Re: [linux-security] SNI-12: BIND Vulnerabilities and Solutions

[Thomas.Roessler () SOBOLEV IAM UNI-BONN DE (Thomas Roessler)]

On Apr 22 1997, Kirk Bauer wrote on linux-security:

> I don't know if this has made it to you yet, so here it is...

[del del del]

>                     BIND Vulnerabilities and Solutions

As currently discussed on bugtraq, the proposed fix uses a weak
seeding for the random number generator if not using OpenBSD.
Under OpenBSD, an arc4random(3) libc routine which is
essentially RC4 seeded from /dev/arandom is used for this
purpose.

Well, OpenBSD is not the only OS with a /dev/*random, linux has
this too (but it's called /dev/urandom).  Nevertheless, I'm not
aware of any libc interface to this.  So I've put together a
little one-object-file librandom from OpenBSD's arc4andom
sources (which were trivial to ``port''); the changes to the
(patched) bind code if you want to use this beast are quite
obvious.  You can find the source under
ftp://riemann.iam.uni-bonn.de/pub/users/roessler/arc4random.tgz.

HTH, tlr
--
Thomas Roessler · 74a353cc0b19 · dg1ktr · http://home.pages.de/~roessler/