Re: Code updates

----- Original Message -----
From: "Mark Swanson" <[email protected]>
To: <[email protected]>
Sent: Tuesday, November 19, 2002 4:16 AM
Subject: Re: Code updates


> On November 18, 2002 07:56 pm, Alex Kramarov wrote:
> > Ok, i if we are really info gzip compression now, maybe this question
will
> > be finally answered (it was not for the last 2 times i asked about it,
so
> > this is the last attempt).
> >
> > The gzip compression code in tux dates back to 1999. the security
> > vurnerability in gzip library was discovered this year. Is the code used
by
> > tux includes any vurnerable code ?
>
> Perhaps no one wants to stick there neck out and say it is ok :-)
>
> I'm not going to say if it is ok or not, but I'll note a couple of things
> after a quick grep or two:
>
> 1. a grep of deflate *.c shows nothing but gzip.c
> 2. nothing seems to use any inflate keyword except gzip.c
>
> If you enable the compression proc entry, my understanding was that no
gzip.c
> code was used and that the .gz file (if present) would simply be sent
instead
> of the .html file. This makes sense as it would be best to run gzip
locally
> to compress all of your html/css/js files before serving them.
>
> If this guess is correct then there would be no vunerability because no
gzip
> code would execute. I am beginning to wonder what would happen if gzip.c
was
> deleted and you recompiled...

I was thinking alongg the same borders. Maybe i will try that.

>
>
> --
> Schedule your world with ScheduleWorld.com
> http://www.ScheduleWorld.com/
>
>
>
> _______________________________________________
> tux-list mailing list
> [email protected]
> https://listman.redhat.com/mailman/listinfo/tux-list
>