Re: [hylafax-users] Ghostscript vulnerability

[Uwe Dippel <udippel@xxxxxxxxx>]

Lee Howard wrote:
> The vulnerability for HylaFAX deployments is mitigated by the amount 
> of trust in the allowed fax senders.  If your sender pool is quite 
> restricted and well-trusted then your exposure is quite limited.  If 
> your sender pool is quite open and untrusted (i.e. TPC cells) then you 
> may be at greater risk.

Howard, If I am not mistaken, some are completely protected: 
Receive-Only installs cannot be overrun.
Actually, since it is a buffer overflow in ghostscript for incoming .ps 
files, *any* install / setup, in which users cannot deliver PostScript 
files to hylafax are save. (Most can, though, I guess.)

Uwe




____________________ HylaFAX(tm) Users Mailing List _______________________
 To subscribe/unsubscribe, click http://lists.hylafax.org/cgi-bin/lsg2.cgi
On UNIX: mail -s unsubscribe hylafax-users-request@xxxxxxxxxxx < /dev/null
 *To learn about commercial HylaFAX(tm) support, mail sales@xxxxxxxxx*