[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <87odzuxgot.fsf@mid.deneb.enyo.de>
Date: Sun, 26 Mar 2006 00:12:02 +0100
From: Florian Weimer <fw@...eb.enyo.de>
To: Theo de Raadt <deraadt@....openbsd.org>
Cc: Martin Schulze <joey@...odrom.org>, bugtraq@...urityfocus.com
Subject: Re: SendGate: Sendmail Multiple Vulnerabilities (Race Condition DoS, Memory Jumps, Integer Overflow)
* Theo de Raadt:
> What if we ignore your procedures? What if we say no?
You won't be told about bugs in the code you write. It's as simple as
that.
But I don't quite understand why Gadi is so thoroughly offended by the
way how this vulnerability has been handled so far. The patches might
be obscure, but at least there are official patches for older
versions, too. And there is an official advisory. It could be far
worse. The programmers of a rather popular kernel do not publish
advisories at all, for instance.
Powered by blists - more mailing lists