Evaluating security issues are hard for me, I readily admit. The more I learn about security the less I know. The alert was about local users being able to start a denial of service attack on a local box. None of our local users are (I hope!) savvy enough to do such a thing, but like you I always get a vague uneasiness when these sorts of notices appear. The alert also mentioned two other programs that had fixes done with the new kernel. If I were using those affected packages and they really were broken, I certainly would consider upgrading. What we try to do in-house is evaluate the apparent likelihood that our users' normal activity will either cause problems (using software that is subtly broken, say), or allow others to cause problems (subtly breaking our fire wall, say). We then try to ascertain what we currently have that might "break" if we upgrade. This is hard, IMHO. Sometimes we intentionally break things as we did when we moved from 7.3 to 8.0. We needed some software that appears to run better under 8.0 than 7.3 (frees/wan). So we made the conscious decision, and fortunately nothing seriously has gone wrong...so far. Too, we use hardware that is well supported by RedHat. We don't use the latest and greatest video cards, printers, etc., because chances are there aren't good, native Linux drivers available. Always being slightly behind the hardware curve has its uses, too! I am glad that you did not do what I did the first time (or second time) I said "yes" to upgrading the kernel! I was deeply religious about scrubbing remnants of the old kernel off the system...I was deeply embarrassed to have to do a data back-up and a new install. It was ugly. It has taken me time to learn that Linux ain't windows. Greater functionality comes from upgrading applications and not the OS. But that's just me! >>> rchrismon@rcn.com Tuesday, November 19, 2002 10:55:25 AM >>> Charles: Thank you for the response. Fortunately, my momma taught me good! I do still have the earlier kernel and am booting to that. As for upgrading the krenel, when RedHat says there's a known security flaw (or two) and the upgrade is intended to fix them, isn't that sufficient reason to do so? On the other hand, as far as I know, I haven't suffered from the security flaw, so maybe not. In any event, as a matter of professional curiosity and professional advancement (I keep and index all the helpful responses I get from lists like this), I'd still like to know how to determine what's gone wrong and how to fix it. Again, thanks for the words of wisdom. Randy -- Psyche-list mailing list Psyche-list@redhat.com https://listman.redhat.com/mailman/listinfo/psyche-list -- Psyche-list mailing list Psyche-list@redhat.com https://listman.redhat.com/mailman/listinfo/psyche-list
