lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Fri, 26 Sep 2003 08:49:27 +0200
From: "Ralf S. Engelschall" <rse@...elschall.com>
To: Damien Miller <djm@...drot.org>
Cc: bugtraq@...urityfocus.com
Subject: Re: [OpenPKG-SA-2003.042] OpenPKG Security Advisory (openssh)


On Fri, Sep 26, 2003, Damien Miller wrote:

> >   vulnerable. OpenPKG installations are only affected if the package was
> >   built with option "with_pam" set to "yes" -- which is not the default.
>
> Incorrect. You mean "--with-pam" in ./configure (not default) or "UsePam
> yes" (default, before 3.7.1p2) in sshd_config.
>
> Neither of these options is called "use_pam".

Be careful, our advisory talks about the OpenPKG _package_ option
"with_pam", not the GNU autoconf option "--with-pam" of the contained
OpenSSH vendor source. OpenPKG source RPM packages provide "with_xxx"
options which can be set to "yes" or "no" on the command line during
package build ("rpm --rebuild --define 'with_pam yes' openssh*.src.rpm")
in order to build variants of binary RPMs.

If you look at http://cvs.openpkg.org/openpkg-src/openssh/openssh.spec,
you see that in the OpenSSH case the OpenPKG option "with_pam yes" is
mapped onto --with-pam on the GNU autoconf command line later.

                                       Ralf S. Engelschall
                                       rse@...elschall.com
                                       www.engelschall.com



Powered by blists - more mailing lists