Re: [cobalt-users] OT brief note on: CERT AdvisoryCA-2003-25Buffer Overflow in Sendmail

["Zeffie" <cobaltlist@xxxxxxxx>]

> Maybe you should test their OpenSSH package before knocking it ?

I don't need to do that?  do you understand the concept?

> The SolarSpeed company home page is located at
spammer.
LOL :)

> If you don't trust us Europeans, doesn't that cause you problems ?

you don't understand the concept... i have no problem with Europeans.  if it
helps change it to "I can't trust some guy (I think) living in the "south
pole" (I think) (in a red suit)

it's an issue...  it's often very easy to backdoor software...  I even built
a su program that sends the ip and passwd away in the mail for the next time
the /bin/su dialog comes around...  it took about an hour.  If you give root
to people you don't know your just asking to be part of a huge attack...
Thats my feeling these days...

>
> Red Hat had patches out for both OpenSSH and Sendmail *the same day*.
> Quite a difference!

same day and the next day....  ya... that was fun...  not..  in most cases
they are the source that sun depends on...

> Sun hasn't even issued a security bulletin yet, and they usually do
Solaris
> first. Like someone else suggested, they are probably relying on
Stackguard
> catching the buffer overflows while they prepare updates, in a month or
so.
> Then again, they haven't updated the version for Sun Linux 5.0 either ?
> (which doesn't have any stackguard. Fortunately Red Hat RPMS work there)

the sun linux follows plain redhat as far as I have seen...

??  I still have people call and they don't have ssh installed :(  I know
people that never install updates.. any of them....   and they seem to
live...  I don't know why????????

> I'm not more fond of advertising than the next guy, and I do wish that
> more people released their sources/patches (including us too, that is)
> but you can't really blame anyone for trying? Just Sun, for not trying.

have a good one...

Zeffie
734-454-9117
http://www.zeffie.com/
Home of Worlds Largest collection of raq4 rpms