Re: [Openvpn-devel] rc9 and external commands

2008-08-21 Thread Matthias Andree
On Thu, 21 Aug 2008, Alberto Gonzalez Iniesta wrote: > It seems that tightening the security on OpenVPN brought some surprises > [1] to users and broke some features [2]. > > As for [1], I included a note in the Debian NEWS file on the new > --script-security option. But those updating a VPN usin

[Openvpn-devel] rc9 and external commands

2008-08-21 Thread Alberto Gonzalez Iniesta
Hi James, It seems that tightening the security on OpenVPN brought some surprises [1] to users and broke some features [2]. As for [1], I included a note in the Debian NEWS file on the new --script-security option. But those updating a VPN using the very same VPN (and without previous knowledge o

Re: [Openvpn-devel] Followup to CVE-2008-3459 fix

2008-08-21 Thread Peter Rabbitson
James Yonan wrote: > Peter Rabbitson wrote: >> >> Eventually the best way to deal with this is to test for >> ip_addr_dotted_quad_safe and is_special_addr, and then attempt a dns >> lookup on the string supplied for route. If anything comes back - use >> the result as the routed IPs. Otherwise war

Re: [Openvpn-devel] Followup to CVE-2008-3459 fix

2008-08-21 Thread James Yonan
Peter Rabbitson wrote: Hello, I would like to duplicate a concern about the proposed fix, voiced over at the debian BTS http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=493488#29, before the final version ships. = This fix breaks the follo