lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Fri, 26 Sep 2003 08:49:27 +0200 From: "Ralf S. Engelschall" <rse@...elschall.com> To: Damien Miller <djm@...drot.org> Cc: bugtraq@...urityfocus.com Subject: Re: [OpenPKG-SA-2003.042] OpenPKG Security Advisory (openssh) On Fri, Sep 26, 2003, Damien Miller wrote: > > vulnerable. OpenPKG installations are only affected if the package was > > built with option "with_pam" set to "yes" -- which is not the default. > > Incorrect. You mean "--with-pam" in ./configure (not default) or "UsePam > yes" (default, before 3.7.1p2) in sshd_config. > > Neither of these options is called "use_pam". Be careful, our advisory talks about the OpenPKG _package_ option "with_pam", not the GNU autoconf option "--with-pam" of the contained OpenSSH vendor source. OpenPKG source RPM packages provide "with_xxx" options which can be set to "yes" or "no" on the command line during package build ("rpm --rebuild --define 'with_pam yes' openssh*.src.rpm") in order to build variants of binary RPMs. If you look at http://cvs.openpkg.org/openpkg-src/openssh/openssh.spec, you see that in the OpenSSH case the OpenPKG option "with_pam yes" is mapped onto --with-pam on the GNU autoconf command line later. Ralf S. Engelschall rse@...elschall.com www.engelschall.com
Powered by blists - more mailing lists