This bug has convinced me finally to upgrade to SuSE 6.0
------ Forwarded message ------
From: [EMAIL PROTECTED]
Subject: [linux-security] CIAC Bulletin J-035: Linux Blind TCP Spoofing
Date: Wed, 17 Mar 1999 13:48:12 -0600
To: [EMAIL PROTECTED]
Cc: [EMAIL PROTECTED]
Return-Path: <[EMAIL PROTECTED]>
...
PROBLEM: An implementation flaw has been identified in the Linux TCP/IP
stack.
PLATFORM: Linux kernels up to and including 2.0.35.
DAMAGE: Remote attackers could forge TCP connections without predicting
sequence numbers and pass data to the application layer before
a connection is established.
SOLUTION: Install upgrade.
______________________________________________________________________________
VULNERABILITY Risk is high. To eliminate this vulnerability, kernels below
ASSESSMENT: version 2.0.36 should upgrade as soon as possible.
______________________________________________________________________________
<snip>
Not that I had needed the conviction. However, SuSE-USA was so far
unable to give me a price quote on version 6.0 which I needed for my
purchasing department. As far as I am concerned their e-mail addresses
must be pointing to /dev/null. No response despite several tries
starting in mid-January. No response even after I asked the German SuSE
people to intervene on my behalf. They must not be needing my business
apparently. Perhaps if I complain loud enough on this mailing list that
will change by the time 6.1 rolls around?
Anyway, the bug forced me to upgrade to 6.0 via ftp install, and I
suggest all users with kernels of 2.0.35 and lower to also upgrade. I
don't have a good feeling about how dangerous this bug really is to
allow a remote root compromise (Lenz, any comments?), but having been
burnt once before, I'd rather not take any chances.
Best regards, Alex.
--
To get out of this list, please send email to [EMAIL PROTECTED] with
this text in its body: unsubscribe suse-linux-e
Check out the SuSE-FAQ at http://www.suse.com/Support/Doku/FAQ/ and the
archive at http://www.suse.com/Mailinglists/suse-linux-e/index.html
