From owner-freebsd-security@FreeBSD.ORG  Wed Mar 26 05:01:01 2003
Return-Path: <owner-freebsd-security@FreeBSD.ORG>
Delivered-To: freebsd-security@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id 6493537B404
	for <freebsd-security@freebsd.org>;
	Wed, 26 Mar 2003 05:01:01 -0800 (PST)
Received: from mailout.informatik.tu-muenchen.de
	(mailout.informatik.tu-muenchen.de [131.159.0.5])
	by mx1.FreeBSD.org (Postfix) with ESMTP id 6F09243F75
	for <freebsd-security@freebsd.org>;
	Wed, 26 Mar 2003 05:01:00 -0800 (PST)
	(envelope-from barner@in.tum.de)
Received: from mailrelay1.informatik.tu-muenchen.de
	(mailrelay1.informatik.tu-muenchen.de [131.159.254.5])
	by mailout.informatik.tu-muenchen.de (Postfix) with ESMTP
	id 9044B6271; Wed, 26 Mar 2003 14:00:59 +0100 (MET)
Received: from mail.informatik.tu-muenchen.de (mail.informatik.tu-muenchen.de
	[131.159.0.26])
	by mailrelay1.informatik.tu-muenchen.de (Postfix) with ESMTP
	id 801977944; Wed, 26 Mar 2003 14:00:59 +0100 (MET)
Received: from zi025.glhnet.mhn.de (unknown [129.187.19.157])
	by mail.informatik.tu-muenchen.de (Postfix) with ESMTP
	id 58B426CB10; Wed, 26 Mar 2003 14:00:59 +0100 (MET)
Received: by zi025.glhnet.mhn.de (Postfix, from userid 1000)
	id 57AF536D38; Wed, 26 Mar 2003 14:00:57 +0100 (CET)
Date: Wed, 26 Mar 2003 14:00:56 +0100
From: Simon Barner <barner@in.tum.de>
To: D J Hawkey Jr <hawkeyd@visi.com>
Message-ID: <20030326130056.GD657@zi025.glhnet.mhn.de>
References: <Pine.LNX.4.43.0303252144400.21019-100000@pilchuck.reedmedia.net>
	<20030326102057.GC657@zi025.glhnet.mhn.de>
	<20030326061041.A17052@sheol.localdomain>
Mime-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha1;
	protocol="application/pgp-signature"; boundary="ylS2wUBXLOxYXZFQ"
Content-Disposition: inline
In-Reply-To: <20030326061041.A17052@sheol.localdomain>
User-Agent: Mutt/1.5.4i
X-Spam-Status: No, hits=-31.9 required=5.0
	tests=AWL,IN_REP_TO,PGP_SIGNATURE_2,QUOTED_EMAIL_TEXT,REFERENCES,
	      REPLY_WITH_QUOTES,USER_AGENT_MUTT
	autolearn=ham	version=2.50
X-Spam-Level: 
X-Spam-Checker-Version: SpamAssassin 2.50 (1.173-2003-02-20-exp)
cc: "Jeremy C. Reed" <reed@reedmedia.net>
cc: security at FreeBSD <freebsd-security@freebsd.org>
Subject: Re: what actually uses xdr_mem.c?
X-BeenThere: freebsd-security@freebsd.org
X-Mailman-Version: 2.1.1
Precedence: list
List-Id: Security issues [members-only posting]
	<freebsd-security.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-security>,
	<mailto:freebsd-security-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-security>
List-Post: <mailto:freebsd-security@freebsd.org>
List-Help: <mailto:freebsd-security-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-security>,
	<mailto:freebsd-security-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Wed, 26 Mar 2003 13:01:02 -0000


--ylS2wUBXLOxYXZFQ
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline

> Actually, I _would_ check the binaries. Scanning /usr/src doesn't cover
> anything installed via the ports collection (/usr/ports), from other
> sources, or "home-grown" software.

I didn't think of non-base-system software, you are right. From that point of
view, you are certainly right.

As far as I understood your script, it scans the output of "readelf -a", and
prints that file name if and only if this output contains "XDR" or "xdr". Will
this work if the binary is stripped (sorry in case I just overlooked something
stupid :-)

Regards,
 Simon

--ylS2wUBXLOxYXZFQ
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: Digital signature
Content-Disposition: inline

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.1 (FreeBSD)

iD8DBQE+gaSICkn+/eutqCoRAp+WAJ4k3xFkk7mv6fl+RuK10BUZ9Ps9mACgqatu
L+wA59UtnSzyY218KBhal2Y=
=V2zG
-----END PGP SIGNATURE-----

--ylS2wUBXLOxYXZFQ--