oss-security - Re: Re: Some fun with tcp

Openwall Project		/home Owl JtR Pro crypt pam_passwdqc tcb phpass scanlogd popa3d msulogin / Linux BIND / advisories presentations / services donations / wordlists passwords / NEWS community lists Wiki CVSweb mirrors signatures
bringing security into open environments

Password Recovery Resources on the Net

[<prev] [next>] [<thread-prev] [thread-next>] [month] [year] [list]

Date: Thu, 16 Apr 2009 07:59:20 -0400 (EDT)
From: wietse@...cupine.org (Wietse Venema)
To: Tomas Hoger <thoger@...hat.com>
CC: coley@...us.mitre.org, oss-security@...ts.openwall.com, 
 Wietse Venema <wietse@...cupine.org>
Subject: Re: Re: Some fun with tcp_wrappers

Tomas Hoger:
> The good_client (tcp_wrappers wrapping function in portmap /
> nfs-utils / ...) problem is rather interesting too, as it creates
> problems due to its attempt to avoid unneeded DNS lookups (workaround
> for hosts_ctl limitation?) and support host aliases (tcp_wrappers
> limitation).  

See my previous email. Programs such as portmappers must not look
up hostname information, since that would result in an infinite
recursion when host lookups use SUNRPC services. To state the
obvious: the portmapper would directly or indirectly send SUNRPC
calls to itself, in order to locate the NIS server.

Before discussing changes to a program, it is a good investment of
time to find out how the program works, and why it works in the
specific way it works.

	Wietse

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.