March 2000 - openSUSE Security - openSUSE Mailing Lists

named can't write to named.pid
by Jurjen Oskam 06 Mar '00

06 Mar '00

Hello everyone here, I'm posting this in this mailinglist since my problem showed up when I updated BIND to the latest version provided by SuSE. Since then (presumably because it doesn't run under root privileges anymore?) named complains: Mar 6 00:25:02 calvin named[5129]: couldn't create pid file '/var/run/named.pid' I already tried to make named.pid owned by user named. What to do here? -- Jurjen Oskam * ICQ 11573303 * http://www.stupendous.org/ for PGP key assassinate nuclear iraq clinton kill bomb USA eta ira cia fbi nsa kill president wall street ruin economy disrupt phonenetwork atomic bomb sarin nerve gas bin laden military -*- DVD Decryption at www.stupendous.org -*-

1 0

RE: [suse-security] Security announcements
by Paxton, Michael 06 Mar '00

06 Mar '00

> On Mon, 6 Mar 2000, Jussi Laako wrote: > > > I'm viewing it from statistical point of view. Let's say that 10 > crackers > > know about the vulnerability (if we don't announce it to whole world), > it's > > not very likely that YOUR system gets hacked. But if we announce it, > then > > about 1000 or 10000 crackers will know about it. Now it's much more > likely > > that YOUR system gets hacked? > Just an observation, but if 10 crackers know of a vulnerability then pretty soon it will be on a web site somewhere and the 1000, 10000 or 100000 will be just around the corner. They certainly wont feel any need to be discrete about it. It is certainly something that needs to be kept in mind when formulating a bug alert policy..

1 0

Kevin Mitnik
by Master9116＠aol.com 05 Mar '00

05 Mar '00

I thought that everyone would be interested in this. For those of you who don't know this particular person, his name is Kevin Mitnik, and he is/was one of the most notorious hackers ever. In 1995, he was arrested and brought up on federal charges for unauthorized computer access. He now seems to be reformed and has provided testinomy in person to a United States Congressional Commitee for Computer Security. Below is the link for the transcript of his testimony. http://www.senate.gov/~gov_affairs/030200_mitnick.htm Dan.

1 0

Forget
by Peter Hiltz 04 Mar '00

04 Mar '00

Since I ran the harden-suse script, I've begun to get many error messages indicating a command called "forget" has not been found. I can't find a reference to it anywhere obvious to me. Can anyone point me in the right direction? TIA. Peter

1 0

apache ssl with suse6.1
by alex medvedev 04 Mar '00

04 Mar '00

hallo, did anybody try to configure ssl with apache? i installed apassl and ssleay. followed the instructions in README.SuSE. genereated the key and edited the httpd.conf file. now when i try to connect on the secure port, first time it asks to accept certificates (i do so), then it says that "Netscape has encountered bad data from server". i also read the apache+ssl+php howto --> looks like my config is ok, but still get the error. help is greatly appreciated. -alexm the bandwidthwaister

1 0

SSH or SRP
by Victor Sturgeon 04 Mar '00

04 Mar '00

Ive a question, and need some advice. I need to secure a linux development box. It is on the web, and requires to offer telnet, ftp, http and possibly vnc. I have been looking at Stanfords SRP package and open ssh. Which will suit my needs better or should I use both, or or there alternatives. -- Victor Sturgeon Software Engineer & Computer Systems Consultant victors(a)enteract.com

