I updated the screen bug with a RedHat 8.0 package. I added rh80 to the keywords. I had to add the autoconf213 to the BuildRequires line. I am working on the ethereal packages based on the RedHat 9 release. -- Christian Pearce http://www.commnav.com "Christian Pearce" said: > > Jason claimed testing the vulnerability was not trivial. I am not certain. We can come up with RedHat 8 packages. I can put one together right now. > > -- > Christian Pearce > http://www.commnav.com > > > > Jesse Keating said: > > > > On Tuesday 06 January 2004 20:22, Jason wrote: > > > The 7.3 rpms work for me.. I don't have a 7.2 box available to test > > > that one. > > > > > > The default in 7.3 is to not suid the screen binary, so I think we're > > > safe from privilege escalation (unless the user does it of their own > > > volition). But, I am a bit concerned with the idea that someone > > > could hijack my screen session. So, is this a patch we want to push? > > > If so, we should patch the RH8 rpms as well. RH hasn't yet released > > > a patch for 9, though it has a vulnerable version. > > > > Since I use screen daily on a 7.3 box, this is a fairly important one to > > me. I'd like to see it fixed for 8 as well. Hopefully I'll have a 7.2 > > box up to test tonight although it may have to wait for a harddrive ): > > > > Do you have a way of testing the overflow, or are we just testing > > functionality of screen once this patch is added? > > > > -- > > Jesse Keating RHCE MCSE (geek.j2solutions.net) > > Fedora Legacy Team (www.fedora.us/wiki/FedoraLegacy) > > Mondo DevTeam (www.mondorescue.org) > > GPG Public Key (geek.j2solutions.net/jkeating.j2solutions.pub) > > > > Was I helpful? Let others know: > > http://svcs.affero.net/rm.php?r=jkeating > > > -- > > fedora-legacy-list@xxxxxxxxxx > http://www.redhat.com/mailman/listinfo/fedora-legacy-list >
