[linux-security] Re: [RHSA-1999:029-01] Denial of service attackin in.telnetd

[Mihai Ibanescu <misa necomm ro>]

On Sat, 21 Aug 1999, Sergio Ballestrero wrote:

> On Sat, 21 Aug 1999, Rogier Wolff wrote:
> 
> > Dan Stromberg wrote:
> > > 
> > > Is redhat 5.1 immune to the attack?  Or is it no longer supported for
> > > patches?  It seems strange that both 4.2 and 5.2 are vulnerable, but
> > 
> > You're allowed to lag one major behind. So while red Hat is releasing
> > 6.0, 6.1, 6.2 etc, you're allowed to stay on 5.2. If you're on 5.1 or
> > 5.0 you should always upgrade to 5.2. No way around it. That's what
> > they told me about a year ago.
> > 
> > The 5.x -> 5.2 upgrade is supposed to be relatively painless. If you
> > REALLY know what you're doing, you could only upgrade the essential
> > parts. (i.e. the packages that had security issues).
> 
>  As far as i know (and remember - it's a few months that i run 6.0 )
> there's practically no difference between a fully updated 5.1 and a 5.2.
> So after you have installed all the 5.1 updates, you can quite painlessly
> start installing the 5.2 updates. I basically did the 5.1->5.2 upgrade "by
> hand", and had no real problem - but don't try this with major releases.

	This is not 100% true. It was a pain to upgrade from RedHat 4.2 to
5.x. It really was. But from 5.2 to 6.0 it's not a problem, if packages
are updated in the right order. This is the great thing about rpm - you
can upgrade a server without the need to reboot it!
	Should anyone want to try it, I am ready to further explain how it
should be done.
	Sure, an updated 5.[0-1] should be equivalent with an updated 5.2,
but since it's always possible to have an original 5.1 package that is
buggy, and the original 5.2 was not, I feel more comfortable if I upgrade
the system to 5.2.

> PS i do have a "rpm_upd" perl script that does some sanity checks before
> installing an upgrade (no install if any file has been modified and the
> alikes). Mail me if you want it.

Misa

[mod: Red Hat reserves the right to mess up (makes it hard) x.y ->
x+1.0 upgrades. Seems that happened with 4.2->5.0, but not with
5.2->6.0)  -- REW]