Re: [OpenPKG-SA-2003.042] OpenPKG Security Advisory (openssh)

From: Ralf S. Engelschall (rse_at_engelschall.com)
Date: 09/26/03

  • Next message: Jonathan A. Zdziarski: "CyberInsecurity: The cost of Monopoly" 
    Date: Fri, 26 Sep 2003 08:49:27 +0200
To: Damien Miller <djm@mindrot.org>

    On Fri, Sep 26, 2003, Damien Miller wrote:

    > > vulnerable. OpenPKG installations are only affected if the package was
    > > built with option "with_pam" set to "yes" -- which is not the default.
    >
    > Incorrect. You mean "--with-pam" in ./configure (not default) or "UsePam
    > yes" (default, before 3.7.1p2) in sshd_config.
    >
    > Neither of these options is called "use_pam".

    Be careful, our advisory talks about the OpenPKG _package_ option
    "with_pam", not the GNU autoconf option "--with-pam" of the contained
    OpenSSH vendor source. OpenPKG source RPM packages provide "with_xxx"
    options which can be set to "yes" or "no" on the command line during
    package build ("rpm --rebuild --define 'with_pam yes' openssh*.src.rpm")
    in order to build variants of binary RPMs.

    If you look at http://cvs.openpkg.org/openpkg-src/openssh/openssh.spec,
    you see that in the OpenSSH case the OpenPKG option "with_pam yes" is
    mapped onto --with-pam on the GNU autoconf command line later.

                                           Ralf S. Engelschall
                                           rse@engelschall.com
                                           www.engelschall.com

  • Next message: Jonathan A. Zdziarski: "CyberInsecurity: The cost of Monopoly"