Re: Patch/Build procedure fundamentals

[Ben Goren <ben@trumpetpower.com>]

On Tue, Sep 03, 2002 at 10:51:33AM -0500, Nick Gray wrote:

> The question is. I have updated  to the most recent patch branch
> today. My guess  would be  that I  am not  going to  have apache
> 1.3.26. So, do  install the  package for  it (assuming  there is
> one) or do I go to the Apache site and get the source code. What
> is considerd  the "correct" method  in BSD for a  situation like
> this.

Do nothing  more than  you have already  done. The vulnerabilities
have  been  patched  in  -STABLE. This  was  done  by  fixing  the
version of Apache  that shipped with the operating  system, not by
installing a whole new version of Apache.

If you visit

    http://www.trumpetpower.com/pub/

You'll see that  I'm running Apache/1.3.24 yet  I'm not vulnerable
(to this hole at least). That's because  I'm using -STABLE as of a
couple weeks ago.

Cheers,

b&

--
Ben Goren
 mailto:ben@trumpetpower.com
 http://www.trumpetpower.com/
 icbm:33o25'37"N_111o57'32"W

[demime 0.98d removed an attachment of type application/pgp-signature]