1 0

ssh with chroot ?
by DEMERRE DIETER 03 Mar '00

03 Mar '00

-----BEGIN PGP SIGNED MESSAGE----- Hi, Some months ago, as I seem to remember, there was a thread about creating ssh-logins with limited file-system access (even a proper file-system). I then noticed it, and thought it could be interesting, but apparently I didn't save these files. Is there anybody in the neighbourhood that could dish up these messages ? or a conclusion, a direction to follow so I can offer people access to a (very limited) portion of my filesystem. I would like them to have e.g. chroot /tmp/unsecure_root /bin/sh as shell, but I keep getting an error-answer /usr/sbin/chroot: cannot execute sh: No such file or directory What am I doing wrong ? ******* Groetjes vanwege ***** Greetings From ******* Dieter Demerre - http://www.angelfire.com/de/ddemerre ddemerre(a)acm.org - ext.dieter.demerre(a)siemens.be - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: PGPfreeware 6.5.3 for non-commercial use <http://www.pgp.com> mQENAzhXiLAAqQEIAMsoaNcCZFHswGBK1J4dRJvjUA7XwIICCKIKwU1HZIz5meGk rbSgfK3SwJaqQOTRveKjPYtiZ7D6H19bjsO+P9bvdvEZHLC4dCQIvJfSMlcvSvLN 2S/wpfqaDZBsFDk2WnBmah9wilrm3QE4ATbWgGDeRd/XvPuRNc10FiZjRnEp5h+1 PcBppgljLhlJuBFEKxEXxjUsyBTl1zM3Gex8u+vNvg80DtlnlUB7Kc++JkJOSa3e 7FZAN7WEXztH9rKQmeCc/a1S00zHoPBeJnsfhjaX/nUhL2MH0AfTn0fX2W7LxgEQ J9MJhxr8Ejlsj+a5wQD2OFGk4Ttn4ftB++EuukMABRG0IURpZXRlciBEZW1lcnJl IDxkZGVtZXJyZUBhY20ub3JnPokBFQMFEDhXiLDh+0H74S66QwEBr2MIAJyuK5vb 4gMBZNelDedU53df23VfyrychlEH5E2fudaqpt3pspCQgX78KK4vLWsFr9ycUUYF 0FdTQBCUuhvj8BShexU9VocxjuoSaNuNwMqNZCWIAWx3OksvkTiNmXUC8rswxYKu Z81O8LQifpjSe4tifAoZvdSBjrvKNyx6UfAWLrYlaUOmzxzRtulIIW8L429aU//a ivhdBmBs4TKR9/NTCwI1Z/OY8Kc46keOI4cmdTNDGDYjlZHNi7UG8kj4XxajL40o 6yLY7m2TfXBbRB2aK10CjinpPhi+Vk6fA3KJ9/a4am4o2Oe8Tvqm8DPp0BM4VuyW dT7wQMNZk5WW0Ho= =kTdL - -----END PGP PUBLIC KEY BLOCK----- -----BEGIN PGP SIGNATURE----- Version: PGPfreeware 6.5.3 for non-commercial use <http://www.pgp.com> iQEVAwUBOL+bKeH7QfvhLrpDAQG71wgAx/PqCxap9wz5eyhIG7bSLqcZj9Vecuoq 2DUxOrOnEvpyt1lU+8tblxc4ltJd4VNNLFwSfAZR2JC2ns4/mrYNr82dJfT2qJvM F4RoTcaGAcvRao94BfeYR8gEM3vADk03cebA0HkoL/De2rLmFvsSM9ec7FMZNfVt /sdCo3Qn91emdFiakmmfQXekW1TnWZAlJZP2dZg0pEDeJwfceeK0S5bBZj8WEW7q ffnKSdx8t5Gvs57MHOxBzTKRE1f0nJRvMblYurkmjY/kom9WHDUlddRWmv0jFEDl fcdsvIVdxrHFg9srrB0o1ghVi0K7wd47MXZe+/ZzY0GPNe+1+mUJ/A== =Ghi/ -----END PGP SIGNATURE-----

3 2

Damn multi-spam (was: Re: [suse-security] EICAR2000)
by Hans v. Sommerfeld 03 Mar '00

