Security World: [SECURITY] [DSA-2130-1] New BIND packages fix denial of service

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- ------------------------------------------------------------------------
Debian Security Advisory DSA-2130-1 security@debian.org
http://www.debian.org/security/ Florian Weimer
December 10, 2010 http://www.debian.org/security/faq
- ------------------------------------------------------------------------

Package : bind9
Vulnerability : several
Problem type : remote
Debian-specific: no
CVE Id(s) : CVE-2010-3762 CVE-2010-3614 CVE-2010-3613

Several remote vulnerabilities have been discovered in BIND, an
implementation of the DNS protocol suite. The Common Vulnerabilities
and Exposures project identifies the following problems:

CVE-2010-3762
When DNSSEC validation is enabled, BIND does not properly
handle certain bad signatures if multiple trust anchors exist
for a single zone, which allows remote attackers to cause a
denial of service (server crash) via a DNS query.

CVE-2010-3614
BIND does not properly determine the security status of an NS
RRset during a DNSKEY algorithm rollover, which may lead to
zone unavailability during rollovers.

CVE-2010-3613
BIND does not properly handle the combination of signed
negative responses and corresponding RRSIG records in the
cache, which allows remote attackers to cause a denial of
service (server crash) via a query for cached data.

In addition, this security update improves compatibility with
previously installed versions of the bind9 package. As a result, it
is necessary to initiate the update with "apt-get dist-upgrade"
instead of "apt-get update".

For the stable distribution (lenny), these problems have been fixed in
version 1:9.6.ESV.R3+dfsg-0+lenny1.

For the upcoming stable distribution (squeeze) and the unstable
distribution (sid), these problems have been fixed in version
1:9.7.2.dfsg.P3-1.

We recommend that you upgrade your bind9 packages.

Upgrade instructions
- --------------------

wget url
will fetch the file for you
dpkg -i file.deb
will install the referenced file.

If you are using the apt-get package manager, use the line for
sources.list as given below:

apt-get update
will update the internal database
apt-get dist-upgrade
will install corrected packages

You may use an automated update by adding the resources from the
footer to the proper configuration.

Debian GNU/Linux 5.0 alias lenny
- --------------------------------

Source archives:

http://security.debian.org/pool/updates/main/b/bind9/bind9_9.6.ESV.R3+dfsg.orig.tar.gz
Size/MD5 checksum: 5306404 ec28c0b7064129b070dfd66cab1f35ea
http://security.debian.org/pool/updates/main/b/bind9/bind9_9.6.ESV.R3+dfsg-0+lenny1.diff.gz
Size/MD5 checksum: 586005 b2a1e7cb005638fef1407292cf5f8157
http://security.debian.org/pool/updates/main/b/bind9/bind9_9.6.ESV.R3+dfsg-0+lenny1.dsc
Size/MD5 checksum: 1797 eb8bb4c623d66a15e237c6bc59e3697a

Architecture independent packages:

http://security.debian.org/pool/updates/main/b/bind9/bind9-doc_9.6.ESV.R3+dfsg-0+lenny1_all.deb
Size/MD5 checksum: 283938 12739f36e1f811bccc66ac3a9d1eb432

alpha architecture (DEC Alpha)

amd64 architecture (AMD x86_64 (AMD64))

arm architecture (ARM)

armel architecture (ARM EABI)

hppa architecture (HP PA RISC)

i386 architecture (Intel ia32)

ia64 architecture (Intel ia64)

mips architecture (MIPS (Big Endian))

mipsel architecture (MIPS (Little Endian))

powerpc architecture (PowerPC)

s390 architecture (IBM S/390)

sparc architecture (Sun SPARC/UltraSPARC)

These files will probably be moved into the stable distribution on
its next update.

- ---------------------------------------------------------------------------------
For apt-get: deb http://security.debian.org/ stable/updates main
For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main
Mailing list: debian-security-announce@lists.debian.org
Package info: `apt-cache show <pkg>' and http://packages.debian.org/<pkg>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)

iQEcBAEBAgAGBQJNAo3dAAoJEL97/wQC1SS+uXkH/1uPxryEvl31QRAHBhYVa8ly
/YpabxzJaEbGTgBhPjmz7FVZPHSon08H/er3l7Jd2ur9g24rOX+D53w9H5LVssQv
qL2bxZ7S8U9II2acSHg6LkDydsO/E10oBcv1d5eKqoSt3omc737txSrqPR1/9eCS
txw/Cs2J63F6sPV3jfKJ0wIjI4XLeXKRksbEK3DSlLexJfDeVh3d8kl7VQEiDgEl
/6EjIktRRtw1O/qkbPKxNOV33n2ckczIIejeTMAbT8YqLpiw1kFOu1ePBgwggkCv
bMmSBhfS4vxb65Da2ZZj5ssRuPZ/jV9LVtVahYDdEjLLlYk1yELJwcSuwZ3L7dE=
=oD3A
-----END PGP SIGNATURE-----

--
To UNSUBSCRIBE, email to debian-security-announce-REQUEST@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org
Archive: http://lists.debian.org/87tyil5q63.fsf@mid.deneb.enyo.de

Security World

Search This Blog

Friday, December 10, 2010

[SECURITY] [DSA-2130-1] New BIND packages fix denial of service

No comments: