Date: Tue, 15 Jan 2008 00:53:25 -0500 From: Mike Tancsa <mike@sentex.net> To: Mark Andrews <Mark_Andrews@isc.org> Cc: freebsd-security@freebsd.org Subject: Re: FreeBSD Security Advisory FreeBSD-SA-08:02.libc Message-ID: <200801150557.m0F5vhmf084591@lava.sentex.ca> In-Reply-To: <200801150522.m0F5MqV1061436@drugs.dv.isc.org> References: <Your message of "Mon, 14 Jan 2008 23:28:46 CDT." <200801150428.m0F4SaH1084137@lava.sentex.ca> <200801150522.m0F5MqV1061436@drugs.dv.isc.org>
next in thread | previous in thread | raw e-mail | index | archive | help
At 12:22 AM 1/15/2008, Mark Andrews wrote:
> >
> > For the "usual suspects" of applications running, (e.g. sendmail,
> > apache, BIND etc) would it be possible to pass crafted packets
> > through to this function remotely via those apps ? ie how easy
> is this to do
> > ?
>
> The usual suspects don't call inet_network().
> route calls inet_network() but not routed doesn't.
Thanks to all who responded so far! I had a look at some of the
ports I am using and so far all I found was
find . -name "*.c" | xargs grep inet_network
./apache13-modssl/work/apache_1.3.33/src/modules/proxy/proxy_util.c:
if (host[i] == '\0' && (ap_inet_addr(host) == -1 || inet_network(host) == -1))
---Mike
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200801150557.m0F5vhmf084591>