Jacques A. Vidrine" In-Reply-To: <20031004160010.GA96970@hellblazer.celabo.org> Message-ID: References: <200310032249.h93MnXS8047857@freefall.freebsd.org> <20031004160010.GA96970@hellblazer.celabo.org> MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII X-Virus-Scanned: by AMaViS snapshot-20020300 cc: freebsd-security@freebsd.org Subject: Re: FreeBSD Security Advisory FreeBSD-SA-03:18.openssl X-BeenThere: freebsd-security@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: Security issues [members-only posting] List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 04 Oct 2003 16:08:17 -0000 On Sat, 4 Oct 2003, Jacques A. Vidrine wrote: > On Sat, Oct 04, 2003 at 03:22:42PM +0000, Bjoern A. Zeeb wrote: > > Another question: can someone please confirm that mod_ssl.so from > > apache 2.0.47 port is _not_ affected ? > > It _is_ affected, because it uses the affected portions of OpenSSL. ... > mod_ssl.so uses dynamic linking. It would not require a rebuild nor > would the compiler output necessarily change after a rebuild. thanks. my fault. mixed the imapct part with ... : Note that any statically linked applications that are not part of the : base system (i.e. from the Ports Collection or other 3rd-party sources) : must be recompiled. while mod_ssl comes form ports and is not part of the base system it still uses (as you said) dynamic linking. So replacing the libs is enough. Thanks and happy weekend. -- Bjoern A. Zeeb bzeeb at Zabbadoz dot NeT 56 69 73 69 74 http://www.zabbadoz.net/