03 Mar '00

Hi all, although I did the initial posting I'm just a victim of the mail-loop like you. Anyway I'm very sorry for unintentionally causing all this spamming mail-loop. Hopefully aleph1(a)SECURITYFOCUS.COM, firewalls-owner(a)lists.gnac.net, suse-security-owner(a)suse.com were/are able to stop this soon. I did inform them as soon as possible. That in no way says that one of them or gmx.net caused the problem. Maybe no list-sever or server listed and/or posted is/was the solely cause. But I didn't cause it solely myself. There has to be some inability in between. My system is disconnected most times of the day from internet. I did post once. Also I checked my sendmail-logs and they show not any bouncing or looping. If you please check the _full_ mail-headers you will recognize that the bouncing host is out of my sphere of responsibilities. B.T.W. I do have to tolerate impatient or flaming replies. That's ok. I do not tolerate racist, fascist or dumb 'german-nazi' replies. HvS

1 0

funny popper-entry
by Webdirekt Sysop 03 Mar '00

03 Mar '00

ps x | grep sendmail: 4837 ? S 0:00 sendmail: accepting connections on port 25 5719 ? S 0:00 sendmail: QAA05358 blackmail \ .fth.sbs.de.: user open along with a "connect from unknown" and a "fromless" mail in the maillog. That a problem ? thanks dan -- ----------------------------------------------------------- ~ WEBDIREKT INTERNET SERVICE GMBH ~ ~ the e-business intelligence company ~ ----------------------------------------------------------- ~ Dieselstr. 5 Fon: (+49) 6173 / 9359-88 ~ ~ D-61476 Kronberg Fax: (+49) 6173 / 9359-59 ~ ~ http://www.webdirekt.de mailto:sysop@webdirekt.de ~ -----------------------------------------------------------

2 1

EICAR2000 Conference in Brussels, Belgium, EU. March 4th-7th, 2000
by Hans v. Sommerfeld 02 Mar '00

02 Mar '00

*** 9th EICAR Annual Conference Brussels, Belgium, EU. March 4th-7th, 2000 *** -------------------------------------------------------------------------------- ** Saturday, March 4th and Sunday, March 5th two workshops in parallel: Workshop 1: Inforsec 2000 by Mich Kabay Workshop 2: CIRT (Computer Incident Response Team) by Peter Stephenson ** Monday, March 6th, plenaries: "When Worlds Collide, Information Sharing" Sarah Gordon, Richard Ford, USA "We Have to Destroy Privacy in Order to Protect Privacy" T. Schlickmann, European Commission, DG Enterprise, Directorate D, Unit 4 ** Monday, March 6th and Tuesday 7th three tracks in parallel: Track 1: Virus and Malware Track 2: Security Trust and E-commerce Track 3: Securing the Internet ** Tuesday, March 7th, plenaries: - `Gate Expectations' : Groupware Anti-Virus Scanners - Panel: European Privacy Directive, Echelon, How should Internet be changed *** You may visit the open EICAR meetings and ad-hoc workgroups as well! -------------------------------------------------------------------------------- ===> Make a last minute registration at <http://www.eicar.dk/registration> -- 9th EICAR Annual Conference Brussels, Belgium, EU. March 4th-7th, 2000 --- <http://www.eicar.dk/> eicar-online: <http://www.eicar.org/> --- H. von Sommerfeld <mailto:snoopy@redbaron.bir.uunet.de>

1 0

EICAR2000 - Last chance for online registration.
by Hans v. Sommerfeld 02 Mar '00

02 Mar '00

<http://www.eicar.dk/> >>>>> Information Security for the Next Millenium <<<<< 9th EICAR Annual Conference Brussels, Belgium, EU. March 4th-7th, 2000 ++ Last chance for online registration at <http://www.eicar.dk/registration> ++ You can still make a last minute registration :). Come around and enjoy. -- 9th EICAR Annual Conference Brussels, Belgium, EU. March 4th-7th, 2000 --- <http://www.eicar.dk/> eicar-online: <http://www.eicar.org/> --- H. von Sommerfeld <mailto:snoopy@redbaron.bir.uunet.de>

1 0

Re: [suse-security] SuSE Security Announcement - make-3.77
by Peter Folk 02 Mar '00

