From owner-freebsd-security@FreeBSD.ORG Thu Dec 30 14:01:48 2004 Return-Path: Delivered-To: freebsd-security@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 1759016A4CE for ; Thu, 30 Dec 2004 14:01:48 +0000 (GMT) Received: from mail.freebsd.org.cn (dns3.freebsd.org.cn [61.129.66.75]) by mx1.FreeBSD.org (Postfix) with SMTP id 3D77143D31 for ; Thu, 30 Dec 2004 14:01:45 +0000 (GMT) (envelope-from delphij@frontfree.net) Received: (qmail 29524 invoked by uid 0); 30 Dec 2004 13:54:33 -0000 Received: from unknown (HELO beastie.frontfree.net) (219.239.99.7) by mail.freebsd.org.cn with SMTP; 30 Dec 2004 13:54:33 -0000 Received: from localhost (localhost.frontfree.net [127.0.0.1]) by beastie.frontfree.net (Postfix) with ESMTP id 6F0BC131F2E; Thu, 30 Dec 2004 22:01:38 +0800 (CST) Received: from beastie.frontfree.net ([127.0.0.1]) by localhost (beastie.frontfree.net [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 03808-12; Thu, 30 Dec 2004 22:01:25 +0800 (CST) Received: by beastie.frontfree.net (Postfix, from userid 1001) id 1281B131D26; Thu, 30 Dec 2004 22:01:25 +0800 (CST) Date: Thu, 30 Dec 2004 22:01:25 +0800 From: Xin LI To: Josef El-Rayes Message-ID: <20041230140125.GA3982@frontfree.net> References: <34657.24.230.37.14.1104187002.squirrel@24.230.37.14> <2990.24.98.86.57.1104197295.squirrel@24.98.86.57> <41D0C276.7080100@elischer.org> <20041229185332.GL24545@cowbert.net> <20041229193226.GA11252@daemon.li> Mime-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha1; protocol="application/pgp-signature"; boundary="C7zPtVaVf+AK4Oqc" Content-Disposition: inline In-Reply-To: <20041229193226.GA11252@daemon.li> User-Agent: Mutt/1.4.2.1i X-GPG-key-ID/Fingerprint: 0xCAEEB8C0 / 43B8 B703 B8DD 0231 B333 DC28 39FB 93A0 CAEE B8C0 X-GPG-Public-Key: http://www.delphij.net/delphij.asc X-Operating-System: FreeBSD beastie.frontfree.net 5.3-delphij FreeBSD 5.3-delphij #11: Tue Oct 26 14:12:03 CST 2004 delphij@beastie.frontfree.net:/usr/obj/usr/src/sys/BEASTIE i386 X-URL: http://www.delphij.net X-By: delphij@beastie.frontfree.net X-Location: Beijing, China X-Virus-Scanned: by amavisd-new at frontfree.net cc: "Peter C. Lai" cc: freebsd-security@freebsd.org cc: Julian Elischer cc: estover@nativenerds.com Subject: Re: Found security expliot in port phpBB 2.0.8 FreeBSD4.10 X-BeenThere: freebsd-security@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: Security issues [members-only posting] List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 30 Dec 2004 14:01:48 -0000 --C7zPtVaVf+AK4Oqc Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Wed, Dec 29, 2004 at 07:32:26PM +0000, Josef El-Rayes wrote: > "Peter C. Lai" : > > On Mon, Dec 27, 2004 at 06:18:30PM -0800, Julian Elischer wrote: > > > might be a good idea if we "urged" users to update their phpbb a bit= =20 > > > more vocally. > >=20 > > Or if someone had been vigilant enough to add a vuxml entry about it ba= ck > > in November. Waiting >30 days to update the database that portaudit uses > > is a bit longish, don't you think? The "urging" to which you refer is > > already one of the services provided by portaudit. >=20 > first of all, if you run a machine you care about, you should think > twice before installing a software which has a bad security track > as phpBB has. secondly, most of the time we do not know security > issue any earlier then they get posted to bugtraq or similiar > mailinglists, so why dont you track these lists yourself? I always have a headache with the phpBB installation for the FreeBSD China Community. I personally subscribe to phpBB's CVS commit message and patch immediately when they have committed something "interesting". I would admit that it's a bit late for the vuxml chunk to catch up with this. However, it's a good idea to catch up with every phpbb updates, as almost every updates is related to security issues during the last year[1]... [1] http://www.freebsd.org/cgi/cvsweb.cgi/ports/www/phpbb/Makefile Cheers, --=20 Xin LI http://www.delphij.net/ See complete headers for GPG key and other information. --C7zPtVaVf+AK4Oqc Content-Type: application/pgp-signature Content-Disposition: inline -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.6 (FreeBSD) iD8DBQFB1Ao0/cVsHxFZiIoRAo9KAJ4l/jz+aZed5rllIYwBOs0rnjfIoACdHn8X igey0AML7HacItJjITguHGo= =6yAE -----END PGP SIGNATURE----- --C7zPtVaVf+AK4Oqc--