On Tue, Jun 12, 2001 at 11:45:34AM +0200, Foldi Tamas <crowat_private> is thought to have said: > Hi Bugtraqers, > > All of the downloadable versions are still buggy, and I can't understand > why does it recommend the main-main-developer to paste '%s' into the > source code. > > The following patch should work against this ugly format bug: > > --- accept.c.orig Tue Jun 12 11:33:01 2001 > +++ accept.c Tue Jun 12 11:33:38 2001 > @@ -2503,7 +2503,7 @@ > nothing on success. The function moan_smtp_batch() does not return - > it exits from the program with a non-zero return code. */ > > - else if (smtp_reply != NULL) moan_smtp_batch(NULL, smtp_reply); > + else if (smtp_reply != NULL) moan_smtp_batch(NULL, "%s", smtp_reply); > } > > /* Reset headers so that logging of rejects for a subsequent message > doesn't The author has stated on the exim-users mailing list that this is the correct patch to resolve this problem. It'll be rolled into the next release, 3.30, which is expected out shortly. > ><sarcasm> > >Why, thank you for letting Philip Hazel (who is on holiday right now) > >get a patched version out before announcing this to bugtraq. > ></sarcasm> > > At the moment, we know another 'ugly' bug in the exim main code, but > because of your tone it's not published. I can't understand, why do you > use this tone against people, who audits your shity code, which has some > errors in it. Gee. The original poster did not contact the author or the mailing list about the problem but instead went straight to bugtraq and security-l which runs counter to the widely used standards for vendor notification like RFPolicy. This, justifiably, upsets some of the users of Exim. Now you state you are aware of another problem in the Exim source but have not, and apparantly will not, tell anyone about it. I'm not sure what your agenda is but it's clear that it is not about helping to fix security bugs. If the code is so "shity", then I'd think you'd want to point out all of the ways in which it is lacking and submit patches to address those deficiencies. Tabor -- -------------------------------------------------------------------- Tabor J. Wells twellsat_private Fsck It! Just another victim of the ambient morality
This archive was generated by hypermail 2b30 : Wed Jun 13 2001 - 15:49:08 PDT