Re: Tracing binaries statically linked against vulnerable libs

2006-10-14 Thread Andrew Pantyukhin
On 10/14/06, Simon L. Nielsen <[EMAIL PROTECTED]> wrote: On 2006.10.14 08:11:56 -0400, Michael Johnson wrote: > On 10/13/06, Kris Kennaway <[EMAIL PROTECTED]> wrote: > >On Fri, Oct 13, 2006 at 05:18:57PM +0400, Andrew Pantyukhin wrote: > >> On 10/7/06, Kris Kennaway <[EMAIL PROTECTED]> wrote: > >

Re: Tracing binaries statically linked against vulnerable libs

2006-10-14 Thread Simon L. Nielsen
On 2006.10.14 08:11:56 -0400, Michael Johnson wrote: > On 10/13/06, Kris Kennaway <[EMAIL PROTECTED]> wrote: > >On Fri, Oct 13, 2006 at 05:18:57PM +0400, Andrew Pantyukhin wrote: > >> On 10/7/06, Kris Kennaway <[EMAIL PROTECTED]> wrote: > >> >On Fri, Oct 06, 2006 at 09:35:31AM +0400, Andrew Pantyuk

Re: Tracing binaries statically linked against vulnerable libs

2006-10-14 Thread Michael Johnson
On 10/13/06, Kris Kennaway <[EMAIL PROTECTED]> wrote: On Fri, Oct 13, 2006 at 05:18:57PM +0400, Andrew Pantyukhin wrote: > On 10/7/06, Kris Kennaway <[EMAIL PROTECTED]> wrote: > >On Fri, Oct 06, 2006 at 09:35:31AM +0400, Andrew Pantyukhin wrote: > >> I wonder if there is a way to deal with static

Re: Tracing binaries statically linked against vulnerable libs

2006-10-14 Thread Andrew Pantyukhin
On 10/14/06, Kris Kennaway <[EMAIL PROTECTED]> wrote: On Fri, Oct 13, 2006 at 05:18:57PM +0400, Andrew Pantyukhin wrote: > Anyway, maybe portmgr could issue some kind of a policy > about this. I.e. (1) use {build,run}_depends instead of lib_ > when you depend on a port providing both shared and >

Re: Tracing binaries statically linked against vulnerable libs

2006-10-13 Thread Kris Kennaway
On Fri, Oct 13, 2006 at 05:18:57PM +0400, Andrew Pantyukhin wrote: > On 10/7/06, Kris Kennaway <[EMAIL PROTECTED]> wrote: > >On Fri, Oct 06, 2006 at 09:35:31AM +0400, Andrew Pantyukhin wrote: > >> I wonder if there is a way to deal with statically linked binaries, > >> which use vulnerable librarie

Re: Tracing binaries statically linked against vulnerable libs

2006-10-13 Thread Andrew Pantyukhin
On 10/7/06, Kris Kennaway <[EMAIL PROTECTED]> wrote: On Fri, Oct 06, 2006 at 09:35:31AM +0400, Andrew Pantyukhin wrote: > I wonder if there is a way to deal with statically linked binaries, > which use vulnerable libraries. The best way is to track them down and force them all to link dynamicall

Re: Tracing binaries statically linked against vulnerable libs

2006-10-06 Thread Kris Kennaway
On Fri, Oct 06, 2006 at 09:35:31AM +0400, Andrew Pantyukhin wrote: > I wonder if there is a way to deal with statically linked binaries, > which use vulnerable libraries. The best way is to track them down and force them all to link dynamically; static linking is a PITA from a systems management p

Re: Tracing binaries statically linked against vulnerable libs

2006-10-06 Thread Remko Lodder
Hello, The thing I would do with known applications that are linked statically to a vulnerable version of ${Application} is bumping the version of the port. Why do i do that? If ffmpeg in this case is being updated and the PORTREVISION of gstreamer as well, people get informed that they should up

Tracing binaries statically linked against vulnerable libs

2006-10-05 Thread Andrew Pantyukhin
I wonder if there is a way to deal with statically linked binaries, which use vulnerable libraries. There's this advisory: http://www.vuxml.org/freebsd/964161cd-6715-11da-99f6-00123ffe8333.html But mplayer and libxine are linked statically against ffmpeg, as are reportedly many other apps like g