Date: Thu, 22 May 2008 10:58:46 +0200 From: Thijs Kinkhorst <thijs@...ian.org> To: oss-security@...ts.openwall.com Cc: Marcus Meissner <meissner@...e.de> Subject: Re: Root name server changes -> bind On Wednesday 21 May 2008 15:02, Marcus Meissner wrote: > The security consequences of obscure DNS root server usage are > obvious, IMHO. You might want to consider security updates to the bind > package with an updated root.hint file. (Since the story is on Slashdot, it > is as public as it can get; thus I use the regular channel for this > request.) > > Not sure if this warrants a CVE id. We've gotten similar requests at Debian, with people requesting it be fixed in a security update. Our position until now has been that we're not treating it as a security issue: it has been in that IP space for years and there are no concrete indications that the owner of that block has turned bad. The same could be said for many other IP's of the root servers, where the owner of the space, connectivity or housing is currently trusted but could go bad at some point. We'll probably fix it in a next point update. However, if many other vendors are treating it as a security issue, we're interested in their reasons and may follow suit to prevent confusion. Thijs Content of type "application/pgp-signature" skipped
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.