Bugtraq mailing list archives
Re: yes, there's another hole in BIND
From: joe () helix0 chem iastate edu (Joe Hentzel)
Date: Fri, 22 Jul 1994 20:05:47 -0500 (CDT)
"In the previous message, Paul A Vixie said..."yes, a patch is in the works, and i'm testing it now. no, i'm not going to tell anybody what it is until i've got it fixed.Security through obscurity is alive and well here, too, I see. Therefore the crackers who are exploiting the hole have the guaranteed knowlege that all users of DNS are vulnerable. Great. Perhaps more than ONE head working on the problem might be a good idea? Surely there is more than ONE person that can devise a fix...
I agree, the purpose of this list IS full disclosure. If a security problem is noticed, is it not usually after someone is the victim of its exploitation? Surely the software developers are not the first to know. Nothing is gained by "security through obscurity", and you can't expect people to give up every piece of software they use, just because no one will tell them what the nature of the hole is. People have jobs and schedules and can't wait for bug fixes to be released. With knowledge about the hole they can make an educated decision about there system until it can be secured. -- Joe Hentzel | God made the Idiot for practice, and then System Security | He made the School Board. joe () helix0 chem iastate edu | -- Mark Twain
Current thread:
- Re: Is starting a user program on priv port via inetd dangerous ?, (continued)
- Re: Is starting a user program on priv port via inetd dangerous ? Eric Murray (Jul 21)
- Re: Is starting a user program on priv port via inetd dangerous ? matthew green (Jul 21)
- Re: Is starting a user program on priv port via inetd dangerous ? Darren Reed (Jul 22)
- Re: Is starting a user program on priv port via inetd dangerous ? jmc () gnu ai mit edu (Jul 22)
- yes, there's another hole in BIND Paul A Vixie (Jul 21)
- Re: yes, there's another hole in BIND Resident Hacker (Jul 22)
- Re: yes, there's another hole in BIND Paul A Vixie (Jul 22)
- Re: yes, there's another hole in BIND Perry E. Metzger (Jul 22)
- Re: yes, there's another hole in BIND Pat Myrto (Jul 22)
- Re: yes, there's another hole in BIND David Barr (Jul 22)
- Re: yes, there's another hole in BIND Joe Hentzel (Jul 22)
- *PLEASE* shut up Dave Sill (Jul 22)
- Re: Is starting a user program on priv port via inetd dangerous ? Graham Toal (Jul 22)
- Re: Sending escape sequences to xterms via wall/talk jmc () gnu ai mit edu (Jul 20)
- root name server corruption, denial of service prob Mark (Jul 21)
- Re: root name server corruption, denial of service prob Mark Kosters (Jul 21)
- Re: Escape sequences (was Wall and talkd pass binary data) Bruce Barnett (Jul 20)
- Re: Wall and talkd pass binary data G.J.W. Hagenaars (Jul 20)