From owner-freebsd-ports Fri Jun 9 9: 7:14 2000 Delivered-To: freebsd-ports@freebsd.org Received: from server1.mich.com (server1.mich.com [198.108.16.2]) by hub.freebsd.org (Postfix) with ESMTP id 8870337C210; Fri, 9 Jun 2000 09:06:47 -0700 (PDT) (envelope-from will@almanac.yi.org) Received: from argon.gryphonsoft.com (pm004-014.dialup.bignet.net [64.79.80.158]) by server1.mich.com (8.9.3/8.9.3) with ESMTP id MAA31816; Fri, 9 Jun 2000 12:06:39 -0400 Received: by argon.gryphonsoft.com (Postfix, from userid 1000) id 4B5C61951; Fri, 9 Jun 2000 12:05:36 -0400 (EDT) Date: Fri, 9 Jun 2000 12:05:36 -0400 From: Will Andrews To: John Holland Cc: ports@FreeBSD.ORG, freebsd-ports@FreeBSD.ORG Subject: Re: Hylafax security audit Message-ID: <20000609120536.N6343@argon.gryphonsoft.com> References: <4.3.1.0.20000609101719.00ae4900@pop.mindspring.com> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii X-Mailer: Mutt 1.0.1i In-Reply-To: <4.3.1.0.20000609101719.00ae4900@pop.mindspring.com>; from john@zoner.org on Fri, Jun 09, 2000 at 10:54:22AM -0400 X-Operating-System: FreeBSD 5.0-CURRENT i386 Sender: owner-freebsd-ports@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org On Fri, Jun 09, 2000 at 10:54:22AM -0400, John Holland wrote: > Hylafax has been marked BROKEN/FORBIDDEN since 12/1/1999 due to a setuid > uucp buffer overflow in faxalter. The fix for that overflow is trivial, > but I noticed a number of other of unchecked string copies in other > portions of the code. I'd like to fix the buffer overflows so FreeBSD can > have a secure port of Hylafax. Please feel free to submit patches etc. that fix Hylafax's security problems, and I guarantee you they will be committed ASAP. > Is anyone else working on this? Is Hylafax doing anything about this? Probably not. But someone might prove me wrong. No, the hylafax people are completely ignoring this problem. -- Will Andrews GCS/E/S @d- s+:+>+:- a--->+++ C++ UB++++ P+ L- E--- W+++ !N !o ?K w--- ?O M+ V-- PS+ PE++ Y+ PGP+>+++ t++ 5 X++ R+ tv+ b++>++++ DI+++ D+ G++>+++ e->++++ h! r-->+++ y? To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-ports" in the body of the message