Date: Fri, 8 Feb 2002 03:57:34 -0800 From: Kris Kennaway <kris@obsecurity.org> To: Jeroen Ruigrok/asmodai <asmodai@wxs.nl> Cc: John Hay <jhay@icomtek.csir.co.za>, nectar@FreeBSD.ORG, freebsd-arch@FreeBSD.ORG Subject: Re: cvs commit: src/contrib/bind FREEBSD-Xlist Message-ID: <20020208035734.A79602@xor.obsecurity.org> In-Reply-To: <20020208101923.GE52378@daemon.ninth-circle.org>; from asmodai@wxs.nl on Fri, Feb 08, 2002 at 11:19:23AM %2B0100 References: <20020208065440.GB52378@daemon.ninth-circle.org> <200202080853.g188rRO39489@zibbi.icomtek.csir.co.za> <20020208101923.GE52378@daemon.ninth-circle.org>
next in thread | previous in thread | raw e-mail | index | archive | help
--NzB8fVQJ5HfG6fxh Content-Type: text/plain; charset=us-ascii Content-Disposition: inline On Fri, Feb 08, 2002 at 11:19:23AM +0100, Jeroen Ruigrok/asmodai wrote: > I mean, it is ironic that one person already found a heap of potential > problem areas on a single sweep, whereas the piece of software claims to > have been rewritten from scratch to ensure more security [IIRC the texts > correctly]. Of course, a rewrite is a daunting task, but do not flaunt > around stating the improved security and auditing when one person points > out a bunch of problematic cases. I don't think it's as bad as you're suggesting; I found a bunch of format string errors in bind9, but AFAICT none of them were exploitable. bind8 had some scarier ones, but fortunately they also seemed to be non-exploitable. I haven't spent much time auditing bind code, but from what I saw of bind9 it seems better-written. Kris --NzB8fVQJ5HfG6fxh Content-Type: application/pgp-signature Content-Disposition: inline -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.6 (FreeBSD) Comment: For info see http://www.gnupg.org iD8DBQE8Y70uWry0BWjoQKURAs2eAKCHBU1wncVLOUwTkeaSBBADhqFwgwCgkwuE a7zeF2UzC73TcRiS4xS7gMM= =x1k7 -----END PGP SIGNATURE----- --NzB8fVQJ5HfG6fxh-- To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-arch" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20020208035734.A79602>