Christian has posted a follow-up to a discussion on the good old C preprocessor a few years ago. My opinion was (and still is) the C preprocessor is a "feature" hacked into the language to overcome its shortage and is ugly by design.

Nevertheless, as one comment notes it all sums up to "use the right tool for the job". Replacing inline functions and C++ templates by preprocessor macros does not qualify in most cases though there may be situations in which there is no easy to use alternative. One of these situations is making sure a header file is only included once:

#ifndef _STDIO_H
# define _STDIO_H       1
...

#endif /* !_STDIO_H */

This is a common pattern for which I am not aware of a suitable alternative in C land. Fortunately all modern programming languages have introduced other means to solve the problem.

Christian finishes with a link to this very "cool" macro - nothing to add to this one ;)

Responses[2]

Posted by Stefan Reuter on May 11, 2007 2:10:00 AM CEST #

Ignite Realtime has released Openfire 3.3.1 which fixes a critical security issue in all versions prior to 3.3.1. I had reported the issue last week, so thanks to the Openfire guys for the quick fix.

The security issue allows malicious people to remotely upload code to Openfire via the built-in admin console. The code is executed with the permissions of the user running Openfire. It is highly recommended that users upgrade their server instances to fix this security issue.

As a workaround access to the admin console port (9090 by default) can be limited via firewall rules.

The full changelog is available here.

Update June 27, 2007:

Now over a month later that users had enough time to upgrade I can release a few more details about the issue:

Basically the problem was a missing filter mapping in web.xml which caused the beans used to install plugins which are exposed through DWR to be available without authentication.

So you could easily open http://somehost:9090/dwr/test/downloader and upload a malicious plugin that would run with the privileges of Openfire and with full access to the Openfire database.

References: Secunia Advisory: SA25427, CVE-2007-2975, JM-1049

Add a comment

Posted by Stefan Reuter on May 11, 2007 1:16:00 AM CEST #