Date: Thu, 4 Dec 2003 17:20:15 +0200 From: Peter Pentchev <roam@ringlet.net> To: Kris Kennaway <kris@obsecurity.org> Cc: Lukas Ertl <l.ertl@univie.ac.at> Subject: Re: HEADS UP! Watch out for security on your machines and exploits! Message-ID: <20031204152015.GF347@straylight.m.ringlet.net> In-Reply-To: <20031204151013.GA80231@xor.obsecurity.org> References: <20031203234849.7238C2A7EA@canning.wemm.org> <20031204133520.A748@korben.in.tern> <20031204132303.GB347@straylight.m.ringlet.net> <20031204151013.GA80231@xor.obsecurity.org>
next in thread | previous in thread | raw e-mail | index | archive | help
--j2AXaZ4YhVcLc+PQ Content-Type: text/plain; charset=windows-1251 Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Thu, Dec 04, 2003 at 07:10:13AM -0800, Kris Kennaway wrote: > On Thu, Dec 04, 2003 at 03:23:03PM +0200, Peter Pentchev wrote: > > On Thu, Dec 04, 2003 at 01:37:20PM +0100, Lukas Ertl wrote: > > > On Wed, 3 Dec 2003, Peter Wemm wrote: > > >=20 > > > > Please take EXTRA care to watch your mirrors for 'funny stuff' and = make damn > > > > sure that you're fully up todate with patches. > > > > > > > > Being a cvsup*/ftp*/etc mirror means that you're going to be scanne= d and > > > > probed. Especially now. > > >=20 > > > (I'm cc'ing ports@ on this.) > > >=20 > > > Since the gentoo hack was obviously made through a vunerable version = of > > > rsync, I ask if it's possible to update the rsync port to the new ver= sion. > >=20 > > I sent a patch to update rsync to 2.5.7 to Oliver Eikemeier, the port > > maintainer, earlier today. >=20 > Because of the severity of this, I put on my portmgr hat and updated > it myself a few minutes ago. It should be retagged for 5.2. It would be nice to also include the files/patch-util.c from my update patch: rsync-2.5.7 artificially limits the size of a malloc'ed block to 1G, which is fine on 32-bit machines, but might turn out to be just that - an artificial limitation - on 64-bit ones. I don't think it is strictly needed though - allocating more than 1G at a time strikes me as more than a little scary, even for a FreeBSD mirror server :) Thanks for taking care of this, though! G'luck, Peter --=20 Peter Pentchev roam@ringlet.net roam@sbnd.net roam@FreeBSD.org PGP key: http://people.FreeBSD.org/~roam/roam.key.asc Key fingerprint FDBA FD79 C26F 3C51 C95E DF9E ED18 B68D 1619 4553 If you think this sentence is confusing, then change one pig. --j2AXaZ4YhVcLc+PQ Content-Type: application/pgp-signature Content-Disposition: inline -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.3 (FreeBSD) iD8DBQE/z1Cv7Ri2jRYZRVMRApZtAKC5q1zsCQFhRBdivT18SlioyV5OvACghPlG FBHr5NFRPxMh21FlbKSAYkA= =teWI -----END PGP SIGNATURE----- --j2AXaZ4YhVcLc+PQ--
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20031204152015.GF347>