full-disclosure - The last word on the Linux Slapper worm

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <3D93682B.2000301@algroup.co.uk>
From: ben at algroup.co.uk (Ben Laurie)
Subject: The last word on the Linux Slapper worm

vdongen wrote:
>>As I've pointed out elsewhere, patching old versions without changing
>>the version number is so stupid it leaves me boggling. But I guess in
>>future I'll write into advisories: "warning - your vendor may be such
>>a 
>>moron that you can't tell whether you are vulnerable or not by the 
>>version number, so I advise building from source or switching to a 
>>vendor with a clue".
> 
> I have to disagree on this, the way debian patches the current versions 
> of the stable distribution is a good thing in my opinion.
> Instead of upgrading the software, they backport the fixes in the 
> current version.
> This prevents getting new problems with compatibility and such when 
> inplementing new versions.
> New versions of a certain package mosty require updates of other 
> packages and/or rewriting config files. which is something that 
> requires lots of testing before applying on a production machine.
> Which is time you mostly don't have when a problem is found.

Please pay attention. I am not complaining about the practice of 
backporting fixes, which I wholly support. What I am complaining about 
is doing it in such a way that both the user and (particularly) the 
original author of the software cannot tell that it has been done.

Cheers,

Ben.

-- 
http://www.apache-ssl.org/ben.html       http://www.thebunker.net/

"There is no limit to what a man can do or how far he can go if he
doesn't mind who gets the credit." - Robert Woodruff