FreeBSD 7.1-RC1 Security Advisories
One day, you’re bouncing all over the place because there’s an official 7.1-RC1, the next, there’s already two security advisories.
To sum them up:
- protosw
safe to ignore unless you have local users, safe to ignore if you haven’t loaded / compiled in the ng_* modulesIndex: sys/kern/uipc_domain.c =================================================================== --- sys/kern/uipc_domain.c (revision 186366) +++ sys/kern/uipc_domain.c (working copy) @@ -112,13 +112,18 @@ #define DEFAULT(foo, bar) if ((foo) == NULL) (foo) = (bar) DEFAULT(pu->pru_accept, pru_accept_notsupp); + DEFAULT(pu->pru_bind, pru_bind_notsupp); DEFAULT(pu->pru_connect, pru_connect_notsupp); DEFAULT(pu->pru_connect2, pru_connect2_notsupp); DEFAULT(pu->pru_control, pru_control_notsupp); + DEFAULT(pu->pru_disconnect, pru_disconnect_notsupp); DEFAULT(pu->pru_listen, pru_listen_notsupp); + DEFAULT(pu->pru_peeraddr, pru_peeraddr_notsupp); DEFAULT(pu->pru_rcvd, pru_rcvd_notsupp); DEFAULT(pu->pru_rcvoob, pru_rcvoob_notsupp); DEFAULT(pu->pru_sense, pru_sense_null); + DEFAULT(pu->pru_shutdown, pru_shutdown_notsupp); + DEFAULT(pu->pru_sockaddr, pru_sockaddr_notsupp); DEFAULT(pu->pru_sosend, sosend_generic); DEFAULT(pu->pru_soreceive, soreceive_generic); DEFAULT(pu->pru_sopoll, sopoll_generic);
- ftpd
you can ignore it if you don’t run this ftp daemon, or if you have disabled ftp all together. Otherwise: patch it right the heck now!Index: libexec/ftpd/ftpcmd.y =================================================================== --- libexec/ftpd/ftpcmd.y (revision 185134) +++ libexec/ftpd/ftpcmd.y (working copy) @@ -1191,7 +1191,7 @@ /* * getline - a hacked up version of fgets to ignore TELNET escape codes. */ -char * +int getline(char *s, int n, FILE *iop) { int c; @@ -1207,7 +1207,7 @@ if (ftpdebug) syslog(LOG_DEBUG, "command: %s", s); tmpline[0] = '\0'; - return(s); + return(0); } if (c == 0) tmpline[0] = '\0'; @@ -1244,13 +1244,24 @@ } } *cs++ = c; - if (--n <= 0 || c == '\n') + if (--n <= 0) { + /* + * If command doesn't fit into buffer, discard the + * rest of the command and indicate truncation. + * This prevents the command to be split up into + * multiple commands. + */ + while (c != '\n' && (c = getc(iop)) != EOF) + ; + return (-2); + } + if (c == '\n') break; } got_eof: sigprocmask(SIG_SETMASK, &osset, NULL); if (c == EOF && cs == s) - return (NULL); + return (-1); *cs++ = '\0'; if (ftpdebug) { if (!guest && strncasecmp("pass ", s, 5) == 0) { @@ -1270,7 +1281,7 @@ syslog(LOG_DEBUG, "command: %.*s", len, s); } } - return (s); + return (0); } static void @@ -1300,9 +1311,14 @@ case CMD: (void) signal(SIGALRM, toolong); (void) alarm(timeout); - if (getline(cbuf, sizeof(cbuf)-1, stdin) == NULL) { + n = getline(cbuf, sizeof(cbuf)-1, stdin); + if (n == -1) { reply(221, "You could at least say goodbye."); dologout(0); + } else if (n == -2) { + reply(500, "Command too long."); + (void) alarm(0); + continue; } (void) alarm(0); #ifdef SETPROCTITLE Index: libexec/ftpd/extern.h =================================================================== --- libexec/ftpd/extern.h (revision 185134) +++ libexec/ftpd/extern.h (working copy) @@ -46,7 +46,7 @@ void ftpd_logwtmp(char *, char *, struct sockaddr *addr); int ftpd_pclose(FILE *); FILE *ftpd_popen(char *, char *); -char *getline(char *, int, FILE *); +int getline(char *, int, FILE *); void lreply(int, const char *, ...) __printflike(2, 3); void makedir(char *); void nack(char *); Index: libexec/ftpd/ftpd.c =================================================================== --- libexec/ftpd/ftpd.c (revision 185134) +++ libexec/ftpd/ftpd.c (working copy) @@ -2794,15 +2794,20 @@ myoob(void) { char *cp; + int ret; if (!transflag) { syslog(LOG_ERR, "Internal: myoob() while no transfer"); return (0); } cp = tmpline; - if (getline(cp, 7, stdin) == NULL) { + ret = getline(cp, 7, stdin); + if (ret == -1) { reply(221, "You could at least say goodbye."); dologout(0); + } else if (ret == -2) { + /* Ignore truncated command. */ + return (0); } upper(cp); if (strcmp(cp, "ABOR\r\n") == 0) {
I noticed that the -RC2 branch is in place too now. Almost there…. must … be … patient …
And FreeBSD 7.1-RC1 official
You got to love the way they write the release announcements:
“Gee. Did we really implement that new interface that way? That needs a bit more work.”
