cvs commit: src UPDATING src/contrib/bind9/bin/named client.c src/contrib/bind9/lib/dns dispatch.c src/contrib/bind9/lib/dns/include/dns dispatch.h src/contrib/tcpdump print-bgp.c src/etc/rc.d jail src/sys/conf newvers.sh

[Simon L. Nielsen]

On 2007.08.03 15:27:06 +0000, Alexey Dokuchaev wrote:
> On Thu, Aug 02, 2007 at 03:07:28AM -0700, Doug Barton wrote:
> > Alexey Dokuchaev wrote:
> >
> > > What about RELENG_4, is it going to be fixed, or these bugs are not
> > > applicable to it?  
> > 
> > No and no. Support has been dropped for 4.x, so it's not relevant,
> > even if it had BIND 9 in the base, which it doesn't.
> 
> OK, but what about tcpdump(1)?
> 
> Even so, does it read that 4.X is not vulnerable?

Since FreeBSD 4.X isn't supported by the security team we generally
don't mention it (or even check) if it's vulnerable in advisories
anymore.  That said, for the cases like bind9 etc. where we know that
wasn't in FreeBSD < 5.3 we do mention that (but no guarantees that we
will keep doing that).  There is enough work just handling the
supported versions.

For this particular case I don't know if tcpdump in FreeBSD 4 is
vulnerable - it could be that it isn't since tcpdump has changed a
lot, but I don't care enough to check.

-- 
Simon L. Nielsen
FreeBSD Security Team