Re: FreeBSD Security Advisory FreeBSD-SA-03:08.realpath

From: Jacques A. Vidrine (nectar_at_FreeBSD.org)
Date: 08/05/03

  • Next message: Jacques A. Vidrine: "IMPORTANT FOR lukemftpd USERS (was Re: FreeBSD Security Advisory FreeBSD-SA-03:08.realpath)" 
    Date: Mon, 4 Aug 2003 17:20:23 -0500
To: Troels Holm <th@cogito.dk>

    On Tue, Aug 05, 2003 at 12:10:14AM +0200, Troels Holm wrote:
    > Jacques A. Vidrine wrote:
    > > The realpath.c that is distributed with OpenSSH-portable and found in
    > > our CVS tree as /usr/src/crypto/openssh/openbsd-compat/realpath.c is
    > > not used.
    >
    > Just for the record :=)
    > What u say is that the advisory is in error and my "sftp-server" is _not_
    > affected? Or are you just saying that sftp isnt using the realpath.c from
    > OpenSSH?

    The latter.

    sftp-server *is* affected, just as it says in the advisory.

    But OpenSSH as bundled with FreeBSD uses realpath(3) from libc,
    not from src/crypto/openssh/openbsd-compat/realpath.c, and so (in
    answer to the question by a previous poster) that file does not need
    patching.

    Cheers, 

    -- 
Jacques Vidrine   . NTT/Verio SME      . FreeBSD UNIX       . Heimdal
nectar@celabo.org . jvidrine@verio.net . nectar@freebsd.org . nectar@kth.se
_______________________________________________
freebsd-security@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-security
To unsubscribe, send any mail to "freebsd-security-unsubscribe@freebsd.org"
  • Next message: Jacques A. Vidrine: "IMPORTANT FOR lukemftpd USERS (was Re: FreeBSD Security Advisory FreeBSD-SA-03:08.realpath)"

    Relevant Pages