Re: 'Generic' Firewall Rulesets?

2000-11-13 Thread Scott Bigham
On Nov 13, 2000, Giacomo Mulas wrote: > [...] But there is a very nice user space tool available, named spf > (for "stateful packet filter") and available as a package for debian > unstable (woody), which can make your packet filter stateful. I've examined that package and it certainly looks inte

#76788: forced ssh agent/X forwarding vulnerability

2000-11-13 Thread Chuan-kai Lin
I just saw this in bugtraq this morning, and somebody already filed a bug against ssh. A patch is available against 2.2.0, so we probably need to backport it to 1.2.3. As it is heavily used among security- aware users, we need this one fixed soon. -- Chuan-kai Lin

Re: 'Generic' Firewall Rulesets?

2000-11-13 Thread Scott Bigham
On Nov 13, 2000, Giacomo Mulas wrote: > [...] But there is a very nice user space tool available, named spf > (for "stateful packet filter") and available as a package for debian > unstable (woody), which can make your packet filter stateful. I've examined that package and it certainly looks int

#76788: forced ssh agent/X forwarding vulnerability

2000-11-13 Thread Chuan-kai Lin
I just saw this in bugtraq this morning, and somebody already filed a bug against ssh. A patch is available against 2.2.0, so we probably need to backport it to 1.2.3. As it is heavily used among security- aware users, we need this one fixed soon. -- Chuan-kai Lin -- To UNSUBSCRIBE, email t

Re: 'Generic' Firewall Rulesets?

2000-11-13 Thread Stefan Hornburg
Giacomo Mulas <[EMAIL PROTECTED]> writes: [...] > This makes it a more powerful approach, even more unneeded rules can be > pruned, and the ruleset is again simpler and easier to understand and > maintain. But this implies running a 2.4.0-testX kernel, and I have had > mixed (very good and very

Re: Local root exploit with kmod and modutils > 2.1.121

2000-11-13 Thread Wichert Akkerman
Previously André Dahlqvist wrote: > Keith Owens, the author of modutils, just sent this security annoucement > to the linux-kernel mailing list: Looking into this I found some nice issues: 1. potato is not vulnerable 2. the patch from Keith is wrong I'll have fix for woody later today. Wichert.

Re: 'Generic' Firewall Rulesets?

2000-11-13 Thread Stefan Hornburg
Giacomo Mulas <[EMAIL PROTECTED]> writes: [...] > This makes it a more powerful approach, even more unneeded rules can be > pruned, and the ruleset is again simpler and easier to understand and > maintain. But this implies running a 2.4.0-testX kernel, and I have had > mixed (very good and very

debian

2000-11-13 Thread Sovichea VANNY
je ne veux plus recevoir de mail concernant debian unsubscription __ Boîte aux lettres - Caramail - http://www.caramail.com

Re: Local root exploit with kmod and modutils > 2.1.121

2000-11-13 Thread Wichert Akkerman
Previously André Dahlqvist wrote: > Keith Owens, the author of modutils, just sent this security annoucement > to the linux-kernel mailing list: Looking into this I found some nice issues: 1. potato is not vulnerable 2. the patch from Keith is wrong I'll have fix for woody later today. Wichert.

debian

2000-11-13 Thread Sovichea VANNY
je ne veux plus recevoir de mail concernant debian unsubscription __ Boîte aux lettres - Caramail - http://www.caramail.com

cfingerd: broken get_localhost, security implications

2000-11-13 Thread Thomas Gebhardt
Package: cfingerd Version: 1.4.1-1 Hi, about five weeks ago, I sent this report to [EMAIL PROTECTED] and the package maintainer but got no response yet. So I'll submit it to the public BTS. The get_localhost (util.c) function of cfingerd is broken: gethostname((char *) hostname, (size_t) 8

cfingerd: broken get_localhost, security implications

2000-11-13 Thread Thomas Gebhardt
Package: cfingerd Version: 1.4.1-1 Hi, about five weeks ago, I sent this report to [EMAIL PROTECTED] and the package maintainer but got no response yet. So I'll submit it to the public BTS. The get_localhost (util.c) function of cfingerd is broken: gethostname((char *) hostname, (size_t)

Re: 'Generic' Firewall Rulesets?

2000-11-13 Thread Giacomo Mulas
Yes, ipchains rulesets are stateless. But there is a very nice user space tool available, named spf (for "stateful packet filter") and available as a package for debian unstable (woody), which can make your packet filter stateful. The package can be easily recompiled for the stable (potato) distrib

Re: 'Generic' Firewall Rulesets?

2000-11-13 Thread Giacomo Mulas
Yes, ipchains rulesets are stateless. But there is a very nice user space tool available, named spf (for "stateful packet filter") and available as a package for debian unstable (woody), which can make your packet filter stateful. The package can be easily recompiled for the stable (potato) distri