FORBIDDEN ports scheduled for removal

[Kris Kennaway]

On Fri, Mar 28, 2003 at 12:30:25PM +1030, Greg 'groggy' Lehey wrote:

> OK, found it at http://www.securityfocus.com/bid/5808.  Discussion
> says:
> 
>   gv is a freely available, open source Portable Document Format (PDF)
>   and PostScript (PS) viewing utility. It is available for Unix and
>   Linux operating systems.
> 
>   It has been reported that an insecure sscanf() function exists in
>   gv. Due to this function, an attacker may be able to put malicious
>   code in the %%PageOrder: portion of a file. When this malicious file
>   is opened with gv, the code would be executed in the security
>   context of the local user.
> 
> Note that this refers to gv, not ghostview.  It's also incorrect with
> ghostview 1.5.  The binary doesn't contain a sscanf() function.  I've
> tried the exploit, and it didn't work.  I'll check further, but I
> think this one can be allowed again.

Seems reasonable.  It looks like sobomax marked this port FORBIDDEN by
mistake.

Kris
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 187 bytes
Desc: not available
Url : http://lists.freebsd.org/pipermail/freebsd-ports/attachments/20030328/ad33cef3/attachment.bin