Date: Thu, 27 Jun 2002 12:06:34 -0600 From: Brett Glass <brett@lariat.org> To: Robert Watson <rwatson@FreeBSD.ORG> Cc: bright@mu.org, odela01@ca.com, freebsd-security@FreeBSD.ORG Subject: Re: resolv and dynamic linking to compat libc Message-ID: <4.3.2.7.2.20020627120145.02451c10@localhost> In-Reply-To: <Pine.NEB.3.96L.1020627125013.6971E-100000@fledge.watson.or g> References: <200206271617.KAA04440@lariat.org>
next in thread | previous in thread | raw e-mail | index | archive | help
At 10:55 AM 6/27/2002, Robert Watson wrote:
>Apache is actually a fairly unlikely target for the libc resolver attack,
>because it's default shipped both as dynamically linked,
I seem to have a mix of static and dynamic linking among the machines
I host. When it links dynamically, it seems to use libc 3. For example:
httpd:
-lcrypt.2 => /usr/lib/libcrypt.so.2.0 (0x2008b000)
-lc.3 => /usr/lib/libc.so.3.1 (0x200a0000)
>and because it
>doesn't ship doing reverse DNS lookups by default for performance reasons.
It doesn't do reverse DNS in the logs unless you turn on
HostNameLookups, that's true. But if you enable access control
on a directory it seems to look up the client.
>Far more likely targets are tools such as sendmail or sshd, which do
>predictable DNS lookups based on externally generated network traffic.
Very true. Sendmail in particular might be a problem.
>We are aware of the ftp apache package problem and attempting to resolve
>it.
Thank you!
--Brett
To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?4.3.2.7.2.20020627120145.02451c10>