02 Mar '00

Jussi Laako <jussi(a)jlaako.pp.fi> wrote: >Or are you just pissed off because you couldn't use that bug to exploit few >systems? > >...Just wondering why are you crying about common practice and hiding behind >anonymity. (You aliases writing style just happens to be common to wanna-be >crackers who think they are kEwL...) I just want you to know that I think that is an entirely inappropriate comment. Many people prefer to protect their privacy and in many respects I think the 'net would be a much better place if more people did. Just because he does does not make him a cracker, nor does it invalidate his opinions (which I happen to share despite my not using an alias or being a cracker). If a system is concerned about security, then they should take measures to follow bug lists and disable services as bugs are discovered to maintain it. If not, then they will likely not know about the fix when it is re- leased either, and their system will be open to attack anyway. I see no reason to withhold information from those who will use it for the sake of those who (most likely) will not---at least it puts the security folks and the crackers on (more) even footing. Pete

1 0

T.Rex
by Johann G. Hautzinger 02 Mar '00

02 Mar '00

are there any plans to provide T.Rex (http://www.opensourcefirewall.com/index.html) for SuSE? it sounds all very interesting ... just doesn't currently support my favoured distribution ... *greetz* from Vienna Hannes -- Johann Georg Hautzinger, email: trema(a)eic.at, Tel.: 531 00 1907 Erste Bank AG - OE 0423 - Orga./Entw. Treasury u. Orga.Wertpapier Boersegasse 14, 1010 Wien http://treasury.erstebank.at

4 3

Re: [suse-security] SuSE Security Announcement - make-3.77
by Peter Folk 02 Mar '00

02 Mar '00

rabbi(a)quickie.net wrote: >Bruce Schneier has a very good piece about this. In it he condems >publishing exploits, and *demands* that those who find exploits give the >vendors ample time (not just a few days) to fix the hole. Fine. Then let's have two announcements: A hole has been discovered in X which allows [basic description of the security violations]. Please disable it until a patch is available. and the standard one, with an in-depth description of the problem and patches (and expoits if you aren't idiologically opposed to them). If all the locks are broken, it would be wise to tell those living in the subdivision to stand guard with a shotgun until the lock can be fixed. Pete

1 0

Re: [suse-security] Network question
by Selcuk Ozturk 01 Mar '00

01 Mar '00

If you are using Suse 6.2 and Intel EtherExpress Pro 100 cards, we had a similar experience and upgrading the drivers to the 'newnet.rpm' (available on Suse updates area) solved it for us. Selcuk > Hi! > > I know, this is a security board, but I have a network question and I > can't resolve the problem. I have tryed all thing I know and I'm a network > engineer. (I know what I'm do..) > > I always get collisions on my eth1, internal nic. Some pc's are connected > over a half duplex hub. The nic's and the cables are ok. My questions is > now.. Sometimes the data stream get frozen for about 3 or 4 sec. > > Can I push up somethink like windows size or something else I can try to > get a better result? What I can adjust for earn a fast constant data > stream without these connection errors?? > > Thanks for you help, > Chris <=><=><=><=><=><=><=><=><=><=><=><=><=><=><=><=><=><=><=><=><=><=><=> < Selcuk Ozturk <+> Email: > < MIS Deputy Director <+> sozturk(a)eMediaMillWorks.com > <=============================<#>===================================> < <+> eMediaMillWorks > < Fax : (301)883-2482 x121 <+> 1100 Mercantile Lane, Ste 119 > < Fax : (301)883-9754 <+> Largo, MD 20774 > <=><=><=><=><=><=><=><=><=><=><=><=><=><=><=><=><=><=><=><=><=><=><=>

1 0

Network question
by list 01 Mar '00

01 Mar '00

Hi! I know, this is a security board, but I have a network question and I can't resolve the problem. I have tryed all thing I know and I'm a network engineer. (I know what I'm do..) I always get collisions on my eth1, internal nic. Some pc's are connected over a half duplex hub. The nic's and the cables are ok. My questions is now.. Sometimes the data stream get frozen for about 3 or 4 sec. Can I push up somethink like windows size or something else I can try to get a better result? What I can adjust for earn a fast constant data stream without these connection errors?? Thanks for you help, Chris

