From owner-freebsd-security@FreeBSD.ORG  Wed Dec 29 18:57:54 2004
Return-Path: <owner-freebsd-security@FreeBSD.ORG>
Delivered-To: freebsd-security@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id 18DD716A4CE
	for <freebsd-security@freebsd.org>;
	Wed, 29 Dec 2004 18:57:54 +0000 (GMT)
Received: from obsecurity.dyndns.org
	(CPE0050040655c8-CM00111ae02aac.cpe.net.cable.rogers.com [69.199.47.57])
	by mx1.FreeBSD.org (Postfix) with ESMTP id D8C4C43D45
	for <freebsd-security@freebsd.org>;
	Wed, 29 Dec 2004 18:57:53 +0000 (GMT)
	(envelope-from kris@obsecurity.org)
Received: by obsecurity.dyndns.org (Postfix, from userid 1000)
	id F0BD35119D; Wed, 29 Dec 2004 10:57:48 -0800 (PST)
Date: Wed, 29 Dec 2004 10:57:48 -0800
From: Kris Kennaway <kris@obsecurity.org>
To: "Peter C. Lai" <sirmoo@cowbert.net>
Message-ID: <20041229185748.GA9560@xor.obsecurity.org>
References: <34657.24.230.37.14.1104187002.squirrel@24.230.37.14>
	<2990.24.98.86.57.1104197295.squirrel@24.98.86.57>
	<41D0C276.7080100@elischer.org> <20041229185332.GL24545@cowbert.net>
Mime-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha1;
	protocol="application/pgp-signature"; boundary="y0ulUmNC+osPPQO6"
Content-Disposition: inline
In-Reply-To: <20041229185332.GL24545@cowbert.net>
User-Agent: Mutt/1.4.2.1i
cc: freebsd-security@freebsd.org
cc: Julian Elischer <julian@elischer.org>
cc: estover@nativenerds.com
Subject: Re: Found security expliot in port phpBB 2.0.8  FreeBSD4.10
X-BeenThere: freebsd-security@freebsd.org
X-Mailman-Version: 2.1.1
Precedence: list
List-Id: Security issues [members-only posting]
	<freebsd-security.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-security>,
	<mailto:freebsd-security-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-security>
List-Post: <mailto:freebsd-security@freebsd.org>
List-Help: <mailto:freebsd-security-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-security>,
	<mailto:freebsd-security-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Wed, 29 Dec 2004 18:57:54 -0000


--y0ulUmNC+osPPQO6
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On Wed, Dec 29, 2004 at 01:53:32PM -0500, Peter C. Lai wrote:
> On Mon, Dec 27, 2004 at 06:18:30PM -0800, Julian Elischer wrote:
> > might be a good idea if we "urged" users to update their phpbb  a bit=
=20
> > more vocally.
>=20
> Or if someone had been vigilant enough to add a vuxml entry about it back
> in November. Waiting >30 days to update the database that portaudit uses
> is a bit longish, don't you think? The "urging" to which you refer is
> already one of the services provided by portaudit.

Remember that FreeBSD is supported by the community, so you also could
have submitted the update but didn't.

Kris

--y0ulUmNC+osPPQO6
Content-Type: application/pgp-signature
Content-Disposition: inline

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.6 (FreeBSD)

iD8DBQFB0v4sWry0BWjoQKURAic6AJ4tYQr7Nj0XDjYIuznPi8qL14Y2SACfZEGy
YqYTugVYw9R7/9Xp7yDPX3g=
=Ifao
-----END PGP SIGNATURE-----

--y0ulUmNC+osPPQO6--