Re: [Fwd: freeswan & zlib security]

2002-09-17 Thread Dale Amon
On Tue, Sep 17, 2002 at 06:10:32PM +0200, Florian Weimer wrote: > Dale Amon <[EMAIL PROTECTED]> writes: > > > I chatted on the phone with Henry Spencer back when the > > zilb bug was first announced and he was of the opinion > > that in FS it would be almost impossible to exploit. So it's > > pro

Re: [Fwd: freeswan & zlib security]

2002-09-17 Thread Florian Weimer
Dale Amon <[EMAIL PROTECTED]> writes: > I chatted on the phone with Henry Spencer back when the > zilb bug was first announced and he was of the opinion > that in FS it would be almost impossible to exploit. So it's > probably something that should be fixed but is not a high > profile issue. Not

Re: [Fwd: freeswan & zlib security]

2002-09-17 Thread Dale Amon
On Tue, Sep 17, 2002 at 06:10:32PM +0200, Florian Weimer wrote: > Dale Amon <[EMAIL PROTECTED]> writes: > > > I chatted on the phone with Henry Spencer back when the > > zilb bug was first announced and he was of the opinion > > that in FS it would be almost impossible to exploit. So it's > > pr

Re: [Fwd: freeswan & zlib security]

2002-09-17 Thread Florian Weimer
Dale Amon <[EMAIL PROTECTED]> writes: > I chatted on the phone with Henry Spencer back when the > zilb bug was first announced and he was of the opinion > that in FS it would be almost impossible to exploit. So it's > probably something that should be fixed but is not a high > profile issue. Not

Re: [Fwd: freeswan & zlib security]

2002-09-17 Thread Dale Amon
On Tue, Sep 17, 2002 at 12:49:34AM -0300, Peter Cordes wrote: > IIRC, the problem with zlib was that it called free(3) an extra time, or > something like that, and glibc no longer allows that. Moving the ZFREE() > obviously changes the conditions required for it to be called, so this is > very pr

Re: [Fwd: freeswan & zlib security]

2002-09-17 Thread Dale Amon
On Tue, Sep 17, 2002 at 12:49:34AM -0300, Peter Cordes wrote: > IIRC, the problem with zlib was that it called free(3) an extra time, or > something like that, and glibc no longer allows that. Moving the ZFREE() > obviously changes the conditions required for it to be called, so this is > very p

Re: [Fwd: freeswan & zlib security]

2002-09-16 Thread Peter Cordes
On Mon, Sep 16, 2002 at 07:07:30PM +0200, Rene Mayrhofer wrote: > -BEGIN PGP SIGNED MESSAGE- > Hash: SHA1 > > Hi all, > > I have checked the source code of freeswan 1.98b and have noticed that > the second change (which is mentioned in the attached mail) is included > with this code. Howe

Re: [Fwd: freeswan & zlib security]

2002-09-16 Thread Rene Mayrhofer
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Phillip Hofmeister wrote: | Often changes get back-ported, have you read the changelog in /usr/doc/package/changloeg.Debian.gz? Yes. Sorry that I didn't mention it: I am the maintainer :) The question is if this would justify a security advisory. bes

Re: [Fwd: freeswan & zlib security]

2002-09-16 Thread Phillip Hofmeister
Often changes get back-ported, have you read the changelog in /usr/doc/package/changloeg.Debian.gz? Regards, -- Phil PGP/GPG Key: http://www.zionlth.org/~plhofmei/ wget -O - http://www.zionlth.org/~plhofmei/ | gpg --import XP Source Code: #include #include #include #include #include #in

[Fwd: freeswan & zlib security]

2002-09-16 Thread Rene Mayrhofer
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Hi all, I have checked the source code of freeswan 1.98b and have noticed that the second change (which is mentioned in the attached mail) is included with this code. However, in version 1.96 (which is currently in woody) this fix is not included. I