FreeLists / openbeosnetteam / [openbeosnetteam] Re: New stack

[Luke Fowler <luke.fowler@xxxxxxxxxxx>]

on Wed, 23 Jul 2003 15:23:35 -0300 (BRT)
"Bruno G. Albuquerque" <bga@xxxxxxxxxxxxx> wrote:

On Wed, 23 Jul 2003, Leon Timmermans wrote:

> Why obviously?

Because 90% of the world use it and it is a proven framework? :)

> I know BIND (including it's client library) has a bad reputation, 
specially
> considering security.

Heh. The last significant flaw I heard concerning BIND was like 1 and a
half year ago.

-Bruno

Bruno,

The last BIND vunerability I know of was much more recent than that. Try 
this last November.

Here's a quote from the CERT post:

Multiple vulnerabilities have been found in BIND (Berkeley Internet Name 
Domain). One of these vulnerabilities (VU#852283) may allow remote 
attackers to execute arbitrary code with the privileges of the user 
running named, typically root. Other vulnerabilities (VU#229595, 
VU#581682) may allow remote attackers to disrupt the normal operation of 
your name server, possibly causing a crash. A vulnerability in the DNS 
resolver library (VU#844360) may allow remote attackers to execute 
arbitrary code with the privileges of applications that issue network 
name or address requests.

Link:  http://www.cert.org/advisories/CA-2002-31.html

Note that this is just the one I remember and that it applies only to 
some BIND 4 and BIND 8 versions.

I do however agree that ISC BIND is the standard to which we must adhere.

Thanks,

-Luke