[SECURITY] [DSA 553-1] New getmail packages fix root compromise

2004-09-27 Thread Martin Schulze
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 - -- Debian Security Advisory DSA 553-1 [EMAIL PROTECTED] http://www.debian.org/security/ Martin Schulze September 27th, 2004

[SECURITY] [DSA 554-1] New sendmail packages fix potential open relay

2004-09-27 Thread Martin Schulze
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 - -- Debian Security Advisory DSA 554-1 [EMAIL PROTECTED] http://www.debian.org/security/ Martin Schulze September 27th, 2004

Re: [OT] Collective memory query

2004-09-27 Thread Mason Loring Bliss
On Mon, Sep 27, 2004 at 06:38:03PM +0200, Adrian 'Dagurashibanipal' von Bidder wrote: $ for foo in `command outputting a list of filenames` should *always* be replaced by $ said command | while read foo; do ... Hm. I like that better in general. Processing doesn't have to wait for the

Re: telnetd vulnerability from BUGTRAQ

2004-09-27 Thread Matt Zimmerman
On Mon, Sep 27, 2004 at 12:59:28PM +0100, Steve Kemp wrote: On Mon, Sep 27, 2004 at 01:17:47PM +0200, Milan Jurik wrote: Yes, it's time to look at the sources and find the truth. This appears to have been addressed by the patch in DSA-070-1, so you should be able to apply that to

Re: [OT] Collective memory query

2004-09-27 Thread Bernd Eckenfels
In article [EMAIL PROTECTED] you wrote: Alternately, with sed: ] sed -si.orig -e '...' `find . -name '...'` More safely, but with more forks: ] find . -name '...' -print0 | xargs -0 sed -si.orig -e '...' BTW: I dont see how xarg would do more forks than the shell? Because the above

Re: telnetd vulnerability from BUGTRAQ

2004-09-27 Thread Greg Folkert
On Mon, 2004-09-27 at 09:24 +0200, Dariush Pietrzak wrote: The point remains that while telnet/ftp should be treated as deprecated Why is that exactly? There is no replacement for ftp, and I don't know of any problems with it? Please enlighten me. ftp == good enough for public upload and

Re: telnetd vulnerability from BUGTRAQ

2004-09-27 Thread Jan Minar
On Mon, Sep 27, 2004 at 04:08:38PM -0400, Greg Folkert wrote: On Mon, 2004-09-27 at 09:24 +0200, Dariush Pietrzak wrote: The point remains that while telnet/ftp should be treated as deprecated Why is that exactly? There is no replacement for ftp, and I don't know of any problems with it?

Re: telnetd vulnerability from BUGTRAQ

2004-09-27 Thread Rick Moen
Quoting Jan Minar ([EMAIL PROTECTED]): Unfortunately, scp requires a shell access http://www.sublimation.org/scponly/ -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of unsubscribe. Trouble? Contact [EMAIL PROTECTED]

Re: telnetd vulnerability from BUGTRAQ

2004-09-27 Thread David Ramsden
On Mon, Sep 27, 2004 at 02:54:49PM -0700, Rick Moen wrote: Quoting Jan Minar ([EMAIL PROTECTED]): Unfortunately, scp requires a shell access http://www.sublimation.org/scponly/ I've been using scponly for a while now as a replacement for FTP. Never had any complaints or problems. I

Re: telnetd vulnerability from BUGTRAQ

2004-09-27 Thread Jan Minar
On Mon, Sep 27, 2004 at 02:54:49PM -0700, Rick Moen wrote: Quoting Jan Minar ([EMAIL PROTECTED]): Unfortunately, scp requires a shell access http://www.sublimation.org/scponly/ Of course, but this is even more non-standard then ssh proper, and a recent project, so no scponly in woody btw.

Re: [OT] Collective memory query

2004-09-27 Thread Daniel Pittman
On 28 Sep 2004, Bernd Eckenfels wrote: In article [EMAIL PROTECTED] you wrote: Alternately, with sed: ] sed -si.orig -e '...' `find . -name '...'` More safely, but with more forks: ] find . -name '...' -print0 | xargs -0 sed -si.orig -e '...' BTW: I dont see how xarg would do more forks

Re: [OT] Collective memory query

2004-09-27 Thread Bernd Eckenfels
In article [EMAIL PROTECTED] you wrote: Last time I read the xargs documentation it stated that using '\0' as an input separator would also tell it to pass at most one argument to the command. echo -en a\0b\0c | xargs -t -0 echo echo a b c a b c echo -en a\0b\0c | xargs -t -s 8 -0 echo echo

Re: telnetd vulnerability from BUGTRAQ

2004-09-27 Thread Milan Jurik
Hi, so, again, for some locked people. There is maybe an application in Debian which is remotely exploitable. This application will be probably also in the next stable release. This thread is about this situation. I (and some other people) use telnetd only in very specific situations where

[OT] Collective memory query

2004-09-27 Thread Dale Amon
A couple years ago I ran across a sed like program that will recursively descend through a tree and apply specified edits in place. I have searched my notes, gone through the deb available and have not been able to find it. Might just have been something on SourceForge... Has anyone else run

