G'day, The attached patch reduces the impact of a denial of service security vulnerability in versions of the Netrek Vanilla Server from 2.14.0 and prior. After receiving CP_SOCKET the server waits an excessive time with a slot allocated. This can lead to a denial of service. The patch reduces this time and allows it to be configured without rebuild. A reproducer is available and has been tested. Client impact: Netrek XP, should work as normal. COW on Linux, will need change from 199 to 99 seconds login timeout. See getname.c. -- James Cameron mailto:quozl at us.netrek.org http://quozl.netrek.org/ -------------- next part -------------- A non-text attachment was scrubbed... Name: netrek-server-vanilla-2.14.0-2008-06-27.patch Type: text/x-diff Size: 4264 bytes Desc: not available Url : http://mailman.us.netrek.org/pipermail/netrek-dev/attachments/20080627/3a6e6c1a/attachment-0001.patch -------------- next part -------------- A non-text attachment was scrubbed... Name: not available Type: application/pgp-signature Size: 189 bytes Desc: Digital signature Url : http://mailman.us.netrek.org/pipermail/netrek-dev/attachments/20080627/3a6e6c1a/attachment-0001.pgp