Security

刚刚想睡觉的时候收到了commit mail:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24

clement     2004/05/28 08:27:02 PDT

  FreeBSD ports repository
  Modified files:
    www/apache2          Makefile 
  Added files:
    www/apache2/files    patch-modules:ssl:ssl_engine_kernel.c 
  Log:
  - Import security fix from Apache CVS...
  * modules/ssl/ssl_engine_kernel.c (ssl_hook_UserCheck): Fix buffer
  overflow in FakeBasicAuth code if client's subject DN exceeds 6K in
  length (CVE CAN-2004-0488); switch to using apr-util base64 encoder
  functions.
  - ... and of course bump PORTREVISION.
  
  http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0488
  http://secunia.com/advisories/11534/
  
  Reported by:    Charles-Damien Orbello <tazma@cultdeadsheep.org>
  
  Revision  Changes    Path
  1.178     +1 -0      ports/www/apache2/Makefile
  1.1       +39 -0     ports/www/apache2/files/patch-modules:ssl:ssl_engine_kernel.c (new)

I have requested src/usr.sbin/timed/timedc/timedc.c, v 1.5 to be MFC’ed to RELENG_4 and RELENG_4_10 so it will get its way into the upcoming release. It has not decided whether this will be merged into RELENG_4_10 yet, however, it is very likely that this will.

Currently the settings are:

Strict RFC821 Envelop.

It seems that OpenBSD people has then patched cvs vulnerablity, though. In this version, OpenBSD has pf(4) improved a lot!

刚刚揭露的那个TCP漏洞OpenBSD在1999年就修正了……和FreeBSD现在用的方法类似，只是更严厉一些。折服了……

Yesterday someone has asked me about my diary system, I told her that my diary is managed by my own diary software, which is a close-source system (written in C#) and I do not want to share it with others because it is technically not a friendly one.

TCP is vulnerable?! Yes if your system relays on persist TCP connections, for example, routers supporting BGP. CERT has released a advisory about this.

Finally the phpBB issue was posted to BugTraq, as a follow-up to the original post by Wang.

I have turned on several anti-spam settings on beastie.frontfree.net to ease my life. They stand for “most evident spam characters” and hence should not go to the content filtering subsystem and should be directly dropped.

Today Microsoft has released four critical security updates, their KB numbers are: 835732, 828741, 837009, 837001.