Re: mgetty vulnerable

2003-05-02 Thread Drew Scott Daniels
On Fri, 2 May 2003, Wolfgang Sourdeau wrote: > I am not subscribed to debian-security, so please include me in your Cc: > for this discussion. > Likewise. > I have noticed a "fax" user was expected in mgetty-1.1.30 (never played > with 1.1.29). The problem I have with that is that this user is req

Re: mgetty vulnerable

2003-05-02 Thread Wolfgang Sourdeau
Hi, I am not subscribed to debian-security, so please include me in your Cc: for this discussion. I have noticed a "fax" user was expected in mgetty-1.1.30 (never played with 1.1.29). The problem I have with that is that this user is required at build time (during the make install phase). Anoth

Re: mgetty vulnerable?

2003-05-02 Thread Andreas Barth
* Drew Scott Daniels ([EMAIL PROTECTED]) [030502 01:20]: > [...] There is as far as I can see (only) one important security enhancement in the newer mgettys, and this is running the fax-out-scripts not as root. There is no proof that the old mgettys are vulnerable, but it's never a good idea to ru

mgetty vulnerable?

2003-05-01 Thread Drew Scott Daniels
I don't know whether potato, woody, sarge and sid should have a security bug filed against them. According to http://packages.qa.debian.org/m/mgetty.html sid has version 1.1.30-1, sarge has version 1.1.28-5, and woody has version 1.1.27-4.1. Note that Debian packages contain changes. I have not lo