I'm gaim

[Leonard den Ottolander]

Hi,

http://gaim.sourceforge.net/gaim-0.75.patch

Everybody being so tide up in testing "security enhanced" linux serious
vulnerabilties lay around unaddressed for weeks. What's up?

I won't repeat my complaints about mc as I know Jakub is away and a
patched version can at least be found in testing, but this gaim issue
has been around for 2 weeks and has not been addressed yet.

I had hoped Fedora would continue the good track record Red Hat has had
for years considering releasing security related patches, but I the last
few weeks I feel somewhat disappointed.

Bye,
Leonard.

-- 
mount -t life -o ro /dev/dna /genetic/research

[Ryan Nix]

Speaking of which, does this Gaim flaw affect all platforms (including 
Windows)?  Shouldn't having a firewall be enough?
Leonard den Ottolander wrote:

> Hi,
>
> http://gaim.sourceforge.net/gaim-0.75.patch
>
> Everybody being so tide up in testing "security enhanced" linux serious
> vulnerabilties lay around unaddressed for weeks. What's up?
>
> I won't repeat my complaints about mc as I know Jakub is away and a
> patched version can at least be found in testing, but this gaim issue
> has been around for 2 weeks and has not been addressed yet.
>
> I had hoped Fedora would continue the good track record Red Hat has had
> for years considering releasing security related patches, but I the last
> few weeks I feel somewhat disappointed.
>
> Bye,
> Leonard.
>
>   
>

[Leonard den Ottolander]

Hello Ryan,

>  Speaking of which, does this Gaim flaw affect all platforms
> (including 
>  Windows)? 
Dunno, possibly.

>    Shouldn't having a firewall be enough? 
What's the use of a firewall when you use an instant messenger? How are
you going to communicate with the outside world if your firewall blocks
the traffic? You could just as well uninstall gaim in that case.

Bye,
Leonard.

-- 
mount -t life -o ro /dev/dna /genetic/research

[Ryan Nix]

Hi Leonard,

I'm referring to blocking inbound traffic while using the vulnerable 
Gaim.  is it still a security hole if you are blocking in bound requests? 

Just curious.
Leonard den Ottolander wrote:

> Hello Ryan,
>
>   
>
> >Speaking of which, does this Gaim flaw affect all platforms (including 
> >Windows)?
> >    
> >
>
> Dunno, possibly.
>
>   
>
> >  Shouldn't having a firewall be enough?
> >    
> >
>
> What's the use of a firewall when you use an instant messenger? How are
> you going to communicate with the outside world if your firewall blocks
> the traffic? You could just as well uninstall gaim in that case.
>
> Bye,
> Leonard.
>
>   
>

[Bart Martens]

On Fri, 2004-02-06 at 01:14, Ryan Nix wrote:
>  I'm referring to blocking inbound traffic while using the
> vulnerable 
>  Gaim.  is it still a security hole if you are blocking in bound requests?  
The point is that security updates should be released and announced as
soon as possible. Compare the lists of rc9 and fc1:

https://rhn.redhat.com/errata/rh9-errata.html
http://fedoranews.org/updates/

[William Hooper]

Bart Martens said:
>  On Fri, 2004-02-06 at 01:14, Ryan Nix wrote:
> > I'm referring to blocking inbound traffic while using the vulnerable
> > Gaim.  is it still a security hole if you are blocking in bound
> > requests?
>
>  The point is that security updates should be released and announced as
>  soon as possible. Compare the lists of rc9 and fc1:
>
>  https://rhn.redhat.com/errata/rh9-errata.html
>  http://fedoranews.org/updates/ 
Did I just hear someone volunteer to maintain gaim?

It's a community supported OS, remember?

The bugzilla entry I see was just put in yesterday:
https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=114948

And is against the "devel" tree, not Core.

--
William Hooper

[Leonard den Ottolander]

Hello William,

>  It's a community supported OS, remember? 
Not entirely so, at least not for now. It is growing to be. But Red Hat
is still somewhat in charge of the infrastructure and development path,
and thus patch maintenance.

>  The bugzilla entry I see was just put in yesterday:
>  https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=114948 
You might want to check both the history for mc and gaim
(https://bugzilla.redhat.com/bugzilla/buglist.cgi?component=mc &
https://bugzilla.redhat.com/bugzilla/buglist.cgi?component=gaim ).

Now please explain to me why in both cases bugs where filed by the
Security Response Team, but these bug reports were not propagated to
Fedora Core.

Bye,
Leonard.

-- 
mount -t life -o ro /dev/dna /genetic/research

[Matthias Saou]

Leonard den Ottolander wrote :

>  http://gaim.sourceforge.net/gaim-0.75.patch
>  
>  Everybody being so tide up in testing "security enhanced" linux serious
>  vulnerabilties lay around unaddressed for weeks. What's up? 
If you're so concerned about this issue, you can always grab my gaim
package from http://yarrow.freshrpms.net/ as the latest build (2.fr)
includes this patch.

Matthias

-- 
Clean custom Red Hat Linux rpm packages : http://freshrpms.net/
Fedora Core release 1 (Yarrow) - Linux kernel 2.6.1-1.65
Load : 3.81 2.40 1.10