[53362] in North American Network Operators' Group
Re: new bind vuln
daemon@ATHENA.MIT.EDU (Steven M. Bellovin)
Wed Nov 13 00:07:14 2002
From: "Steven M. Bellovin" <smb@research.att.com>
To: "Michael H. Warfield" <mhw@wittsend.com>
Cc: Gerald <gcoon@inch.com>, nanog@merit.edu
Date: Wed, 13 Nov 2002 00:06:04 -0500
Errors-To: owner-nanog-outgoing@merit.edu
In message <20021113044904.GA6374@alcove.wittsend.com>, "Michael H. Warfield" w
rites:
>
>
>On Tue, Nov 12, 2002 at 06:10:14PM -0500, Gerald wrote:
>
>> Haven't seen mention of this yet today and DNS affects most everyone in
>> some way. The advisory was released a day early according to FreeBSD
>> security officer.
>
> Just to reiterate (I realize, in my haste, I forgot to include
>a reference or a quote in my earlier message)...
>
> Here is a quote from Vixie on Slashdot:
>
>] "ISS and ISC worked together on this. ISS found the
>] vulns, ISC worked with the vendors, and both of us
>] worked with CERT and coordinated the announcements.
>]=20
>] Paul Vixie
>] Chairman, ISC"
>
> Doesn't sound like "released a day early" to me.
>
CERT said that the ISS advisory was to be released on 13 November, and
that the patch would be available from ISC next week. There was no
indication about when CERT itself was going to issue an advisory, but
clearly someone said something a day earlier than had been expected.
--Steve Bellovin, http://www.research.att.com/~smb (me)
http://www.wilyhacker.com ("Firewalls" book)
