A Red Hat (Linux) mega patch

TalkBack 1 of 8:

Next »

• Thread View
• Flat View

Veryy misleading title - Mega Patch

As you stated, there are 3 critical vulnerabilities, but they're in user packages, not core OS internals.

Ekiga (formerly Gnome Meeting - an H.323 client)
Firefox This is the 1.5.0.10 patch that everyone knows about - nothing new
Thunderbird Again, this was known.

The flaws rated important were a mix. A kernel flaw that could lead to a DOS or code execution. The GNUpg patch wasn't due to a flaw in its code but a patch that would prevent ill-written apps from allowing some data outside the bounds of signed data to be interpreted as signed. Xen had a flaw that could allow read ability as root outside of a VM; again, no DOS or code execution.

Others were OS services like bind and Samba. Still others were spamassasin, wireshard, and a Wordperfect format converter.

What's a common theme here? Well, there's a couple:

(1) These aren't Red Had vulnerabilities per se - they affect a lot of distros. It's just that they were discovered and fixed after Red Hat froze the code base. RH was just in the unfortunate position that the flaws were found very late in the release cycle. None of the other distros are releasing a new version right now, so RH "catches all the flak".

(2) Most are in applications that aren't even part of the OS itself. They're add-ons - in particular the three critical ones.

At least Ryan didn't say they were flaws in the operating system, but by not expanding on what they actually were, a certain ilk here will run with the headline and broadcast to the world "See, here's proof our development methods produce a more secure Operating System". And we all know that would be very far from the truth...

Posted by: NetArch.   Posted on: 03/16/07 You are currently: a Guest | Members login | Terms of Use

Alert moderator to an offensive message

Subscribe to this discussion via Email or RSS

SponsoredWhite Papers, Webcasts, and Downloads

• eBook - How to Drive Better Business Outcomes with Exceptional Web Experiences IBM Today's businesses stand to benefit by implementing an enterprise-class ... Download Now
• Offload Reporting To Improve Oracle Database Performance Quest Software Is your organization looking for a more cost-effective way to get critical ... Download Now
• The New Generation of System X Servers: Lower datacenter costs through server refresh IBM Join Intel and IBM for a deep dive into the new Intel Xeon Processor 5500 ... Download Now