From owner-freebsd-bugs Sat Aug 2 09:55:25 1997 Return-Path: Received: (from root@localhost) by hub.freebsd.org (8.8.5/8.8.5) id JAA01275 for bugs-outgoing; Sat, 2 Aug 1997 09:55:25 -0700 (PDT) Received: from sax.sax.de (sax.sax.de [193.175.26.33]) by hub.freebsd.org (8.8.5/8.8.5) with SMTP id JAA01270 for ; Sat, 2 Aug 1997 09:55:22 -0700 (PDT) Received: (from uucp@localhost) by sax.sax.de (8.6.12/8.6.12-s1) with UUCP id SAA17111; Sat, 2 Aug 1997 18:52:30 +0200 Received: (from j@localhost) by uriah.heep.sax.de (8.8.5/8.8.5) id SAA26263; Sat, 2 Aug 1997 18:48:25 +0200 (MET DST) Message-ID: <19970802184824.DD51566@uriah.heep.sax.de> Date: Sat, 2 Aug 1997 18:48:24 +0200 From: j@uriah.heep.sax.de (J Wunsch) To: ru@ucb.crimea.ua (Ruslan Ermilov) Cc: jkh@time.cdrom.com, freebsd-bugs@FreeBSD.ORG, imp@village.org Subject: Re: CERT Advisory CA-97.17 - Vulnerability in suidperl (sperl) question... References: <19970802152306.IZ53286@uriah.heep.sax.de> <199708021425.RAA07998@relay.ucb.crimea.ua> X-Mailer: Mutt 0.60_p2-3,5,8-9 Mime-Version: 1.0 X-Phone: +49-351-2012 669 X-PGP-Fingerprint: DC 47 E6 E4 FF A6 E9 8F 93 21 E0 7D F9 12 D6 4E Reply-To: joerg_wunsch@uriah.heep.sax.de (Joerg Wunsch) In-Reply-To: <199708021425.RAA07998@relay.ucb.crimea.ua>; from Ruslan Ermilov on Aug 2, 1997 17:25:53 +0300 Sender: owner-freebsd-bugs@FreeBSD.ORG X-Loop: FreeBSD.org Precedence: bulk As Ruslan Ermilov wrote: > For CERT Advisory CA-97.16 - ftpd Signal Handling Vulnerability > there is a response from FreeBSD Project: Not a big surprise. I think this particular problem has been detected by David Greenman. ;) > Because no response was made by FreeBSD Project to the CA-97.17, why > there is no at least GNATS entry for it? Because nobody has ever filed one. I wouldn't recommend doing it right now, since the fix is already apparent. I'm now only waiting for an OK by Warner. (Warner is also the security co-officer, so i think he could handle informing CERT afterwards.) -- cheers, J"org joerg_wunsch@uriah.heep.sax.de -- http://www.sax.de/~joerg/ -- NIC: JW11-RIPE Never trust an operating system you don't have sources for. ;-)