Re: [OT] Collective memory query

2004-09-27 Thread Simon Huggins
On Mon, Sep 27, 2004 at 12:48:03PM +0100, Dale Amon wrote: A couple years ago I ran across a sed like program that will recursively descend through a tree and apply specified edits in place. Has anyone else run across a program of this nature? This is probably more appropriate for -user but

Re: [OT] Collective memory query

2004-09-27 Thread Andrew McGlashan
Does this resemble what you want? http://www.cs.rit.edu/~hpb/Man/_Man_Local_html/html1/srwin.1.html Regards AndrewM Andrew McGlashan ADSL, Dialup, Satellite, ISDN and other enquiries: 1300 85 3804 Mobile: 04 2574 1827 Fax: 03 8790 1224 Affinity Vision Australia Pty Ltd

Re: [OT] Collective memory query

2004-09-27 Thread Andrew McGlashan
Sorry wrong link... I didn't look closely at it. Ughh. Andrew McGlashan wrote: Does this resemble what you want? http://www.cs.rit.edu/~hpb/Man/_Man_Local_html/html1/srwin.1.html Regards AndrewM Andrew McGlashan ADSL, Dialup, Satellite, ISDN and other enquiries: 1300 85 3804 Mobile: 04

Re: telnetd vulnerability from BUGTRAQ

2004-09-27 Thread Steve Kemp
On Mon, Sep 27, 2004 at 01:17:47PM +0200, Milan Jurik wrote: Yes, it's time to look at the sources and find the truth. This appears to have been addressed by the patch in DSA-070-1, so you should be able to apply that to current sources with a small amount of work. Although the

vulnerabilities in CVS?

2004-09-27 Thread Robert Millan
Hi! Are we affected by this? I haven't seen any DSA. On Mon, Sep 20, 2004 at 01:50:33PM +, FreeBSD Security Advisories wrote: -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 = FreeBSD-SA-04:14.cvs.asc

Re: [OT] Collective memory query

2004-09-27 Thread Andrew McGlashan
Try again: http://packages.debian.org/testing/utils/rpl Intelligent recursive search/replace utility Regards AndrewM Andrew McGlashan ADSL, Dialup, Satellite, ISDN and other enquiries: 1300 85 3804 Mobile: 04 2574 1827 Fax: 03 8790 1224 Affinity Vision Australia Pty Ltd

Re: [OT] Collective memory query

2004-09-27 Thread Brett Parker
On Mon, Sep 27, 2004 at 12:48:03PM +0100, Dale Amon wrote: A couple years ago I ran across a sed like program that will recursively descend through a tree and apply specified edits in place. I have searched my notes, gone through the deb available and have not been able to find it. Might just

Re: vulnerabilities in CVS?

2004-09-27 Thread Steve Kemp
On Sun, Sep 26, 2004 at 03:46:44PM +0200, Robert Millan wrote: CVE Name: CAN-2004-0414, CAN-2004-0416, CAN-2004-0417, CAN-2004-0418, CAN-2004-0778 CAN-2004-0416, CAN-2004-0417, and CAN-2004-0418 were fixed in DSA-519. CAN-2004-0414 was fixed in DSA-517. So it

Re: [OT] Collective memory query

2004-09-27 Thread Dale Amon
On Mon, Sep 27, 2004 at 10:04:00PM +1000, Andrew McGlashan wrote: Try again: http://packages.debian.org/testing/utils/rpl Intelligent recursive search/replace utility Thanks much. I do believe that is the one. *amon runs off to dselect yet again... --

Re: [OT] Collective memory query

2004-09-27 Thread Bartosz Fenski aka fEnIo
On Mon, Sep 27, 2004 at 01:07:40PM +0100, Simon Huggins wrote: On Mon, Sep 27, 2004 at 12:48:03PM +0100, Dale Amon wrote: A couple years ago I ran across a sed like program that will recursively descend through a tree and apply specified edits in place. Has anyone else run across a

Re: [OT] Collective memory query

2004-09-27 Thread Daniel Pittman
On 27 Sep 2004, Dale Amon wrote: A couple years ago I ran across a sed like program that will recursively descend through a tree and apply specified edits in place. I have searched my notes, gone through the deb available and have not been able to find it. Might just have been something on

Re: [OT] Collective memory query

2004-09-27 Thread Mason Loring Bliss
On Mon, Sep 27, 2004 at 12:48:03PM +0100, Dale Amon wrote: A couple years ago I ran across a sed like program that will recursively descend through a tree and apply specified edits in place. I have searched my notes, gone through the deb available and have not been able to find it. Might

Re: [OT] Collective memory query

2004-09-27 Thread Adrian 'Dagurashibanipal' von Bidder
On Monday 27 September 2004 16.28, Mason Loring Bliss wrote: for foo in `find . -name something` Note that $ for foo in `command outputting a list of filenames` should *always* be replaced by $ said command | while read foo; do ... (Or, for trivial cases, xargs) because the for loop will