2 1

ftp
by Jochen Lillich 01 Mar '00

01 Mar '00

Hi, what are recommended ways of securing ftp access from internal networks to the internet? Regards, Jochen -- ---------------------------------------------------------------------- Jochen Lillich | http://www.teamlinux.de | TeamLinux - J. Lillich und B. Schmidt GbR | Tel. 07255/76784-12 Linux-Loesungen fuer Internet und Intranet | Fax 07255/76784-50 ----------------------------------------------------------------------

3 3

Security Announcement: htdig
by thomas＠suse.de 01 Mar '00

01 Mar '00

Subject: SuSE Security Announcement - htdig -----BEGIN PGP SIGNED MESSAGE----- ______________________________________________________________________________ SuSE Security Announcement Package: htdig < 3.1.5 Date: Sun Feb 27 21:58:59 CET 2000 Affected SuSE versions: 6.1 - 6.3 Vulnerability Type: remote compromise SuSE default package: no Other affected systems: all systems using htdig < 3.1.5 ______________________________________________________________________________ A security hole was discovered in the package mentioned above. Please update it as soon as possible or disable the service if you are using this software on your SuSE Linux installation(s). Other Linux distributions or operating systems might be affected as well, please contact your vendor for information about this issue. Please note that we provide this information on an "as-is" basis only. There is no warranty whatsoever and no liability for any direct, indirect or incidental damage arising from this information or the installation of the update package. _____________________________________________________________________________ 1. Problem Description htsearch, a CGI program which is part of htdig, doesn't do proper checking on user input. 2. Impact By exploiting this security hole a remote attacker can view the contents of arbitrary files on the www server system with the privileges of the HTTP server. 3. Solution Update the package from our FTP server. ______________________________________________________________________________ Please verify these md5 checksums of the updates before installing: (For SuSE 6.0, please use the 6.1 updates) 4c8fe97c7d0804f1209ddae0c4feec7c ftp://ftp.suse.com/pub/suse/axp/update/6.1/n1/htdig-3.1.5-0.alpha.rpm bcbb21d0dc86c7b383e2991cfdde997d ftp://ftp.suse.com/pub/suse/axp/update/6.3/n1/htdig-3.1.5-0.alpha.rpm 105d8b266bc05a8aa0362b95e516ffe2 ftp://ftp.suse.com/pub/suse/i386/update/6.1/n1/htdig-3.1.5-0.i386.rpm 9e3a5875f87a1f14d5b6602859208076 ftp://ftp.suse.com/pub/suse/i386/update/6.2/n1/htdig-3.1.5-0.i386.rpm 0e302f0ebe4772a3f84ad8390f62c4e8 ftp://ftp.suse.com/pub/suse/i386/update/6.3/n1/htdig-3.1.5-0.i386.rpm ______________________________________________________________________________ You can find updates on our ftp-Server: ftp://ftp.suse.com/pub/suse/i386/update for Intel processors ftp://ftp.suse.com/pub/suse/axp/update for Alpha processors or try the following web pages for a list of mirrors: http://www.suse.de/ftp.html