Bug#300775: Pam: newer upstream version (0.78) available fixing security bugs

2005-04-09 Thread Javier Fernández-Sanguino Peña
On Fri, Apr 08, 2005 at 04:28:13PM -0700, Steve Langasek wrote: Um, no, they are not. I don't need to dig into the source to know you're wrong. Check the PAM spec, the API documentation in the pam-doc package, or the symbol table of any Debian version of libpam.so.0 -- if these symbols are

Bug#300775: Pam: newer upstream version (0.78) available fixing security bugs

2005-04-08 Thread Javier Fernández-Sanguino Peña
On Mon, Apr 04, 2005 at 02:45:24AM -0400, Sam Hartman wrote: I'd recommend importing PAM 0.78's upstream and then looking at each of the debian local patches and seeing whether they should be maintained, dropped or modified. Well, I've dedicated an hour of work to this today and I've (almost)

Bug#300775: Pam: newer upstream version (0.78) available fixing security bugs

2005-04-08 Thread Steve Langasek
On Fri, Apr 08, 2005 at 07:53:06PM +0200, Javier Fernández-Sanguino Peña wrote: pam-0.78.orig/Linux-PAM/examples$ LC_ALL=C make gcc -Wall -Wwrite-strings -Wpointer-arith -Wcast-qual -Wcast-align -Wstrict-prototypes -Wmissing-prototypes -Wnested-externs -Winline

Bug#300775: Pam: newer upstream version (0.78) available fixing security bugs

2005-04-08 Thread Sam Hartman
I hate to be a pain in the ass, but it is going to be very difficult for me to take a huge .diff.gz that applies all the debian patches. That's hard to audit, hard to understand and not well documented. I'm happy to give you access to the repository so you can work on a branch and try to get

Bug#300775: Pam: newer upstream version (0.78) available fixing security bugs

2005-04-08 Thread Javier Fernández-Sanguino Peña
On Fri, Apr 08, 2005 at 12:20:10PM -0700, Steve Langasek wrote: undefined reference means that libpam.so does not contain symbols for these functions. That's a rather critical problem, considering these are core PAM functions. If you took a little bit of time to dig into the source before

Bug#300775: Pam: newer upstream version (0.78) available fixing security bugs

2005-04-08 Thread Javier Fernández-Sanguino Peña
On Fri, Apr 08, 2005 at 03:35:17PM -0400, Sam Hartman wrote: I hate to be a pain in the ass, but it is going to be very difficult for me to take a huge .diff.gz that applies all the debian patches. That's hard to audit, hard to understand and not well documented. I'm Well documented? The

Bug#300775: Pam: newer upstream version (0.78) available fixing security bugs

2005-04-08 Thread Steve Langasek
On Sat, Apr 09, 2005 at 12:34:23AM +0200, Javier Fernández-Sanguino Peña wrote: On Fri, Apr 08, 2005 at 12:20:10PM -0700, Steve Langasek wrote: undefined reference means that libpam.so does not contain symbols for these functions. That's a rather critical problem, considering these are

Bug#300775: Pam: newer upstream version (0.78) available fixing security bugs

2005-04-04 Thread Sam Hartman
Javier == Javier Fernández-Sanguino Peña [EMAIL PROTECTED] writes: Javier On Thu, Mar 24, 2005 at 08:49:01PM -0500, Sam Hartman Javier wrote: severity 300775 wishlist tags 300775 -security Javier ^ Why this? PAM 0.76 is indeed Javier vulnerable to the

Bug#300775: Pam: newer upstream version (0.78) available fixing security bugs

2005-03-25 Thread Javier Fernández-Sanguino Peña
On Thu, Mar 24, 2005 at 08:49:01PM -0500, Sam Hartman wrote: severity 300775 wishlist tags 300775 -security ^ Why this? PAM 0.76 is indeed vulnerable to the issues fixed in 0.78 Hi. I've explicitly decided not to upgrade PAM for sarge. I had also decided when 0.77 came

Bug#300775: Pam: newer upstream version (0.78) available fixing security bugs

2005-03-24 Thread Sam Hartman
severity 300775 wishlist tags 300775 -security thanks Hi. I've explicitly decided not to upgrade PAM for sarge. I had also decided when 0.77 came out that I didn't see a good reason to take it. Taking a new pam release is a painful process. That said, I'm looking for people to help with PAM.

Bug#300775: Pam: newer upstream version (0.78) available fixing security bugs

2005-03-21 Thread Javier Fernández-Sanguino Peña
Package: libpam-runtime Version: 0.76-22 Priority: serious Tags: security It seems we are missing some of upstream releases (0.77 was released in September 2002 and 0.78 was released in November 2004). Please package this new release: ftp://ftp.kernel.org/pub/linux/libs/pam/pre/library/ The