-----BEGIN PGP SIGNED MESSAGE-----

Hash: SHA1
=============================================================================

FreeBSD-SA-09:17.freebsd-update                             Security Advisory

                                                          The FreeBSD Project
Topic:          Inappropriate directory permissions in freebsd-update(8)
Category:       core

Module:         usr.sbin

Announced:      2009-12-03

Credits:        KAMADA Ken'ichi

Affects:        All supported versions of FreeBSD.

Corrected:      2009-12-03 09:18:40 UTC (RELENG_8, 8.0-STABLE)

                2009-12-03 09:18:40 UTC (RELENG_8_0, 8.0-RELEASE-p1)

                2009-12-03 09:18:40 UTC (RELENG_7, 7.2-STABLE)

                2009-12-03 09:18:40 UTC (RELENG_7_2, 7.2-RELEASE-p5)

                2009-12-03 09:18:40 UTC (RELENG_7_1, 7.1-RELEASE-p9)

                2009-12-03 09:18:40 UTC (RELENG_6, 6.4-STABLE)

                2009-12-03 09:18:40 UTC (RELENG_6_4, 6.4-RELEASE-p8)

                2009-12-03 09:18:40 UTC (RELENG_6_3, 6.3-RELEASE-p14)
For general information regarding FreeBSD Security Advisories,

including descriptions of the fields above, security branches, and the

following sections, please visit <URL:http://security.FreeBSD.org/>.
I.   Background
The freebsd-update(8) utility is used to fetch, install, and rollback

updates to the FreeBSD base system, and also to upgrade from one FreeBSD

release to another.
II.  Problem Description
When downloading updates to FreeBSD via 'freebsd-update fetch' or

'freebsd-update upgrade', the freebsd-update(8) utility copies currently

installed files into its working directory (/var/db/freebsd-update by

default) both for the purpose of merging changes to configuration files

and in order to be able to roll back installed updates.
The default working directory used by freebsd-update(8) is normally

created during the installation of FreeBSD with permissions which allow

all local users to see its contents, and freebsd-update(8) doe...
[ message continues ]

Hello world!\n
Like every year, FOSDEM is taking place in Brussels, Belgium the last weekend

of February (23 & 24).  This year will be the eighth edition of the Free and

Open Source software Developers' European Meeting, one of the largest and most

technical open source confereces in Europe.  Attendance is completely free:
  <http://www.fosdem.org/>
For the first time, this year there will be a joint 'developer room' for the

various BSD projects and PostgreSQL coordinated by Daniel Seuffert.  A

tentative schedule for the devroom is at the bottom of this mostly-German

wikipage:
  <https://www.bsdwiki.de/FOSDEM_2007>.
As you can see, there are still some blank spots.  If you're coming to FOSDEM

(of course you are!) please consider contacting <ds@freebsd.org> and giving a

talk about an interesting FreeBSD-related project.
If you're not coming to FOSDEM, perhaps I can change your mind by mentioning

the annual FOSDEM beer event.  This year, the event will take place in a much

larger bar with a much larger selection of beers than previous years:
  <http://www.fosdem.org/2008/beerevent>
We all know that the 'B' in BSD is for 'beer' ... and who knows what the 'S'

and the 'D' might come to mean after a number of Belgian 'B'. :-)
See you in Brussels?
 - Philip
--

Philip Paeps                     Calm down ... it is only ones and zeros

philip@freebsd.org

_______________________________________________

freebsd-announce@freebsd.org mailing list

http://lists.freebsd.org/mailman/listinfo/freebsd-announce

To unsubscribe, send any mail to "freebsd-announce-unsubscribe@freebsd.org"

The FreeBSD Release Engineering Team is pleased to announce the availability

of FreeBSD 7.1-RELEASE.  This is the second release from the 7-STABLE branch

which improves on the functionality of FreeBSD 7.0 and introduces some

new features.  Some of the highlights:
	- The ULE scheduler is now the default in GENERIC kernels for

	  amd64 and i386 architectures.  The ULE scheduler significantly

	  improves performance on multicore systems for many workloads.

	- Support for using DTrace inside the kernel has been imported

	  from OpenSolaris.  DTrace is a comprehensive dynamic tracing

	  framework.

	- A new and much-improved NFS Lock Manager (NLM) client.

	- Boot loader changes allow, among other things, booting from

	  USB devices and booting from GPT-labeled devices.

	- The cpuset(2) system call and cpuset(1) command have been added,

	  providing an API for thread to CPU binding and CPU resource

	  grouping and assignment.

	- KDE updated to 3.5.10, GNOME updated to 2.22.3.

	- DVD-sized media for the amd64 and i386 architectures
For a complete list of new features and known problems, please see the

online release notes and errata list, available at:
    http://www.FreeBSD.org/releases/7.1R/relnotes.html

    http://www.FreeBSD.org/releases/7.1R/errata.html
For more information about FreeBSD release engineering activities,

please see:
    http://www.FreeBSD.org/releng/
 Availability

 -------------
FreeBSD 7.1-RELEASE is now available for the amd64, i386, ia64, pc98,

powerpc, and sparc64 architectures.
FreeBSD 7.1 can be installed from bootable ISO images or over the network;

the required files can be downloaded via FTP or BitTorrent as described in

the sections below.  While some of the smaller FTP mirrors may not carry all

architectures, they will all generally contain the more common ones, such as

i386 and amd64.
MD5 and SHA256 hashes for the release ISO images are included at the

bottom of this message.
The purpose of the ISO images provided as part of the rel...
[ message continues ]

Dear FreeBSD Community,
I am pleased to announce the publication of the FreeBSD Foundation's

Semi-Annual August Newsletter. Go to

http://www.freebsdfoundation.org/press/2007Aug-newsletter.shtml

to find out what we've been doing to help the FreeBSD project and community.
Thank You,
Deb Goodkin

The FreeBSD Foundation

_______________________________________________

freebsd-announce@freebsd.org mailing list

http://lists.freebsd.org/mailman/listinfo/freebsd-announce

To unsubscribe, send any mail to "freebsd-announce-unsubscribe@freebsd.org"