看板FB_security
标 题Re: old perl vulnerabilitiy
发信站NCTU CS FreeBSD Server (Fri Mar 15 17:54:55 2013)
转信站ptt!csnews.cs.nctu!news.cs.nctu!.cs.nctucs.nctu!!freebsdfreebsd.org!ow
On (03/15/13 17:30),
[email protected] wrote:
>Hello Freebsd-security,
>
>I've got portaudit alarm on perl-5.8.9_7 with regard to
>
>perl -- denial of service via algorithmic complexity attack on hashing routines.
>Reference:
http://portaudit.FreeBSD.org/68c1f75b-8824-11e2-9996-c48508086173.html
>
>But on the other server I have perl-threaded-5.8.9_7
>and portaudit thinks that it is OK (no problem)
>
>Is it correct?
>It seems to me that threaded perl also should have the same problem.
>
It does have the same issue. I've corrected the VuXML entry and you
should see updated portaudit results within 30 minutes. Your 5.8.9
perl-threaded installation should also show up as vulnerable to the same
issue.
Thanks!
-r
>Please advise.
>
>PS. I know that it is old and "unsupported" but I don't want to
> upgrade without serious reason. And, any way, the "behavior" of
> portaudit seems to me not correct.
>
>
>With best regards,
>Alexandre Krasnov.
>
>
>_______________________________________________
>
[email protected] mailing list
>
http://lists.freebsd.org/mailman/listinfo/freebsd-security
>To unsubscribe, send any mail to "
[email protected]"
--
Ryan Steinmetz
PGP: EF36 D45A 5CA9 28B1 A550 18CD A43C D111 7AD7 FAF2
_______________________________________________
[email protected] mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-security
To unsubscribe, send any mail to "
[email protected]"