Security

Let’s review what I have did years ago. I say, nothing can claim itself secure! Nothing, nothing, nothing!!

Not sure how did the corporation has designed the firewall system, it is simply - bogous and useless, and is fragile by design. All the design’s function is to keep the network out of being functional, not to make it a bit safer.

刚刚想睡觉的时候收到了commit mail:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24

clement     2004/05/28 08:27:02 PDT

  FreeBSD ports repository
  Modified files:
    www/apache2          Makefile 
  Added files:
    www/apache2/files    patch-modules:ssl:ssl_engine_kernel.c 
  Log:
  - Import security fix from Apache CVS...
  * modules/ssl/ssl_engine_kernel.c (ssl_hook_UserCheck): Fix buffer
  overflow in FakeBasicAuth code if client's subject DN exceeds 6K in
  length (CVE CAN-2004-0488); switch to using apr-util base64 encoder
  functions.
  - ... and of course bump PORTREVISION.
  
  http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0488
  http://secunia.com/advisories/11534/
  
  Reported by:    Charles-Damien Orbello <tazma@cultdeadsheep.org>
  
  Revision  Changes    Path
  1.178     +1 -0      ports/www/apache2/Makefile
  1.1       +39 -0     ports/www/apache2/files/patch-modules:ssl:ssl_engine_kernel.c (new)

I have requested src/usr.sbin/timed/timedc/timedc.c, v 1.5 to be MFC’ed to RELENG_4 and RELENG_4_10 so it will get its way into the upcoming release. It has not decided whether this will be merged into RELENG_4_10 yet, however, it is very likely that this will.

Currently the settings are:

Strict RFC821 Envelop.

It seems that OpenBSD people has then patched cvs vulnerablity, though. In this version, OpenBSD has pf(4) improved a lot!

刚刚揭露的那个TCP漏洞OpenBSD在1999年就修正了……和FreeBSD现在用的方法类似，只是更严厉一些。折服了……

Yesterday someone has asked me about my diary system, I told her that my diary is managed by my own diary software, which is a close-source system (written in C#) and I do not want to share it with others because it is technically not a friendly one.

TCP is vulnerable?! Yes if your system relays on persist TCP connections, for example, routers supporting BGP. CERT has released a advisory about this.

Finally the phpBB issue was posted to BugTraq, as a follow-up to the original post by Wang.