Moving ahead

[Adam Shostack <adam@netect.com>]

We have disagreement on a few issues; I'll suggest that Steve put
those forth one at a time for consideration.  I'll also say that to do 
a proper review job, the list was too long; I didn't start it several
times because I wanted to go through it in one go, and thus my
response was delayed.

In addition, I want to raise three more, now that I've finished
looking into them.

CAN-1999-0014 we have insufficient data if a new CDE dtappgather bug
comes out to determine if its new or a re-invention. (REJECT)

CAN-1999-0032 the mention of (lp) is misleading.  The problem was with 
the BSD lpr family, not the SYSV lp family.  (MODIFY)

CAN-1999-0099 the problem was demonstrated publicly through sendmail,
there is no reason to expect it could not be used through another
program.  Suggest phrasing:  "A buffer overflow in syslog which was
demonstrably exploitable via sendmail."  (MODIFY)