[2817] in bugtraq
Re: What happened to the syslog bug ?
daemon@ATHENA.MIT.EDU (Mike Kienenberger)
Tue Jun 25 19:09:52 1996
Date: Tue, 25 Jun 1996 14:47:05 -0800
Reply-To: mkienenb@arsc.edu
From: Mike Kienenberger <mkienenb@arsc.edu>
To: Multiple recipients of list BUGTRAQ <BUGTRAQ@NETSPACE.ORG>
In-Reply-To: <199606251755.KAA01990@netservice.ca.navigist.com>
On Tue, 25 Jun 1996, Joe Rhett wrote:
> > In August last year 8LGM released an advisory warning about a syslog
> > vulnerability. Something to do with a buffer overflow and passing commands
> > to a remote site. The advisory said that exploit would not be released
> > yet, in order to give time to vendors to issue patches. Now I understand
> > that some vendors are pretty slow in acknowledging security problems but
> > it sounds like they had enough time by now.
> > Anyone considering posting details on this full disclosure list ?
>
> Sun, HP, IBM, SGI, and SCO had patches available within 2 weeks. I've
> had the patches installed for over 3 months on our systems ... what
> other kind of "response" are you looking for?
I don't know about the other vendors, but SGI's patch only covered
sendmail's interaction with syslog, and not the actual syslog bug itself.
If I remember correctly, to fix the bug in syslog required replacing the
libc library which was a major change.
---
Mike Kienenberger Arctic Region Supercomputing Center
Systems Analyst (907) 474-6842
mkienenb@arsc.edu http://www.arsc.edu
