[1514] in linux-security and linux-alert archive
[linux-security] Re: SNI-12: BIND Vulnerabilities and Solutions (fwd)
daemon@ATHENA.MIT.EDU (Thomas Roessler)
Wed Apr 23 08:37:21 1997
Date: Wed, 23 Apr 1997 14:14:04 +0200
From: Thomas Roessler <Thomas.Roessler@sobolev.iam.uni-bonn.de>
To: linux-security@redhat.com
Cc: bugtraq@netspace.org
In-Reply-To: <Pine.LNX.3.95.970422161814.19818A-100000@quick.gt.ed.net>
Resent-From: linux-security@redhat.com
Reply-To: linux-security@redhat.com
On Apr 22 1997, Kirk Bauer wrote on linux-security:
> I don't know if this has made it to you yet, so here it is...
[del del del]
> BIND Vulnerabilities and Solutions
As currently discussed on bugtraq, the proposed fix uses a weak
seeding for the random number generator if not using OpenBSD.
Under OpenBSD, an arc4random(3) libc routine which is
essentially RC4 seeded from /dev/arandom is used for this
purpose.
Well, OpenBSD is not the only OS with a /dev/*random, linux has
this too (but it's called /dev/urandom). Nevertheless, I'm not
aware of any libc interface to this. So I've put together a
little one-object-file librandom from OpenBSD's arc4andom
sources (which were trivial to ``port''); the changes to the
(patched) bind code if you want to use this beast are quite
obvious. You can find the source under
ftp://riemann.iam.uni-bonn.de/pub/users/roessler/arc4random.tgz.
HTH, tlr
--
Thomas Roessler · 74a353cc0b19 · dg1ktr · http://home.pages.de/~roessler/
