On Sat, 2006-09-09 at 21:28, Gilbert Sebenste wrote: > >> I agree as much time should be spent on FC6, but I don't see how that a > >> DOS isn't a DOS. Just my opinion, and if I am wrong, correct me, please. > >> Thanks! > > > > Well it is probably no more of a DOS in practice for a remote site to > > connect to your sendmail and crash a child such that the parent will > > start new ones as needed than to connect and talk very slowly, keeping > > that process busy for a long time. You can do the latter to any MTA. > > True on the latter. But that has and will always be the case. That is not > the fault of the software, however. In this case, an extra problem is > causing a DOS on top of what you describe above. And if your network is a > victim of an attack based on that, it can be just as costly as a security > flaw allowing a breach of information. How is it more of a DOS one way than the other? If I understand the flaw, you can only crash the sendmail child connected to yourself which shouldn't have as much impact on anything else as staying connected would. It's not particularly desirable but I don't see how killing a child process that will be restarted is a big problem. -- Les Mikesell lesmikesell@xxxxxxxxx