http://www.suse.com/ftp_new.html Our webpage for patches: http://www.suse.de/patches/index.html Our webpage for security announcements: http://www.suse.de/security If you want to report vulnerabilities, please contact security(a)suse.de ______________________________________________________________________________ SuSE has got two free security mailing list services to which any interested party may subscribe: suse-security(a)suse.com - moderated and for general/linux/SuSE security discussions. All SuSE security announcements are sent to this list. suse-security-announce(a)suse.com - SuSE's announce-only mailing list. Only SuSE's security annoucements are sent to this list. To subscribe to the list, send a message to: <suse-security-subscribe(a)suse.com> To remove your address from the list, send a message to: <suse-security-unsubscribe(a)suse.com> Send mail to the following for info and FAQ for this list: <suse-security-info(a)suse.com> <suse-security-faq(a)suse.com> _____________________________________________________________________________ This information is provided freely to everyone interested and may be redistributed provided that it is not altered in any way. Type Bits/KeyID Date User ID pub 2048/3D25D3D9 1999/03/06 SuSE Security Team <security(a)suse.de> - ------BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.3i mQENAzbhLQQAAAEIAKAkXHe0lWRBXLpn38hMHy03F0I4Sszmoc8aaKJrhfhyMlOA BqvklPLE2f9UrI4Xc860gH79ZREwAgPt0pi6+SleNFLNcNFAuuHMLQOOsaMFatbz JR9i4m/lf6q929YROu5zB48rBAlcfTm+IBbijaEdnqpwGib45wE/Cfy6FAttBHQh 1Kp+r/jPbf1mYAvljUfHKuvbg8t2EIQz/5yGp+n5trn9pElfQO2cRBq8LFpf1l+U P7EKjFmlOq+Gs/fF98/dP3DfniSd78LQPq5vp8RL8nr/o2i7jkAQ33m4f1wOBWd+ cZovrKXYlXiR+Bf7m2hpZo+/sAzhd7LmAD0l09kABRG0JVN1U0UgU2VjdXJpdHkg VGVhbSA8c2VjdXJpdHlAc3VzZS5kZT6JARUDBRA24S1H5Fiyh7HKPEUBAVcOB/9b yHYji1/+4Xc2GhvXK0FSJN0MGgeXgW47yxDL7gmR4mNgjlIOUHZj0PEpVjWepOJ7 tQS3L9oP6cpj1Fj/XxuLbkp5VCQ61hpt54coQAvYrnT9rtWEGN+xmwejT1WmYmDJ xG+EGBXKr+XP69oIUl1E2JO3rXeklulgjqRKos4cdXKgyjWZ7CP9V9daRXDtje63 Om8gwSdU/nCvhdRIWp/Vwbf7Ia8iZr9OJ5YuQl0DBG4qmGDDrvImgPAFkYFzwlqo choXFQ9y0YVCV41DnR+GYhwl2qBd81T8aXhihEGPIgaw3g8gd8B5o6mPVgl+nJqI BkEYGBusiag2pS6qwznZiQEVAwUQNuEtBHey5gA9JdPZAQFtOAf+KVh939b0J94u v/kpg4xs1LthlhquhbHcKNoVTNspugiC3qMPyvSX4XcBr2PC0cVkS4Z9PY9iCfT+ x9WM96g39dAF+le2CCx7XISk9XXJ4ApEy5g4AuK7NYgAJd39PPbERgWnxjxir9g0 Ix30dS30bW39D+3NPU5Ho9TD/B7UDFvYT5AWHl3MGwo3a1RhTs6sfgL7yQ3U+mvq MkTExZb5mfN1FeaYKMopoI4VpzNVeGxQWIz67VjJHVyUlF20ekOz4kWVgsxkc8G2 saqZd6yv2EwqYTi8BDAduweP33KrQc4KDDommQNDOXxaKOeCoESIdM4p7Esdjq1o L0oixF12Cg== =pIeS - ------END PGP PUBLIC KEY BLOCK----- -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: noconv iQEVAwUBOLz283ey5gA9JdPZAQEW1AgAlEzhOH+SnBNA07OgnQ5TngeMBlgPyMLR bl+aX3Yp39jmeaUM7MA4eAew3CNjzEbs4ZClTsU9Ag6IH2cSd+aq0FaQvBIEY8Pe CjbCck+yL+6UOo/mWX1cnEAFU0Q2gZe165GYcvg3mP9GPuRe3wuUAyMusHTa3/ZO Iax5AySa9uwuZ7i5+ycWh6/v7R3Pip9zkDvZ4dFIsQ3jS2COG8GW9OGLs8jhcJfU RJWTwA0Ky6G+ezbcwrSKeD7xwLddU65uJca4BQ8rx5aGcfwzCxomC78M2etTLWM5 kqznQEtOGu8Ym3ogIRPxHgyIyYzPDbwcrf0BnFsb43zGf1wP5fJtig== =Jl60 -----END PGP SIGNATURE-----

