From owner-freebsd-security  Mon Jan 29 22:28:52 2001
Delivered-To: freebsd-security@freebsd.org
Received: from obsecurity.org (adsl-64-169-104-72.dsl.lsan03.pacbell.net [64.169.104.72])
	by hub.freebsd.org (Postfix) with ESMTP
	id 3B66A37B402; Mon, 29 Jan 2001 22:28:35 -0800 (PST)
Received: by obsecurity.org (Postfix, from userid 1000)
	id B7E8FBA134; Mon, 29 Jan 2001 22:29:04 -0800 (PST)
Date: Mon, 29 Jan 2001 22:29:03 -0800
From: Kris Kennaway <kris@obsecurity.org>
To: "Brian F. Feldman" <green@FreeBSD.ORG>
Cc: security@FreeBSD.ORG
Subject: Re: FreeBSD Security Advisory: FreeBSD-SA-01:11.inetd [REVISED]
Message-ID: <20010129222903.A79869@xor.obsecurity.org>
References: <security-advisories@freebsd.org> <200101300609.f0U69Cf70017@green.dyndns.org>
Mime-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-md5;
	protocol="application/pgp-signature"; boundary="NzB8fVQJ5HfG6fxh"
Content-Disposition: inline
User-Agent: Mutt/1.2.5i
In-Reply-To: <200101300609.f0U69Cf70017@green.dyndns.org>; from green@FreeBSD.ORG on Tue, Jan 30, 2001 at 01:09:11AM -0500
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
X-Loop: FreeBSD.org


--NzB8fVQJ5HfG6fxh
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On Tue, Jan 30, 2001 at 01:09:11AM -0500, Brian F. Feldman wrote:
> Actually, there were two issues.  One was that the permissions weren't=20
> dropped totally on the way to opening the .fakeid file, and the other was=
=20
> that it was not read in a way that would be guaranteed not to block, so b=
y=20
> creating a named pipe, the user could hang an inetd child.

Is that really a security issue, though?

Kris
--NzB8fVQJ5HfG6fxh
Content-Type: application/pgp-signature
Content-Disposition: inline

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.4 (FreeBSD)
Comment: For info see http://www.gnupg.org

iD8DBQE6dl8vWry0BWjoQKURAu8UAKDO1CwB7FLOqY+fQwcQArE33M4UzgCeJ6hA
FNGsS/SECT82Mt1pWbuMyaU=
=XvgO
-----END PGP SIGNATURE-----

--NzB8fVQJ5HfG6fxh--


To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message