From owner-freebsd-security  Wed Nov 20 10:23:03 1996
Return-Path: owner-security
Received: (from root@localhost)
          by freefall.freebsd.org (8.7.5/8.7.3) id KAA24423
          for security-outgoing; Wed, 20 Nov 1996 10:23:03 -0800 (PST)
Received: from precipice.shockwave.com (ppp-206-170-5-61.rdcy01.pacbell.net [206.170.5.61])
          by freefall.freebsd.org (8.7.5/8.7.3) with ESMTP id KAA24415
          for <freebsd-security@freebsd.org>; Wed, 20 Nov 1996 10:23:00 -0800 (PST)
Received: from shockwave.com (localhost.shockwave.com [127.0.0.1]) by precipice.shockwave.com (8.8.2/8.7.3) with ESMTP id KAA21077; Wed, 20 Nov 1996 10:22:03 -0800 (PST)
Message-Id: <199611201822.KAA21077@precipice.shockwave.com>
To: Tom Fischer <tfischer@panoramix.rain.fr>
cc: freebsd-security@freebsd.org
Subject: Re: Serious BIND resolver problem. (fwd) 
In-reply-to: Your message of "Wed, 20 Nov 1996 18:15:55 GMT."
             <32934ADB.15FB7483@panoramix.rain.fr> 
Date: Wed, 20 Nov 1996 10:22:03 -0800
From: Paul Traina <pst@shockwave.com>
Sender: owner-security@freebsd.org
X-Loop: FreeBSD.org
Precedence: bulk


  From: Tom Fischer <tfischer@panoramix.rain.fr>
  Subject: Re: Serious BIND resolver problem. (fwd)
  Hello,
  
  Paul Traina warned:
  
  > If you're running 2.1R, you've got so many bloody security holes it's
  > not funny.  If you allow "untrusted" users on your machine, my advice
  > is to upgrade to 2.1.6 or 2.1-stable (nearly the same thing) without delay.
  
  
  thanks for the advice, but I was hoping to delay this until 2.2R
  came out (in two months, supposedly).  The security holes that
  I know about, and did something about are:
  
  	mount_union, mount_msdos, man...
  
  	suidperl
  
  	iijppp
  
  	rdist...
  
  Aside from this new libc thing, you're telling me that there are
  others as well?  Is there an easy way to fix the libc problem
  while I wait for 2.2R?

Upgrade to 2.1.6's libc.
  
  thanks,
  
  tom
  
  tfischer@rain.fr