multiple vulnerabilities in the cvs server code

[Xin LI]

On Tue, Sep 14, 2004 at 04:37:10PM +0300, Dmitry Pryanishnikov wrote:
>  As I read in this SA, this vulnerability was fixed on 2004-05-20, before
> 4.10 was released, so 4.10-RELEASE isn't vulnerable, right? But portaudit

Yes, 4.10 is not vulnerable.

> still complains about FreeBSD-491000. Probably, wrong check in auditfile?
> Also, it would be nice if such an advisories advance kern.osreldate,
> so auditfile could check this automatically; e.g., I have 4.9-RELEASE-p11, 
> which isn't vulnerable to this problem, but kern.osreldate is still 490000 
> there. If Security Officer bumps src/sys/conf/newvers.sh, why he doesn't 
> bump src/sys/sys/param.h?

I think it is not applicable to bump param.h, as it represents an ABI change,
which a security update should not introduce.  (just my $0.02 :-)


Cheers,
-- 
Xin LI <delphij frontfree net>	http://www.delphij.net/
See complete headers for GPG key and other information.

-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 187 bytes
Desc: not available
Url : http://lists.freebsd.org/pipermail/freebsd-security/attachments/20040914/4cfa444a/attachment.bin