[22339] in Kerberos
Re: MITKRB5-SA-2004-002: double-free vulnerabilities
daemon@ATHENA.MIT.EDU (Mike Friedman)
Wed Sep 1 13:09:01 2004
Date: Wed, 1 Sep 2004 10:06:49 -0700 (PDT)
From: Mike Friedman <mikef@ack.berkeley.edu>
To: Andreas <andreas@conectiva.com.br>
In-Reply-To: <20040901164419.GA9998@conectiva.com.br>
Message-ID: <Pine.GSO.4.58.0409011002450.27963@ack.Berkeley.EDU>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
cc: kerberos@mit.edu
Errors-To: kerberos-bounces@mit.edu
On Wed, 1 Sep 2004 at 13:44 (-0300), Andreas wrote:
> On Wed, Sep 01, 2004 at 08:19:33AM -0700, Mike Friedman wrote:
>>> 2004-002-patch_1.2.7.txt
>>> ========================
>>>
>>> http://web.mit.edu/kerberos/advisories/2004-002-patch_1.2.7.txt
>>>
>>> The associated detached PGP signature is at:
>>>
>>> http://web.mit.edu/kerberos/advisories/2004-002-patch_1.2.7.txt.asc
>>
>> I find that the PGP signature doesn't verify. Is anyone else having
>> this problem?
>
> Just downloaded both with wget and the signature checks out OK for me.
Hmm. I just installed wget and then downloaded the 1.3.4 version of the
patch (which I've decided to use instead of 1.2.7). The signature still
doesn't verify! In fact, the file I downloaded with wget is identical to
the one I downloaded using 'lynx -source'.
I have no trouble verifying the asn1 (MITKRB5-SA-2004-003) patch with PGP.
Why can't I get -002 to verify?
Any other ideas? I'm doing this on Solaris 8, using PGP 6.5.8.
Thanks.
Mike
------------------------------------------------------------------------------
Mike Friedman System and Network Security
mikef@ack.Berkeley.EDU 2484 Shattuck Avenue
1-510-642-1410 University of California at Berkeley
http://ack.Berkeley.EDU/~mikef http://security.berkeley.edu
------------------------------------------------------------------------------
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
