[2202] in linux-security and linux-alert archive
[linux-security] Re: [RHSA-1999:029-01] Denial of service attack
daemon@ATHENA.MIT.EDU (Mihai Ibanescu)
Mon Aug 23 03:19:58 1999
Date: Mon, 23 Aug 1999 10:05:46 +0300 (EEST)
From: Mihai Ibanescu <misa@necomm.ro>
To: Sergio Ballestrero <s.ballestrero@c-sistemi.it>
cc: Rogier Wolff <R.E.Wolff@BitWizard.nl>, linux-security@redhat.com
In-Reply-To: <Pine.LNX.4.10.9908210131230.2907-100000@pcna5901.cern.ch>
Resent-From: linux-security@redhat.com
Resent-Reply-To: linux-security@redhat.com
On Sat, 21 Aug 1999, Sergio Ballestrero wrote:
> On Sat, 21 Aug 1999, Rogier Wolff wrote:
>
> > Dan Stromberg wrote:
> > >
> > > Is redhat 5.1 immune to the attack? Or is it no longer supported for
> > > patches? It seems strange that both 4.2 and 5.2 are vulnerable, but
> >
> > You're allowed to lag one major behind. So while red Hat is releasing
> > 6.0, 6.1, 6.2 etc, you're allowed to stay on 5.2. If you're on 5.1 or
> > 5.0 you should always upgrade to 5.2. No way around it. That's what
> > they told me about a year ago.
> >
> > The 5.x -> 5.2 upgrade is supposed to be relatively painless. If you
> > REALLY know what you're doing, you could only upgrade the essential
> > parts. (i.e. the packages that had security issues).
>
> As far as i know (and remember - it's a few months that i run 6.0 )
> there's practically no difference between a fully updated 5.1 and a 5.2.
> So after you have installed all the 5.1 updates, you can quite painlessly
> start installing the 5.2 updates. I basically did the 5.1->5.2 upgrade "by
> hand", and had no real problem - but don't try this with major releases.
This is not 100% true. It was a pain to upgrade from RedHat 4.2 to
5.x. It really was. But from 5.2 to 6.0 it's not a problem, if packages
are updated in the right order. This is the great thing about rpm - you
can upgrade a server without the need to reboot it!
Should anyone want to try it, I am ready to further explain how it
should be done.
Sure, an updated 5.[0-1] should be equivalent with an updated 5.2,
but since it's always possible to have an original 5.1 package that is
buggy, and the original 5.2 was not, I feel more comfortable if I upgrade
the system to 5.2.
> PS i do have a "rpm_upd" perl script that does some sanity checks before
> installing an upgrade (no install if any file has been modified and the
> alikes). Mail me if you want it.
Misa
[mod: Red Hat reserves the right to mess up (makes it hard) x.y ->
x+1.0 upgrades. Seems that happened with 4.2->5.0, but not with
5.2->6.0) -- REW]
--
----------------------------------------------------------------------
Please refer to the information about this list as well as general
information about Linux security at http://www.aoy.com/Linux/Security.
----------------------------------------------------------------------
To unsubscribe:
mail -s unsubscribe linux-security-request@redhat.com < /dev/null