So, it’s now the last few legs of the release cycle, and I’m looking forward to it.
DO read the release announcement or /usr/src/UPDATING, specialy if you currently have a system that uses the em(4) driver (Intel E1000 NIC), it might change with this release, to igb(4).
gearing up for FreeBSD 7.1
We’re only a little bit removed from the next major FreeBSD release. The branch has been tagged, and the ports-tree is (thank God!) unfrozen once again. The first Release Candidate has hit the FTP servers.
I’ve been running -PRERELEASE for a while now, and haven’t found any problems so far, not on real-steal hardware, nor on vmware virtualized hardware.
Windows market share drops below 90%
Some historical firsts are quite newsworthy.
Net Applications reports that for the first time ever, Windows market share has dropped below 90%. According to sources, this is mainly because Mac OS X is grabbing a stronger footing in the global OS market with 8.87% share. Linux, the iPhone and the PS3 gain a bit too, while FreeBSD looses 0.01%.
Now mind you, these are digits from consumers visiting sites, there could be much more market share for Linux and FreeBSD, because there are many servers running those operating systems, and servers don’t tend to visit websites all that much. The same, off course, can be said for windows servers.
This is significant, Windows has always been the dominant party in the desktop user market, and seemingly, this is changing. This whole year, Windows has pretty much shown a slow but sure decent, with as much as 91.64% market share in April of this year down to less then 90% today.
Why is this important? Well, Microsoft has been under fire for years on end now, allegations and convictions for unfair business tactics and anti-competitive behavior have cost them billions in legal fees, fines and penalties. This is sure to spark a change within the ranks of Microsoft, where the old walls get broken down, and a new flag of cooperation is to be seen on the Redmond flagpole. Perhaps not so much because the end user is aware of the bad things Microsoft has been doing, but more because other vendors (like Apple) offer better user experience on the desktop. Even the 0.83% share for Linux can be seen as truth to that statement, with the rise of user friendly distributions like the many Ubuntu versions.
Another important factor is the fact that many businesses are adopting an anti-vendor-lock in policy, where they do not wish to be dependent on just one software vendor and their course.
Another key factor is the ‘Vista factor’. Enthusiasm from many people not withstanding, a lot of people have even been heard making the dreaded ‘ME’ comparison earlier. Quite a few of the kinks have been worked out since that initial release, but consumers have long memories, and businesses do not like the heavy hardware requirements Vista has.
I’m not quite opening the champagne bottle just yet, but I am getting rather optimistic about the downward trend for windows. It should spark inovation in the offices of Microsoft, and inovation is the key to all progress.
no such thing as a lucky break
Count your blessings, but what if there are none?
Yesterday, since it was a saturday and I have a large amount of spare time in the weekend, I decided to get busy on one of those things I never have the time to do during the week: laundry. (yay!).
