Paul Gilmartin wrote:
On Fri, 1 Aug 2008 15:33:19 -0700, Edward Jaffe wrote:
http://www.pcworld.com/businesscenter/article/149022/faq_how_to_dodge_the_dns_bug.html
http://www.computerworld.com/action/article.do?command=viewArticleBasic&articleId=9110622
http://www.doxpara.com/
Is z/OS vulnerable? If not, why not? If so, what is the fixing APAR?
You know the rules: If it's a security APAR, IBM won't disclose
that information, will they?
This is big news. Attack code has recently been made public. And, BIND
is not IBM's proprietary code. They just need to incorporate the fix
into a PTF.
The best test site I've found so far is here:
https://www.dns-oarc.net/oarc/services/dnsentropy. It produces graphs
showing the randomness (or lack thereof) of your DNS source ports and
transaction ids.
--
Edward E Jaffe
Phoenix Software International, Inc
5200 W Century Blvd, Suite 800
Los Angeles, CA 90045
310-338-0400 x318
[EMAIL PROTECTED]
http://www.phoenixsoftware.com/
----------------------------------------------------------------------
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO
Search the archives at http://bama.ua.edu/archives/ibm-main.html
