nanog mailing list archives
Re: SendGate: Sendmail Multiple Vulnerabilities (Race Condition DoS,
From: Alain Hebert <ahebert () pubnix net>
Date: Fri, 24 Mar 2006 23:08:11 -0500
Hi,My only big issue with all of this is that a lot of us are depending on sendmail and its developer to keep it bug free...
But who are we to ask them to be accountable to us? What are we paying them for it?What make us so special that to command them, or whinne about it when its not as perfect as ones mind think things should be?
We should praise them and accept whatever scrap they send us.Because at the end of the day, sendmail, its staff, and other contributor saves our butts.
(time to go put on my fireproof jammies) Gadi Evron wrote:
Michael.Dillon () btradianz com wrote:I wonder how many other unreported silently-patched vulnerabilities are out there?You seem to be inferring that it is a bad thing to silently patch bugs which may have security implications. The OpenBSDFull disclosure, we believe in it.team makes a habit of auditing software for flaws and fixing them without waiting to find out whether they create actual security vulnerabilities. They consider this to be a GOOD thing.It is a good thing.I think that people who use software also consider it to be good for software flaws to be fixed as quickly as possible.Inevitably, this means that if the DEVELOPERS discover a flaw, they will fix it before they tell anyone about it. Thereason that security researchers publish bulletins aboutsecurity flaws is because they are unable to fix them either due to lack of skill, or more commonly, they just don't have permission to commit changes to the source code.Network operators are users of software and not developers, therefore most network operators are happy when flaws are fixed early and often.I wonder if the same network operators will be happy about potentially millions of compromised sendmail servers globally.
--Alain Hebert ahebert () pubnix net PubNIX Inc. P.O. Box 175 Beaconsfield, Quebec H9W 5T7
tel 514-990-5911 http://www.pubnix.net fax 514-990-9443
Current thread:
- SendGate: Sendmail Multiple Vulnerabilities (Race Condition DoS, Memory Jumps, Integer Overflow) Gadi Evron (Mar 23)
- Re: SendGate: Sendmail Multiple Vulnerabilities (Race Condition DoS, Memory Jumps, Integer Overflow) Valdis . Kletnieks (Mar 23)
- Re: SendGate: Sendmail Multiple Vulnerabilities (Race Condition DoS, Memory Jumps, Integer Overflow) Gadi Evron (Mar 23)
- Re: SendGate: Sendmail Multiple Vulnerabilities (Race Condition DoS, Memory Jumps, Integer Overflow) Valdis . Kletnieks (Mar 23)
- Re: SendGate: Sendmail Multiple Vulnerabilities (Race Condition DoS, Memory Jumps, Integer Overflow) JP Velders (Mar 25)
- Re: SendGate: Sendmail Multiple Vulnerabilities (Race Condition DoS, Memory Jumps, Integer Overflow) Jeroen Massar (Mar 25)
- Re: SendGate: Sendmail Multiple Vulnerabilities (Race Condition DoS, Memory Jumps, Integer Overflow) Gadi Evron (Mar 23)
- Re: SendGate: Sendmail Multiple Vulnerabilities (Race Condition DoS, Memory Jumps, Integer Overflow) Michael . Dillon (Mar 24)
- Re: SendGate: Sendmail Multiple Vulnerabilities (Race Condition DoS, Memory Jumps, Integer Overflow) Gadi Evron (Mar 24)
- Re: SendGate: Sendmail Multiple Vulnerabilities (Race Condition DoS, Alain Hebert (Mar 24)
- Re: SendGate: Sendmail Multiple Vulnerabilities (Race Condition DoS, Randy Bush (Mar 24)
- Re: SendGate: Sendmail Multiple Vulnerabilities (Race Condition DoS, Alain Hebert (Mar 24)
- Re: SendGate: Sendmail Multiple Vulnerabilities (Race Condition DoS, Memory Jumps, Integer Overflow) Valdis . Kletnieks (Mar 23)
- Re: SendGate: Sendmail Multiple Vulnerabilities (Race Condition DoS, Memory Jumps, Integer Overflow) Michael . Dillon (Mar 27)
- Re: SendGate: Sendmail Multiple Vulnerabilities (Race Condition DoS, Memory Jumps, Integer Overflow) Steven M. Bellovin (Mar 24)
- Re: SendGate: Sendmail Multiple Vulnerabilities (Race Condition DoS, Memory Jumps, Integer Overflow) Gadi Evron (Mar 25)
- Re: SendGate: Sendmail Multiple Vulnerabilities (Race Condition DoS, Memory Jumps, Integer Overflow) Valdis . Kletnieks (Mar 25)