|
|
|
|
|
|
|
|
|
|
|
|
| home | help | back | first | fref | pref | prev | next | nref | lref | last | post |
Date: Wed, 23 Apr 1997 14:14:04 +0200 Reply-To: Thomas Roessler <Thomas.Roessler@SOBOLEV.IAM.UNI-BONN.DE> From: Thomas Roessler <Thomas.Roessler@SOBOLEV.IAM.UNI-BONN.DE> X-To: linux-security@redhat.com To: BUGTRAQ@NETSPACE.ORG In-Reply-To: <Pine.LNX.3.95.970422161814.19818A-100000@quick.gt.ed.net> On Apr 22 1997, Kirk Bauer wrote on linux-security: > I don't know if this has made it to you yet, so here it is... [del del del] > BIND Vulnerabilities and Solutions As currently discussed on bugtraq, the proposed fix uses a weak seeding for the random number generator if not using OpenBSD. Under OpenBSD, an arc4random(3) libc routine which is essentially RC4 seeded from /dev/arandom is used for this purpose. Well, OpenBSD is not the only OS with a /dev/*random, linux has this too (but it's called /dev/urandom). Nevertheless, I'm not aware of any libc interface to this. So I've put together a little one-object-file librandom from OpenBSD's arc4andom sources (which were trivial to ``port''); the changes to the (patched) bind code if you want to use this beast are quite obvious. You can find the source under ftp://riemann.iam.uni-bonn.de/pub/users/roessler/arc4random.tgz. HTH, tlr -- Thomas Roessler =B7 74a353cc0b19 =B7 dg1ktr =B7 http://home.pages.de/~r= oessler/
|
|
|
|
|
|
|
|
|
|
|
|
| home | help | back | first | fref | pref | prev | next | nref | lref | last | post |