From owner-freebsd-ports@FreeBSD.ORG Thu Dec 4 07:20:23 2003 Return-Path: Delivered-To: freebsd-ports@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 7FD8E16A4CF for ; Thu, 4 Dec 2003 07:20:23 -0800 (PST) Received: from gandalf.online.bg (gandalf.online.bg [217.75.128.9]) by mx1.FreeBSD.org (Postfix) with SMTP id 6E7BC43F3F for ; Thu, 4 Dec 2003 07:20:19 -0800 (PST) (envelope-from roam@ringlet.net) Received: (qmail 11023 invoked from network); 4 Dec 2003 15:18:24 -0000 Received: from office.sbnd.net (HELO straylight.ringlet.net) (217.75.140.130) by gandalf.online.bg with SMTP; 4 Dec 2003 15:18:23 -0000 Received: (qmail 8036 invoked by uid 1000); 4 Dec 2003 15:20:15 -0000 Date: Thu, 4 Dec 2003 17:20:15 +0200 From: Peter Pentchev To: Kris Kennaway Message-ID: <20031204152015.GF347@straylight.m.ringlet.net> Mail-Followup-To: Kris Kennaway , Lukas Ertl , Peter Wemm , ports@freebsd.org, hubs@freebsd.org References: <20031203234849.7238C2A7EA@canning.wemm.org> <20031204133520.A748@korben.in.tern> <20031204132303.GB347@straylight.m.ringlet.net> <20031204151013.GA80231@xor.obsecurity.org> Mime-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha1; protocol="application/pgp-signature"; boundary="j2AXaZ4YhVcLc+PQ" Content-Disposition: inline In-Reply-To: <20031204151013.GA80231@xor.obsecurity.org> User-Agent: Mutt/1.5.5.1i cc: ports@freebsd.org cc: hubs@freebsd.org cc: Peter Wemm cc: Lukas Ertl Subject: Re: HEADS UP! Watch out for security on your machines and exploits! X-BeenThere: freebsd-ports@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: Porting software to FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 04 Dec 2003 15:20:23 -0000 --j2AXaZ4YhVcLc+PQ Content-Type: text/plain; charset=windows-1251 Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Thu, Dec 04, 2003 at 07:10:13AM -0800, Kris Kennaway wrote: > On Thu, Dec 04, 2003 at 03:23:03PM +0200, Peter Pentchev wrote: > > On Thu, Dec 04, 2003 at 01:37:20PM +0100, Lukas Ertl wrote: > > > On Wed, 3 Dec 2003, Peter Wemm wrote: > > >=20 > > > > Please take EXTRA care to watch your mirrors for 'funny stuff' and = make damn > > > > sure that you're fully up todate with patches. > > > > > > > > Being a cvsup*/ftp*/etc mirror means that you're going to be scanne= d and > > > > probed. Especially now. > > >=20 > > > (I'm cc'ing ports@ on this.) > > >=20 > > > Since the gentoo hack was obviously made through a vunerable version = of > > > rsync, I ask if it's possible to update the rsync port to the new ver= sion. > >=20 > > I sent a patch to update rsync to 2.5.7 to Oliver Eikemeier, the port > > maintainer, earlier today. >=20 > Because of the severity of this, I put on my portmgr hat and updated > it myself a few minutes ago. It should be retagged for 5.2. It would be nice to also include the files/patch-util.c from my update patch: rsync-2.5.7 artificially limits the size of a malloc'ed block to 1G, which is fine on 32-bit machines, but might turn out to be just that - an artificial limitation - on 64-bit ones. I don't think it is strictly needed though - allocating more than 1G at a time strikes me as more than a little scary, even for a FreeBSD mirror server :) Thanks for taking care of this, though! G'luck, Peter --=20 Peter Pentchev roam@ringlet.net roam@sbnd.net roam@FreeBSD.org PGP key: http://people.FreeBSD.org/~roam/roam.key.asc Key fingerprint FDBA FD79 C26F 3C51 C95E DF9E ED18 B68D 1619 4553 If you think this sentence is confusing, then change one pig. --j2AXaZ4YhVcLc+PQ Content-Type: application/pgp-signature Content-Disposition: inline -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.3 (FreeBSD) iD8DBQE/z1Cv7Ri2jRYZRVMRApZtAKC5q1zsCQFhRBdivT18SlioyV5OvACghPlG FBHr5NFRPxMh21FlbKSAYkA= =teWI -----END PGP SIGNATURE----- --j2AXaZ4YhVcLc+PQ--