From owner-freebsd-security Tue Apr 9 13:16:39 2002 Delivered-To: freebsd-security@freebsd.org Received: from atlantis.dp.ua (atlantis.dp.ua [193.108.46.1]) by hub.freebsd.org (Postfix) with ESMTP id E2EDA37B400 for ; Tue, 9 Apr 2002 13:16:31 -0700 (PDT) Received: from localhost (dmitry@localhost) by atlantis.dp.ua (8.11.1/8.11.1) with ESMTP id g39KGLi23485 for ; Tue, 9 Apr 2002 23:16:23 +0300 (EEST) (envelope-from dmitry@atlantis.dp.ua) Date: Tue, 9 Apr 2002 23:16:21 +0300 (EEST) From: Dmitry Pryanishnikov To: Subject: Re: zlib double-free security notification In-Reply-To: <20020409040344.36061.qmail@web11802.mail.yahoo.com.lucky.freebsd.security> Message-ID: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.org Hello! On Tue, 9 Apr 2002, X Philius wrote: > Security Folks, > Are there any exploits out there that take advantage of this hole? I am > running 4.4 Release, and have been watching the security notifications > list for patches that I *really* need to run. So, if I want to keep > things as simple as possible, would you recomend patching to fix this > issue? If it is just a matter of possible DOS issues, versus actual > known exploits, I'll probably skip it. If you don't want to break functionality of /sys/net/zlib.c, don't apply a patch proposed by the FreeBSD-SA-02:18.zlib - it will crash your patched kernel if you'll try to use pppd with deflate compression enabled (at least I've got a kernel panic almost immediately diring an experiment on a patched 4.5-RELEASE). The bug has fixed in all security branches (RELENG_4_5 etc), but security advisory still points to a buggy patch. Better fetch the correct version of this file from CVS repositary. Beware of it! Sincerely, Dmitry Atlantis ISP, System Administrator e-mail: dmitry@atlantis.dp.ua nic-hdl: LYNX-RIPE To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message