[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[SCO] Denial of Service Schwachstelle in BIND 8 - CSSA-2004-003.0
-----BEGIN PGP SIGNED MESSAGE-----
Liebe Kolleginnen und Kollegen,
soeben erreichte uns nachfolgende Warnung der SCO Group ueber
Sicherheitsprobleme bei BIND 8. Wir geben diese Informationen
unveraendert an Sie weiter.
CAN-2003-0914 - Negativ Cache Poisoning
Beim Caching von Negativantworten wird nicht korrekt ueberprueft,
ob die Negativantwort zu einer vom Server gestellten Anfrage ge-
hoert. Angreifer koennen diese Schwachstelle dazu ausnutzen, eigene
Negativantworten in den des Nameservers einzuspielen. Clients, die
Antworten aus dem Cache des betroffenen Nameservers beziehen, bekom-
men eine falsche Antwort, was zu einer Denial-of-Service Attacke
ausgenutzt werden kann. Der gefaelschte Eintrag bleibt im Cache, bis
seine Gueltigkeit ablaeuft.
Betroffen ist SCO OpenLinux 3.1.1 mit BIND 8 Versionen vor 3.7-1. Der
Hersteller stellt Updates zur Behebung der Schwachstelle bereit.
(c) der deutschen Zusammenfassung bei DFN-CERT Services GmbH; die
Verbreitung, auch auszugsweise, ist nur unter Hinweis auf den Urheber,
DFN-CERT Services GmbH, und nur zu nicht kommerziellen Zwecken gestattet.
Mit freundlichen Gruessen,
Klaus Moeller, DFN-CERT
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
______________________________________________________________________________
SCO Security Advisory
Subject: OpenLinux: Bind: cache poisoning BIND 8 prior to 8.3.7 and BIND 8.4.x prior 8.4.2
Advisory number: CSSA-2004-003.0
Issue date: 2004 February 19
Cross reference: sr886764 fz528462 erg712477 CAN-2003-0914
______________________________________________________________________________
1. Problem Description
CERT/CC Incident Note VU#734644
BIND is an implementation of the Domain Name System (DNS)
protocols. Successful exploitation of this vulnerability
may result in a temporary denial of service.
The Common Vulnerabilities and Exposures project (cve.mitre.org)
has assigned the name CAN-2003-0914 to this issue.
2. Vulnerable Supported Versions
System Package
----------------------------------------------------------------------
OpenLinux 3.1.1 Server prior to bind-8.3.7-1.i386.rpm
prior to bind-doc-8.3.7-1.i386.rpm
prior to bind-utils-8.3.7-1.i386.rpm
OpenLinux 3.1.1 Workstation prior to bind-8.3.7-1.i386.rpm
prior to bind-doc-8.3.7-1.i386.rpm
prior to bind-utils-8.3.7-1.i386.rpm
3. Solution
The proper solution is to install the latest packages. Many
customers find it easier to use the Caldera System Updater, called
cupdate (or kcupdate under the KDE environment), to update these
packages rather than downloading and installing them by hand.
4. OpenLinux 3.1.1 Server
4.1 Package Location
ftp://ftp.sco.com/pub/updates/OpenLinux/3.1.1/Server/CSSA-2004-003.0/RPMS
4.2 Packages
5bbeb4009cd1c63070d7edabc36838cd bind-8.3.7-1.i386.rpm
80582975955be472cc5dbb9eff171f72 bind-doc-8.3.7-1.i386.rpm
28b0522cb6a0d661337e58f05f264766 bind-utils-8.3.7-1.i386.rpm
4.3 Installation
rpm -Fvh bind-8.3.7-1.i386.rpm
rpm -Fvh bind-doc-8.3.7-1.i386.rpm
rpm -Fvh bind-utils-8.3.7-1.i386.rpm
4.4 Source Package Location
ftp://ftp.sco.com/pub/updates/OpenLinux/3.1.1/Server/CSSA-2004-003.0/SRPMS
4.5 Source Packages
08c17ced9fbed8ad680aad1f1df903f8 bind-8.3.7-1.src.rpm
5. OpenLinux 3.1.1 Workstation
5.1 Package Location
ftp://ftp.sco.com/pub/updates/OpenLinux/3.1.1/Workstation/CSSA-2004-003.0/RPMS
5.2 Packages
f5acabf134676668f0d669d5d58feda0 bind-8.3.7-1.i386.rpm
ac156c2e52b12aa8d46c94d5d7a37c7a bind-doc-8.3.7-1.i386.rpm
b8fb4eba73037973a85752d0c07aea03 bind-utils-8.3.7-1.i386.rpm
5.3 Installation
rpm -Fvh bind-8.3.7-1.i386.rpm
rpm -Fvh bind-doc-8.3.7-1.i386.rpm
rpm -Fvh bind-utils-8.3.7-1.i386.rpm
5.4 Source Package Location
ftp://ftp.sco.com/pub/updates/OpenLinux/3.1.1/Workstation/CSSA-2004-003.0/SRPMS
5.5 Source Packages
90229c9bbc06fe554b39eba9d3b3aa95 bind-8.3.7-1.src.rpm
6. References
Specific references for this advisory:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0914
http://www.kb.cert.org/vuls/id/734644
SCO security resources:
http://www.sco.com/support/security/index.html
This security fix closes SCO incidents sr886764 fz528462
erg712477.
7. Disclaimer
SCO is not responsible for the misuse of any of the information
we provide on this website and/or through our security
advisories. Our advisories are a service to our customers intended
to promote secure installation and use of SCO products.
8. Acknowledgements
SCO would like to thank CERT and The Internet Software Consortium.
______________________________________________________________________________
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (SCO/UNIX_SVR5)
iD8DBQFANTCebluZssSXDTERApzZAKDFVBKt3NhlD0FO7ZYwY+NYrYuzuACfe/6i
DGdX6eR6ERfR44lCmR74QNA=
=sJAn
- -----END PGP SIGNATURE-----
- --
Dipl. Inform. Klaus Moeller (CSIRT) DFN-CERT Services GmbH
https://www.dfn-cert.de/ +49-40-808077-555
PGP RSA/2048, 0BB7C8F9, 6D CC 59 0F 86 0C 58 4D 35 D7 0C 55 EF 4F 42 23
-----BEGIN PGP SIGNATURE-----
Version: 2.6.2i
iQEVAwUBQDX5r4rEggYLt8j5AQGKeAf/TLZer7/kh8tkYww1Nd1tLd9Gz/SDi7l1
Jt3hdO7IalDAtKOVYFdaBQYk0jsAY2IbPgldLG90oL7GeVv9p3xFSZCYZVjHTmui
j530sIaDVOC+N3m0xOcWYASYqI5AXJc0kV+JB8nA3RfZY1z6HetrhvIqrH3mP5mG
g37ui7k8L/0VlooHW8LFPYXxvuFafyDy/D3RzVAZBYzrfvvB8GWwQJw4AWam5LNo
Kpw6Pu7zV1Lu23aGGlrpZwFmAZUuY7eHxM01ApifmuXZu4YuFekGhXg8TCc0WjwS
ScEI7A/hc/C8P93aA1pLF+jIt6M4+O2vcx0jmRzNphoeoPO339w8Iw==
=rONF
-----END PGP SIGNATURE-----