|
|
BugTraq
[OpenPKG-SA-2003.042] OpenPKG Security Advisory (openssh) Sep 24 2003 11:28AM OpenPKG (openpkg openpkg org) (1 replies) Re: [OpenPKG-SA-2003.042] OpenPKG Security Advisory (openssh) Sep 25 2003 02:55PM Damien Miller (djm mindrot org) (1 replies) |
|
Privacy Statement |
> > vulnerable. OpenPKG installations are only affected if the package was
> > built with option "with_pam" set to "yes" -- which is not the default.
>
> Incorrect. You mean "--with-pam" in ./configure (not default) or "UsePam
> yes" (default, before 3.7.1p2) in sshd_config.
>
> Neither of these options is called "use_pam".
Be careful, our advisory talks about the OpenPKG _package_ option
"with_pam", not the GNU autoconf option "--with-pam" of the contained
OpenSSH vendor source. OpenPKG source RPM packages provide "with_xxx"
options which can be set to "yes" or "no" on the command line during
package build ("rpm --rebuild --define 'with_pam yes' openssh*.src.rpm")
in order to build variants of binary RPMs.
If you look at http://cvs.openpkg.org/openpkg-src/openssh/openssh.spec,
you see that in the OpenSSH case the OpenPKG option "with_pam yes" is
mapped onto --with-pam on the GNU autoconf command line later.
Ralf S. Engelschall
rse (at) engelschall (dot) com [email concealed]
www.engelschall.com
[ reply ]