Re: Is FreeBSD susceptible to this vulnerability?

From: Brett Glass (brett@lariat.org)
Date: 03/28/02 

Date: Thu, 28 Mar 2002 12:22:38 -0700
To: David Pick <d.m.pick@qmul.ac.uk>
From: Brett Glass <brett@lariat.org>

At 07:58 AM 3/28/2002, David Pick wrote:

>The notice says it's an "information leakage" vulnerability that
>can leak information useful for otherwise unrelated brute-force
>attacks.

True. In particular, it could facilitate brute force password
guessing attacks, because it does not appear that any special
measures are taken after wrong guesses.

Claims that it's a "Back Orifice for UNIX" (cf The Register)
are overblown, of course.

BTW< It appears that Caldera reported and fixed this years ago.
The issuers of the security notice probably dredged up the report
and began to test other UNIX implementations.

--Brett

To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message