From owner-freebsd-audit Mon May 1 7:45:15 2000 Delivered-To: freebsd-audit@freebsd.org Received: from fledge.watson.org (fledge.watson.org [204.156.12.50]) by hub.freebsd.org (Postfix) with ESMTP id A352637BC3F for ; Mon, 1 May 2000 07:45:13 -0700 (PDT) (envelope-from robert@cyrus.watson.org) Received: from fledge.watson.org (robert@fledge.pr.watson.org [192.0.2.3]) by fledge.watson.org (8.9.3/8.9.3) with SMTP id KAA12040; Mon, 1 May 2000 10:44:54 -0400 (EDT) (envelope-from robert@cyrus.watson.org) Date: Mon, 1 May 2000 10:44:54 -0400 (EDT) From: Robert Watson X-Sender: robert@fledge.watson.org To: Joe Karthauser Cc: Mike Heffner , FreeBSD-audit Subject: Re: three small patches - oflows In-Reply-To: <20000429141039.A48739@pavilion.net> Message-ID: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Sender: owner-freebsd-audit@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.ORG I noticed a bunch of commits go in labeled, ``fix buffer overflow'' -- any chance you could include a note indicating whether or not they represent a security hole in the base configuration/etc? I.e., the natd buffer overflow does not present a security risk (that I'm aware of) as it's not setugid, and when it does run with privilege only the caller can specify the arguments? Robert N M Watson robert@fledge.watson.org http://www.watson.org/~robert/ PGP key fingerprint: AF B5 5F FF A6 4A 79 37 ED 5F 55 E9 58 04 6A B1 TIS Labs at Network Associates, Safeport Network Services To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-audit" in the body of the message