So, I loaded up the washer, turned it on, and hopped in the shower. I take pretty long showers ( bite me, it’s the only time in the day I truly relax ), but even so I was kinda suspicious on how fast it hit the centrifuge programm…
*KALUNK!!!*
I pretty much hit the roof, I jumped so high (still in the shower). So I got out, towled off and started to look. It was still trying to centrifuge the load, but everytime it had to actually put in some effort there was a screaching noise and sometimes a big klunking sound which actually made the darn thing shift half a foot or so.
So, that’s either the bearings, or the gearbox that’s totaly shot to hell. I tried to do another test today, totaly empty (because maybe, just maybe, I didn’t pay attention and overloaded it a bit). The banging / klunking sound is gone now, but it still can’t get up to speed…. essentialy worthless because the wash comes out totaly soaking wet that way. (and no, I don’t have a dryer – always hangdry my laundry)
Yay, I was hoping to save some money and start doing something about my house, which is very empty and kinda eary now that Petra and Femke are gone. But it looks like I’m going to have to buy a new washer.
well, let’s hope that’s the last of the crap that goes wrong for 2008, and that 2009 will cut me a little more slack
Small update
Just a little update, since I’ve not been around for a while now.
A lot of changes in my life. As you know Petra and I where getting a divorce, and that was final in june. Then the waiting game started, because Petra needed a place of her own. Well, she and Femke moved out a couple of weeks ago, and my place is pretty empty now.
That’s pretty much it I guess, I’m still geeking around, making new friends (no, no new love yet) and getting used to really being single and alone.
Naturally I miss Femke, but I get to see her quite a lot thank goodness, she and Petra only live about a 7 minute walk from my place.
(which is really good, or I think I would have lost my sanity by now).
more to come, once I get my life back together.
message to stockholders and financial analysts
I would like to issue the follow message to stockholders and financial analysts:
stop messing up the economy even more!
Okay, pause, take a deep breath, go out into the woods if you have some nearby, or a walk in the park. Enjoy some clean air, the company of friends. Clear your mind of all your troubles.
Think about it, this whole financial crisis started as nothing more then a little breeze. But all that panic behavior and ‘doing what the other guy is doing’ is making that little breeze into a storm that would make an F-5 tornado cower in fear.
So, look around, take a good look at your portfolio, and think about it…. do you really wish to cause your economy more harm then it has already suffered at that hands of analysts. Look at those shares in your hand, do you want to harm the company that you hold little pieces of? I didn’t think so.
Investing and playing in the stock market isn’t a ‘get rich quick’ thing, it requires insight, it requires knowledge. But most of all: it requires long term vision.
So, buy some more shares, those companies won’t go away, they won’t dissapear. Your money won’t vaporize (unless you invest into an obscure company like SCO). Have faith in the very economy you once helped built. So, yeah, the banks messed up with stupid mortgages. Won’t happen again. They have learned, we all have. Shame for those who are loosing their home, terrible shame even. But the world will continue to turn, as it always has. Sounds cold, but it’s true. Eventually those people will be able to buy houses again too.
captcha image permission error in contact form 7
I found a little snag in the contact form 7 plugin for wordpress by Takayuki Miyoshi when using it in combination with suphp.
The plugin temporarily stores the captcha image in your uploads directory, and does so with permissions set to 0700, which makes sense security wise. When using it in combination with suphp though, the image can not be read by the webserver then, since the webserver runs under username ‘www’ (on FreeBSD 7.x at least), but any PHP scripts are run onder the username/userid of the website owner (which is not www).
Now, there’s two ways to fix this:
- Run the rest of the website (not just .php, but everything) with the username of the website owner, but that is not always an available option, doing suexec is pretty tricky at times.
- Patch the plugin so it stores ONLY the captcha image with 755 permissions. Security wise this should not have any implications what so ever.
I used option two:
captcha/captcha.php line: 78 (after imagedestroy($im); )
78 | chmod($this->tmp_dir . $filename,octdec(755)); |
Problem solved.
Iron Maiden – Assen
Yesterday ( August 16th): the day had come, a day I had been looking forward to for months: the Iron Maiden concert. The first concert ever on the well-known TT Circuit in Assen.
I would like to take the opportunity to thank my ex-wife Petra for the ticket, fantastic birthday present!
