From owner-freebsd-security Mon Aug 10 03:14:43 1998 Return-Path: Received: (from majordom@localhost) by hub.freebsd.org (8.8.8/8.8.8) id DAA15687 for freebsd-security-outgoing; Mon, 10 Aug 1998 03:14:43 -0700 (PDT) (envelope-from owner-freebsd-security@FreeBSD.ORG) Received: from gate.consol.de (gate.consol.de [194.162.127.130]) by hub.freebsd.org (8.8.8/8.8.8) with ESMTP id DAA15678 for ; Mon, 10 Aug 1998 03:14:39 -0700 (PDT) (envelope-from Michael.Elbel@consol.de) X-Envelope-Sender-Is: Michael.Elbel@consol.de (at relayer gate.consol.de) Received: from msgsrv.bb.consol.de (root@msgsrv [10.250.0.100]) by gate.consol.de (8.8.8/8.8.8) with ESMTP id MAA22441 for ; Mon, 10 Aug 1998 12:13:58 +0200 (CEST) Received: from fourier.int.consol.de (me@fourier.int.consol.de [10.0.1.17]) by msgsrv.bb.consol.de (8.8.8/8.8.8) with ESMTP id LAA11988 for ; Mon, 10 Aug 1998 11:14:38 +0200 Received: (from me@localhost) by fourier.int.consol.de (8.8.8/8.8.7) id MAA09930; Mon, 10 Aug 1998 12:13:57 +0200 (CEST) (envelope-from me) Date: Mon, 10 Aug 1998 12:13:57 +0200 (CEST) From: Michael Elbel Message-Id: <199808101013.MAA09930@fourier.int.consol.de> To: security@FreeBSD.ORG Subject: Re: Does this mean we have another breakin? Newsgroups: lists.freebsd.security References: <199808080403.VAA05702@burka.rdy.com> Reply-To: me@FreeBSD.ORG X-Newsreader: NN version 6.5.0 CURRENT #123 Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org In lists.freebsd.security you write: >David Greenman writes: [...] >> Corruption is probably not the right word. There might be a bug where a >> page is seen as modified when it isn't, causing the modify date to get >> updated. The only way to be certain is to compare the binary with your >> backup (e.g. if installed from CDROM, then with the copy on the CDROM). I >> haven't personally seen this happen in more than a year, so if the bug is >> still there, it must be fairly rare. >We usually get this bug once in two weeks. But since file by itself >stays the same and machine doesn't crash, fixing/finding the problem >wasn't in out TODO list. Same here. I've seen it twice in the last four weeks on one of two absolutely identical machines we use as firewall bastions running -STABLE from end of April. Michael -- \|/ -O- Michael Elbel, ConSol* GmbH, - me@consol.de - 089 / 45841-128 /|\ Fermentation fault (coors dumped) To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe security" in the body of the message