HEADS UP! Watch out for security on your machines and exploits!

[Peter Pentchev]

On Thu, Dec 04, 2003 at 07:10:13AM -0800, Kris Kennaway wrote:
> On Thu, Dec 04, 2003 at 03:23:03PM +0200, Peter Pentchev wrote:
> > On Thu, Dec 04, 2003 at 01:37:20PM +0100, Lukas Ertl wrote:
> > > On Wed, 3 Dec 2003, Peter Wemm wrote:
> > > 
> > > > Please take EXTRA care to watch your mirrors for 'funny stuff' and make damn
> > > > sure that you're fully up todate with patches.
> > > >
> > > > Being a cvsup*/ftp*/etc mirror means that you're going to be scanned and
> > > > probed.  Especially now.
> > > 
> > > (I'm cc'ing ports@ on this.)
> > > 
> > > Since the gentoo hack was obviously made through a vunerable version of
> > > rsync, I ask if it's possible to update the rsync port to the new version.
> > 
> > I sent a patch to update rsync to 2.5.7 to Oliver Eikemeier, the port
> > maintainer, earlier today.
> 
> Because of the severity of this, I put on my portmgr hat and updated
> it myself a few minutes ago.  It should be retagged for 5.2.

It would be nice to also include the files/patch-util.c from my update
patch: rsync-2.5.7 artificially limits the size of a malloc'ed block
to 1G, which is fine on 32-bit machines, but might turn out to be
just that - an artificial limitation - on 64-bit ones.  I don't think
it is strictly needed though - allocating more than 1G at a time strikes
me as more than a little scary, even for a FreeBSD mirror server :)

Thanks for taking care of this, though!

G'luck,
Peter

-- 
Peter Pentchev	roam at ringlet.net    roam at sbnd.net    roam at FreeBSD.org
PGP key:	http://people.FreeBSD.org/~roam/roam.key.asc
Key fingerprint	FDBA FD79 C26F 3C51 C95E  DF9E ED18 B68D 1619 4553
If you think this sentence is confusing, then change one pig.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 187 bytes
Desc: not available
Url : http://lists.freebsd.org/pipermail/freebsd-ports/attachments/20031204/d0aa9d1d/attachment.bin