FTTB
All right, my best friend Jorrin and I left pretty early, part because we had to pick up two people (An English couple – Dave and Kate) at their hotel, and part because Jorrin (and that English couple as well) had competed and won in the ‘First to the Barrier’ competition at the fan-club. If you win in that competition you are one of 60 people (who can all take one friend along) who are the first to be let on to the concert grounds, before the main entrance opens, which naturally is a guarantee for a spot on the first barrier of the stage. Special bracelet on our wrists, and yeah! All the way up front, dead centre of stage. It did raise some eyebrows and a couple of questions from people who entered the normal way, since they where the first ones through the gates, they had not expected to see people in front of them. Some explanation later got the remark: “that is cool!”.
The Event
Lauren Harris
After a few hours of baking in the sun (the weather was – against all odds – beautiful that day) Lauren Harris kicked off the concert. The lady in question does not owe her record deal to daddy Steve Harris ( founder and bassist of Iron Maiden ). And admitted: she can definitely sing. Her band can definitely play too. But for some reason, those two combined just didn’t sound quite right. However, Lauren is only 24 years young, and everything has been going incredibly fast for her. So it is very likely we’ll be hearing a lot of interesting material from her for years to come. Unfortunately on this day, she didn’t seem able to get things warmed up with the audience of 27,000.
Kamelot
Wow! I had only heard of the band, but it stopped there. I had never even heard hem, or heard about them, so I was open to everything. (Just like with Lauren Harris by the way). The five gentleman and one lady blew me completely out of my boots though. Fiesty powermetal, amazing vocals of the singer (Roy Kahn) backed up by the guitarist and the (background) vocalette combined with a dazzling presence on stage. The audience clearly woke up, and fast. This band immediately earned it’s way to the top of my ‘buy this’ list. I can recommend this band to anyone who appreciates Iced Earth.
Within Temptation
The only band with a dutch home-base, and the gentlemen of Iron Maiden are fans of this band (or so rumor has it), and Within Temptation are Maiden fans. They put themselves up quite well, have podium presence and the performance is excellent. A little bit rougher then the studio albums and that’s something I appreciate. The only minor point is something Jorrin remarked, not without merit: their interaction with the audience was completely in Dutch, even though the day had attracted a large amount of foreign fans. English would have been better suited I think, but in all honesty: I can’t blame them, They are playing in The Netherlands, and most of the audience was dutch.
Iron Maiden
Somewhere between Kamelot and Within Temptation, someone had hit/struck/kicked my achilles tendon quite hard, and after hours of standing, it started to hurt a lot. So I knew I would not be enjoying the entire Iron Maiden concert from my rather perfect spot in front. Thankfully, 2 large screens next to the stage had been put up, and I had told myself to pick up 4 songs in front, and then find some quiet spot to enjoy the rest of the show. (I’m not one to like a crowd anyway). The show itself was exactly as one would expect from Iron Maiden: fantastic. Every song got enjoyed to the fullest, but I had to get away from that spot, walk around a bit, perhaps see if I could find some friends of whom I knew they where there as well. So when the band started ‘number of the beast’, I got myself out of the front arena, and grabbed something to eat and drink. All my friends had been swallowed up by the large mass of 27,000 Iron Maiden fans, so off course, I never found a single one of them. In the mean time, I enjoyed the show and music from a distance, and I admit, from a fair bit away it sounded even better then all the way up front. I recall the reaction of singer Bruce Dickinson on the return of his most famous call: “scream for me Assen”: “wow”. He was clearly stunned a bit by the tremendous roar that came back from all the fans. My vocal cords are still on strike since that day, but hey… it’s Maiden!
Prior to the concert, I had already bought a new Maiden shirt, and toward the end, when I was away from the front of the party, I got a bit chilly. So I quickly purchased a tour-shirt, with the print of Powerslave on it – the album that officially made me a metal and Iron Maiden fan.
Conclusion
This is how a concert is supposed to be. Well organized, well managed. Unfortunately: expensive! But, oh well, you need to give a bit for something like this. It was a party I will not forget for as long as I live, there in Assen, under a lunar eclipse on the TT circuit.
