Re: DNS on the Firewall - security problem

[Alfred Huger <ahuger () silence secnet com>]

> there is no egg* to overflow and break a chroot.  Thus, if you don't
> put CHROOT/bin/sh in place, the standard attacks will fail, but a
> smart attacker can still get in.  In practicality, there are few smart
> attackers.

It only takes *one* smart attacker with a subscription to Bugtraq and a
predeliction to share his or her work. The l0pht (which you referanced) is
a perfect example of this.  



/****************************************************************************
Alfred Huger                                    http://www.secnet.com/ballista
Project Director                                ahuger () secnet com
Secure Networks Inc. (SNI)
*****************************************************************************/