On Jun 12, 2006 at 19:48, Robert Millan praised the llamas by saying:
> Package: irssi-text
> Version: 0.8.10-2
> Severity: normal
> Tags: patch
>
> I think the information provided via CTCP VERSION is excessive. Kernel and
> cpu
> platform is precisely the information an attacker would need to insert
> shellcode
> in case a vulnerability is discovered.
>
> Please consider reducing it:
>
> --- irssi-0.8.10/src/irc/core/ctcp.c~ 2005-12-08 18:32:48.000000000 +0100
> +++ irssi-0.8.10/src/irc/core/ctcp.c 2006-06-12 20:45:33.451706184 +0200
> @@ -329,7 +329,7 @@
> ctcp_cmds = NULL;
>
> settings_add_str("misc", "ctcp_version_reply",
> - PACKAGE" v$J - running on $sysname $sysarch");
> + PACKAGE" v$J");
> settings_add_str("misc", "ctcp_userinfo_reply", "$Y");
> settings_add_int("flood", "max_ctcp_queue", 5);
>
>
I'll probably reduce it to just say "irssi". You can change it using
/set ctcp_version_reply irssi v$J
As such, this is more about changing the default. This should be part
of -3 when ever I get around to making it.
--
David Pashley
[EMAIL PROTECTED]
Nihil curo de ista tua stulta superstitione.
--
To UNSUBSCRIBE, email to [EMAIL PROTECTED]
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