1 0

ht://Dig
by Tobias Burnus 01 Mar '00

01 Mar '00

Hi, will be there an update by SuSE? Or is ~> rpm -q htdig htdig-3.1.2-28 not affected? Tobias http://lwn.net/daily/htdig-hole.html > Date: Fri, 25 Feb 2000 18:52:44 -0600 > To: lwn(a)lwn.net > From: Geoff Hutchison <ghutchis(a)wso.williams.edu> > Subject: [SECURITY] Security hole in ht://Dig's htsearch > > (What follows was sent to the htdig, htdig3-announce and htdig3-dev > mailing lists earlier today.) > > Hi, > > I'm sending this message out essentially twice. The contents are > included in the ht://Dig 3.1.5 release notes at > <http://www.htdig.org/RELEASE.html>;, but I wanted to make sure > everyone got the message. There is a security hole in all versions of > the htsearch CGI prior to version 3.1.5 (just released). > > This hole can allow remote users to read any file on your system that > the UID running your webserver can read. > > It is *strongly* recommended that you upgrade to 3.1.5 ASAP. Anyone > upgrading from a 3.1.x stable release will find the process fairly > painless and to fix the hole, they can simply drop in the new CGI. > The databases themselves are not affected. You may also wish to look > at the new default templates as they make use of new features and > generate cleaner HTML output. > > Anyone using version 3.2.0b1 is suggested to upgrade to the latest > development snapshot. The next beta version, 3.2.0b2, will be > released shortly to address this issue and other bugs. > > More detailed information will be posted to the BugTraq mailing list > in a day or two. > > -Geoff Hutchison > Williams Students Online > http://wso.williams.edu/

2 3

Fw: [suse-security] SuSE Security Announcement - make-3.77
by Magus Ba'al 01 Mar '00

01 Mar '00

Here's the way I see about new bugs, they've been there for who knows how long, maybe since the beginning or since the last update/patch. That means it could have been days, weeks or years that this bug has been there, why does it matter if you don't know for a few more days, it's not like they find it and all the sudden ALL the crackers know about it. So what if you don't know for a few more days, it gives the author time to fix the bug, and then post the new version/patch, so then inform you and all the crackers that the bug exists. What if there is no workaround other than to take down the entire box until the fix is available, then what, you're SOL? I'd rather not know about it for a few days, have an update available, then be informed so I know that it wasn't public knowledge so others could exploit me. "He who fights with monsters should look to it that he himself does not become a monster...when you gaze long into the abyss the abyss also gazes into you." -Friedrich Nietzsche "Push and you will find resistance, lead and you will find followers" - Unknown Author ----- Original Message ----- From: "Petri Sirkkala." <petes(a)noitatieto.fi> To: "SuSE Security" <suse-security(a)suse.com> Sent: Monday, February 28, 2000 6:33 AM Subject: Re: [suse-security] SuSE Security Announcement - make-3.77 > > On Mon, 28 Feb 2000, Fred Mobach wrote: > > > Thomas Michael Wanka wrote: > > > > > On 28 Feb 00, at 9:06, Andre Poenitz wrote: > > > > > > > That's simply not possible. So this approach is not feasible IMHO. > > > > Full disclosure is sometimes problematic but works rather well in > > > > general. I'd never trust anybody who is saying 'well, I know of a > > > > problem of yours, but I won't tell you'. > ... > > This is not the discussion I subscribe to this list for. Stop now or I > ignore you for time being. > -Pete > > > --------------------------------------------------------------------- > To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com > For additional commands, e-mail: suse-security-help(a)suse.com >

1 0