[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-Id: <200805221058.48248.thijs@debian.org>
Date: Thu, 22 May 2008 10:58:46 +0200
From: Thijs Kinkhorst <thijs@...ian.org>
To: oss-security@...ts.openwall.com
Cc: Marcus Meissner <meissner@...e.de>
Subject: Re: Root name server changes -> bind
On Wednesday 21 May 2008 15:02, Marcus Meissner wrote:
> The security consequences of obscure DNS root server usage are
> obvious, IMHO. You might want to consider security updates to the bind
> package with an updated root.hint file. (Since the story is on Slashdot, it
> is as public as it can get; thus I use the regular channel for this
> request.)
>
> Not sure if this warrants a CVE id.
We've gotten similar requests at Debian, with people requesting it be fixed in
a security update. Our position until now has been that we're not treating it
as a security issue: it has been in that IP space for years and there are no
concrete indications that the owner of that block has turned bad. The same
could be said for many other IP's of the root servers, where the owner of the
space, connectivity or housing is currently trusted but could go bad at some
point. We'll probably fix it in a next point update.
However, if many other vendors are treating it as a security issue, we're
interested in their reasons and may follow suit to prevent confusion.
Thijs
Content of type "application/pgp-signature" skipped
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
