Mailing List Archive: 49091 messages
  • Home
  • Script library
  • AltME Archive
  • Mailing list
  • Articles Index
  • Site search
 

Ann: Rugby major security update

 [1/10] from: koopmans::itr::ing::nl at: 4-Feb-2002 9:45


All, The bug Romano described in his email this weekend has been fixed in Rugby version 4.3.1 This very nasty bug would allow anyone who studied the Rugby message format to execute aribitrary code on the server due to a 'do' instead of a 'load' in the function that decompresses the molded message. I urge everyone to upgrade ASAP, as using versions earlier than 4.3.1 will make you very vulnerable. Many thanks to Romano for exposing this bug and providing the sample code. The new version is available at: http://www.rebolforces.com/~erebol/download.htm The mirror at www.vrijheid.net will be updated later. --Maarten

 [2/10] from: rebol665:ifrance at: 4-Feb-2002 10:19


Hi Maarten I am using rugby XPi beta 1 . Do I need to download this update ? Patrick

 [3/10] from: koopmans:itr:ing:nl at: 4-Feb-2002 10:36


Yes! Alternatively, you can search for the func decompose-msg in the rugby-server object. In the line: return do decompress do trim/all .... change the two do's to load --Maarten

 [4/10] from: brett:codeconscious at: 4-Feb-2002 21:01


Hi Maarten,
> change the two do's to load
I don't know enough about the script to answer this question... Is there no possibility of a valid Rebol header being given to one of these LOADs? If there is, remember that the header *is* evaluated by LOAD. It is not evaluated if you use LOAD/ALL. BTW, did you get my latest documention I sent via email? Regards, Brett

 [5/10] from: m:koopmans2:chello:nl at: 4-Feb-2002 11:17


I haven't received the last docs :-( I use load to convert a string -> binary. The thing is that load/all returns a block, which is not what I want. But you are right. I will put out a version with load/all today (version 4.3.2) --Maarten

 [6/10] from: g:santilli:tiscalinet:it at: 4-Feb-2002 11:24


Hello Maarten! On 04-Feb-02, you wrote: M> change the two do's to load Maybe you'll want to use LOAD/ALL, since LOAD still has a hole:
>> load {REBOL [print "I can do anything."]}
I can do anything. == [ ] Regards, Gabriele. -- Gabriele Santilli <[giesse--writeme--com]> - Amigan - REBOL programmer Amiga Group Italia sez. L'Aquila -- http://www.amyresource.it/AGI/

 [7/10] from: koopmans:itr:ing:nl at: 5-Feb-2002 8:18


Hi Gabriele! I did another update already (4.3.2) on rebolforces that uses load/all Thanks! --Maarten

 [8/10] from: brett:codeconscious at: 6-Feb-2002 0:03


Hi Maarten,
> I haven't received the last docs :-(
I have sent you a number of emails now, maybe they are being eaten by something between you and me. Brett.

 [9/10] from: koopmans:itr:ing:nl at: 5-Feb-2002 14:36


Hi Brett, I have seen two emails in my webmail yesterday, and answered them via webmail. Guess outgoing webmail is not working :( Anyway, I have seen the mail and I thought that they were the ones on codeconscious? Which I really like.... --Maarten On Tuesday 05 February 2002 14:03, you wrote:

 [10/10] from: brett:codeconscious at: 6-Feb-2002 1:08


Hi Maarten,
> I have seen two emails in my webmail yesterday, and answered them via
webmail.
> Guess outgoing webmail is not working :( > > Anyway, I have seen the mail and I thought that they were the ones on > codeconscious? Which I really like.... > > --Maarten
Yep, same. I'm glad you approve. Pity about your webmail. Thanks for the reply. Brett.