Re: [8lgm]-Advisory-14.UNIX.SCO-prwarn.12-Nov-1994

[dsiebert () icaen uiowa edu (Doug Siebert)]

> Change that in: "how quickly Sun came with not-working patches"
> Note too that the patch that finally fixed the /var/spool/mail
> race conditions appeared months after the last 8lgm advisory.


The Sun patch fixed some of the problems and made the race harder to win.  It
also filled the particular hole that particular 8lgm script exposed.  Better
than a cryptic message from 8lgm saying "there is a bug in mail" and better
than hearing nothing at all from CERT until Sun believes they have the bug
fixed.  And if it takes several iterations for Sun to do this, and they
don't have whatever added pressure a widely-distributed exploit script adds,
this might a year or more for systems to be vulnerable to those who know
about this bug.  And with every passing day the chance someone else will
independly discover it increases...


-- 
Doug Siebert
dsiebert () isca uiowa edu