Re: Intresting problem concerning libresolv.so.2

From: Paul Gear <paul(at)gear.dyndns.org>
Date: Fri Apr 18 2003 - 23:53:21 EDT

Sam Evans wrote:

>I've run into an interesting dilema with a machine that's running Solaris

I've had this happen to me on Linux. Only one file had changed, and the changes seemed to be random. I compared the file with a known good copy and the changes certainly were not trojans or anything like that. Most things worked, but occasionally i'd get freezing or crashes.

I asked for suggestions on this list, and the main ones were faulty motherboard and/or RAM. It turned out to be a failing disk in the software RAID set: when i removed the faulty disk from the RAID set, everything worked fine. I had to work out which disk was bad through trial and error: i rebooted with one disk disconnected and tripwire didn't complain, and with the other one, tripwire found multiple bad checksums.

I think it less likely that a Sun (presumably with SCSI disk?) would exhibit this behaviour without at least providing some clue in the hardware diagnostics, but it is possible.

Paul

---

Attend Black Hat Briefings & Training Europe, May 12-15 in Amsterdam, the world's premier event for IT and network security experts. The two-day Training features 6 hand-on courses on May 12-13 taught by professionals. The two-day Briefings on May 14-15 features 24 top speakers with no vendor sales pitches. Deadline for the best rates is April 25. Register today to ensure your place. http://www.securityfocus.com/BlackHat-incidents

---

Received on Sun Apr 20 01:03:59 2003