Re: Any status on timestamp vulnerability fix for 4.X?

From: Uwe Doering (gemini_at_geminix.org)
Date: 06/25/05

  • Next message: Oleg Rusanov: ""sh -i" My server was hacked. How can i found hole on my server?" 
    Date: Sat, 25 Jun 2005 13:06:28 +0200
To: Richard Coleman <rcoleman@criticalmagic.com>

    Richard Coleman wrote:
    > Any information on when (or if) the following timestamp vulnerability
    > will be fixed for 4.X? Any information would be appreciated.
    >
    > http://www.kb.cert.org/vuls/id/637934

    FYI, the fix for RELENG_5 applies to RELENG_4 as is (apart from the CVS
    version header, of course):

    http://www.freebsd.org/cgi/cvsweb.cgi/src/sys/netinet/tcp_input.c.diff?r1=1.252.2.15&r2=1.252.2.16&f=u

    After verifying its semantic correctness for RELENG_4 we've been running
    the patch for a couple of weeks now with no ill effects.

    I'm posting this also as an encouragement for committers to go ahead and
    do the MFC. It's low hanging fruit.

        Uwe 

    -- 
Uwe Doering         |  EscapeBox - Managed On-Demand UNIX Servers
gemini@geminix.org  |  http://www.escapebox.net
_______________________________________________
freebsd-security@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-security
To unsubscribe, send any mail to "freebsd-security-unsubscribe@freebsd.org"
  • Next message: Oleg Rusanov: ""sh -i" My server was hacked. How can i found hole on my server?"