From owner-freebsd-security Sat May 11 16: 2: 4 2002 Delivered-To: freebsd-security@freebsd.org Received: from forum.lariat.org (forum.lariat.org [12.23.109.3]) by hub.freebsd.org (Postfix) with ESMTP id 38EA537B405 for ; Sat, 11 May 2002 16:02:02 -0700 (PDT) Received: (from brett@localhost) by forum.lariat.org (8.9.3/8.9.3) id RAA15457 for security@freebsd.org; Sat, 11 May 2002 17:02:00 -0600 (MDT) Date: Sat, 11 May 2002 17:02:00 -0600 (MDT) From: Brett Glass Message-Id: <200205112302.RAA15457@forum.lariat.org> To: security@freebsd.org Subject: DHCPD bug Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.org There's a nasty bug in ISC's DHCPD -- a remote root hole -- that affects the versions that have been provided as ports and packages in recent releases. See http://www.extremetech.com/article/0,3396,apn=2&s=1024&a=26709&ap=1,00.asp for a description of the problem. The version of the port that's online has been updated to close the hole, but the package hasn't -- which means that users installing FreeBSD who grab the daemon via /stand/sysinstall will find themselves vulnerable. Also, no advisory has been issued.... One should be. --Brett To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message