[1825] in linux-security and linux-alert archive
[linux-security] Re: Named update for RH 4.2 exploitable?
daemon@ATHENA.MIT.EDU (Michael H. Warfield)
Sat Jun 6 18:46:09 1998
From: "Michael H. Warfield" <mhw@wittsend.com>
To: linux-security@redhat.com
Date: Sat, 6 Jun 1998 17:10:21 -0400 (EDT)
In-Reply-To: <001b01bd9124$feeae8e0$23669fce@bertha.devware.com> from "Jiva DeVoe" at Jun 6, 98 01:27:51 am
Resent-From: linux-security@redhat.com
Reply-To: linux-security@redhat.com
Jiva DeVoe enscribed thusly:
> Someone I was speaking with this evening claimed they have installed the
> latest named rpms yet they are still getting exploited daily and being
> hacked. Do the latest rpm's for the named 4.9.x stuff fix all the root
> exploits or is this person just an idiot who probably has holes elsewhere in
> the system?
Ahhhhh!!!! If the latest RPM's are STILL using 4.9.x instead of
the latest 8.1.x, people should be really upset. Bind 8.1.1 has been out
for quite some time and, unless you have turned on those assinine fake INVQ
inverse queries, it is not vulnerable to the remote root hack. It was still
vulnerable to several DoS attacks and everyone should now be using 8.1.2.
I don't know what's in the RPM's simply because I build straight from Paul
Vixie's sources up at www.isc.com. I know of no reasons to be sitting
on the 4.9.x stuff any more unless you are in love with or need some
compatibility with /etc/named.boot (8.1.x uses the newer, more flexible
/etc/named.conf).
Mike
--
Michael H. Warfield | (770) 985-6132 | mhw@WittsEnd.com
(The Mad Wizard) | (770) 925-8248 | http://www.wittsend.com/mhw/
NIC whois: MHW9 | An optimist believes we live in the best of all
PGP Key: 0xDF1DD471 | possible worlds. A pessimist is sure of it!
--
----------------------------------------------------------------------
Please refer to the information about this list as well as general
information about Linux security at http://www.aoy.com/Linux/Security.
----------------------------------------------------------------------
To unsubscribe:
mail -s unsubscribe linux-security-request@redhat.com < /dev/null
