> Change that in: "how quickly Sun came with not-working patches" > Note too that the patch that finally fixed the /var/spool/mail > race conditions appeared months after the last 8lgm advisory. > The Sun patch fixed some of the problems and made the race harder to win. It also filled the particular hole that particular 8lgm script exposed. Better than a cryptic message from 8lgm saying "there is a bug in mail" and better than hearing nothing at all from CERT until Sun believes they have the bug fixed. And if it takes several iterations for Sun to do this, and they don't have whatever added pressure a widely-distributed exploit script adds, this might a year or more for systems to be vulnerable to those who know about this bug. And with every passing day the chance someone else will independly discover it increases... -- Doug Siebert dsiebert@isca.uiowa.edu