Security World: [SECURITY] [DSA 1961-1] New bind9 packages fix cache poisoning

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- ------------------------------------------------------------------------
Debian Security Advisory DSA-1961-1 security@debian.org
http://www.debian.org/security/ Florian Weimer
December 23, 2009 http://www.debian.org/security/faq
- ------------------------------------------------------------------------

Package : bind9
Vulnerability : DNS cache poisoning
Problem type : remote
Debian-specific: no
CVE Id(s) : CVE-2009-4022
CERT advisory : VU#418861

Michael Sinatra discovered that the DNS resolver component in BIND
does not properly check DNS records contained in additional sections
of DNS responses, leading to a cache poisoning vulnerability. This
vulnerability is only present in resolvers which have been configured
with DNSSEC trust anchors, which is still rare.

Note that this update contains an internal ABI change, which means
that all BIND-related packages (bind9, dnsutils and the library
packages) must be updated at the same time (preferably using "apt-get
update" and "apt-get upgrade"). In the unlikely event that you have
compiled your own software against libdns, you must recompile this
programs, too.

For the old stable distribution (etch), this problem has been fixed in
version 9.3.4-2etch6.

For the stable distribution (lenny), this problem has been fixed in
version 9.5.1.dfsg.P3-1+lenny1.

For the unstable distribution (sid) and the testing distribution
(squeeze), this problem has been fixed in version 9.6.1.dfsg.P2-1.

We recommend that you upgrade your bind9 packages.

Upgrade instructions
- --------------------

wget url
will fetch the file for you
dpkg -i file.deb
will install the referenced file.

If you are using the apt-get package manager, use the line for
sources.list as given below:

apt-get update
will update the internal database
apt-get upgrade
will install corrected packages

You may use an automated update by adding the resources from the
footer to the proper configuration.

Debian GNU/Linux 4.0 alias etch
- -------------------------------

Source archives:

http://security.debian.org/pool/updates/main/b/bind9/bind9_9.3.4-2etch6.dsc
Size/MD5 checksum: 1197 d3beeb379e5a9060ff85d0e5fe1f4cdc
http://security.debian.org/pool/updates/main/b/bind9/bind9_9.3.4-2etch6.diff.gz
Size/MD5 checksum: 306175 7445be7f529dc3d687c0fea88ac5a884
http://security.debian.org/pool/updates/main/b/bind9/bind9_9.3.4.orig.tar.gz
Size/MD5 checksum: 4043577 198181d47c58a0a9c0265862cd5557b0

Architecture independent packages:

http://security.debian.org/pool/updates/main/b/bind9/bind9-doc_9.3.4-2etch6_all.deb
Size/MD5 checksum: 188002 9dc53693ecaf634e575d143a69bcc114

alpha architecture (DEC Alpha)

amd64 architecture (AMD x86_64 (AMD64))

arm architecture (ARM)

hppa architecture (HP PA RISC)

i386 architecture (Intel ia32)

ia64 architecture (Intel ia64)

mips architecture (MIPS (Big Endian))

mipsel architecture (MIPS (Little Endian))

powerpc architecture (PowerPC)

sparc architecture (Sun SPARC/UltraSPARC)

Debian GNU/Linux 5.0 alias lenny
- --------------------------------

Source archives:

http://security.debian.org/pool/updates/main/b/bind9/bind9_9.5.1.dfsg.P3.orig.tar.gz
Size/MD5 checksum: 5221004 dc87f5d14403bee19b0c1d04b4de9252
http://security.debian.org/pool/updates/main/b/bind9/bind9_9.5.1.dfsg.P3-1+lenny1.dsc
Size/MD5 checksum: 1783 2d85bf8e905a6d5d67e8d112927dabbe
http://security.debian.org/pool/updates/main/b/bind9/bind9_9.5.1.dfsg.P3-1+lenny1.diff.gz
Size/MD5 checksum: 226346 77aaa9045171fbfea94e3ac98a00359a

Architecture independent packages:

http://security.debian.org/pool/updates/main/b/bind9/bind9-doc_9.5.1.dfsg.P3-1+lenny1_all.deb
Size/MD5 checksum: 264806 93ce9a4d3e7b8929a15702701048e218

alpha architecture (DEC Alpha)

amd64 architecture (AMD x86_64 (AMD64))

arm architecture (ARM)

armel architecture (ARM EABI)

hppa architecture (HP PA RISC)

i386 architecture (Intel ia32)

ia64 architecture (Intel ia64)

mips architecture (MIPS (Big Endian))

mipsel architecture (MIPS (Little Endian))

powerpc architecture (PowerPC)

s390 architecture (IBM S/390)

sparc architecture (Sun SPARC/UltraSPARC)

These files will probably be moved into the stable distribution on
its next update.

- ---------------------------------------------------------------------------------
For apt-get: deb http://security.debian.org/ stable/updates main
For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main
Mailing list: debian-security-announce@lists.debian.org
Package info: `apt-cache show <pkg>' and http://packages.debian.org/<pkg>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)

iQEcBAEBAgAGBQJLMcL4AAoJEL97/wQC1SS+YhcH/2/+GoEo4bU9bxryPJAEhiOx
yLd0xZ/Y++eJHDUXHkQVJeMMhoc5o1mjdanbRc0zmzH7IKa+CJC5Ljy13h0cIfgI
wrtI7HwAy1LF2Zy7L2p9ElFbcXfmiCP09y3nLUcK/xcjvPeNb5T7FFuPXuq0ylFo
M6ML9xeIVG9BD2/dKmOpTBm9H5bOupwkpnPyFUa2I7NtqbwIkKrEK/AIuCENNH4N
RHhFJSLRnpAg9p6j/0CCYGtjcmO/JfxSdvQaGborgrfuGXSZofRVjcC8VJ4ejGkc
SPq3kjEQMuFA1II93mUGi7IB1+lXShwJOQwhmq950EjZqb9SxPka3Df09Rh4Vus=
=S0/a
-----END PGP SIGNATURE-----

--
To UNSUBSCRIBE, email to debian-security-announce-REQUEST@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org

Security World

Search This Blog

Tuesday, December 22, 2009

[SECURITY] [DSA 1961-1] New bind9 packages fix cache poisoning

No comments: