Home page logo

bugtraq logo Bugtraq mailing list archives

Re: [linux-security] SNI-12: BIND Vulnerabilities and Solutions
From: Thomas.Roessler () SOBOLEV IAM UNI-BONN DE (Thomas Roessler)
Date: Wed, 23 Apr 1997 14:14:04 +0200

On Apr 22 1997, Kirk Bauer wrote on linux-security:

I don't know if this has made it to you yet, so here it is...

[del del del]

                    BIND Vulnerabilities and Solutions

As currently discussed on bugtraq, the proposed fix uses a weak
seeding for the random number generator if not using OpenBSD.
Under OpenBSD, an arc4random(3) libc routine which is
essentially RC4 seeded from /dev/arandom is used for this

Well, OpenBSD is not the only OS with a /dev/*random, linux has
this too (but it's called /dev/urandom).  Nevertheless, I'm not
aware of any libc interface to this.  So I've put together a
little one-object-file librandom from OpenBSD's arc4andom
sources (which were trivial to ``port''); the changes to the
(patched) bind code if you want to use this beast are quite
obvious.  You can find the source under

HTH, tlr
Thomas Roessler · 74a353cc0b19 · dg1ktr · http://home.pages.de/~roessler/

  By Date           By Thread  

Current thread:
  • Re: [linux-security] SNI-12: BIND Vulnerabilities and Solutions Thomas Roessler (Apr 23)
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]