To: [email protected]Subject: [ MDKSA-2007:030 ] - Updated bind packages fix DoS vulnerabilities
Date: Tue, 30 Jan 2007 15:08:09 -0700
From: [email protected]
Reply-To: <xsecurity@mandriva.com.>
Message-Id: <E1HC197-0004EB-EA@artemis.annvix.ca.>
Sender: QA Team <qateam@artemis.annvix.ca.>
X-Virus-Scanned: antivirus-gw at tyumen.ru
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
_______________________________________________________________________
Mandriva Linux Security Advisory MDKSA-2007:030
http://www.mandriva.com/security/
_______________________________________________________________________
Package : bind
Date : January 30, 2007
Affected: 2006.0, 2007.0, Corporate 3.0, Corporate 4.0,
Multi Network Firewall 2.0
_______________________________________________________________________
Problem Description:
Use-after-free vulnerability in ISC BIND 9.3.0 up to 9.3.3, 9.4.0a1 up
to 9.4.0a6, 9.4.0b1 up to 9.4.0b4, 9.4.0rc1, and 9.5.0a1 (Bind Forum
only) allows remote attackers to cause a denial of service (named
daemon crash) via unspecified vectors that cause named to "dereference
a freed fetch context." (CVE-2007-0493)
ISC BIND 9.0.x, 9.1.x, 9.2.0 up to 9.2.7, 9.3.0 up to 9.3.3, 9.4.0a1 up
to 9.4.0a6, 9.4.0b1 up to 9.4.0b4, 9.4.0rc1, and 9.5.0a1 (Bind Forum
only) allows remote attackers to cause a denial of service (exit) via a
type * (ANY) DNS query response that contains multiple RRsets, which
triggers an assertion error. (CVE-2007-0494)
The updated packages have been patched to correct these issues.
_______________________________________________________________________
References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0493http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0494
_______________________________________________________________________
Updated Packages:
Mandriva Linux 2006.0:
136f032a3e607a885e8e758c21de697e 2006.0/i586/bind-9.3.1-4.3.20060mdk.i586.rpm
4ec04765b384832e638fba3ca97958d6 2006.0/i586/bind-devel-9.3.1-4.3.20060mdk.i586.rpm
67b8b8fd0d66d3548e23bc9ea758a9b2 2006.0/i586/bind-utils-9.3.1-4.3.20060mdk.i586.rpm
0478a46a421aaff69a4268fc50311cad 2006.0/SRPMS/bind-9.3.1-4.3.20060mdk.src.rpm
Mandriva Linux 2006.0/X86_64:
dcfcda7ac17daa0e7d1a898d8f018c53 2006.0/x86_64/bind-9.3.1-4.3.20060mdk.x86_64.rpm
114417e447db63eff69f0fb9c1da5ca5 2006.0/x86_64/bind-devel-9.3.1-4.3.20060mdk.x86_64.rpm
822d35d0c359512697b00aa322e229c8 2006.0/x86_64/bind-utils-9.3.1-4.3.20060mdk.x86_64.rpm
0478a46a421aaff69a4268fc50311cad 2006.0/SRPMS/bind-9.3.1-4.3.20060mdk.src.rpm
Mandriva Linux 2007.0:
5dd19eec1e9befd50e04f8f57ef05a14 2007.0/i586/bind-9.3.2-8.2mdv2007.0.i586.rpm
93ee3478554408436542ecca80a057b5 2007.0/i586/bind-devel-9.3.2-8.2mdv2007.0.i586.rpm
0b41cdaf5c5dcb6b22b9e7cbdd176a71 2007.0/i586/bind-utils-9.3.2-8.2mdv2007.0.i586.rpm
2837da2b6e2ad6e8cb633649db7f2f72 2007.0/SRPMS/bind-9.3.2-8.2mdv2007.0.src.rpm
Mandriva Linux 2007.0/X86_64:
bd1f5a957435cfd8b98c9144fdce3e2c 2007.0/x86_64/bind-9.3.2-8.2mdv2007.0.x86_64.rpm
2eaff9073641cdbb1728b93b8d47466e 2007.0/x86_64/bind-devel-9.3.2-8.2mdv2007.0.x86_64.rpm
65e0b300358077a40491c0050a6018c3 2007.0/x86_64/bind-utils-9.3.2-8.2mdv2007.0.x86_64.rpm
2837da2b6e2ad6e8cb633649db7f2f72 2007.0/SRPMS/bind-9.3.2-8.2mdv2007.0.src.rpm
Corporate 3.0:
0c4cb30dfc9859166b17a31e6a2af79d corporate/3.0/i586/bind-9.2.3-6.3.C30mdk.i586.rpm
ac37b03dc288e261da1fa6a6345dd8dd corporate/3.0/i586/bind-devel-9.2.3-6.3.C30mdk.i586.rpm
079bae6b9f8068d74e072be65d26fa77 corporate/3.0/i586/bind-utils-9.2.3-6.3.C30mdk.i586.rpm
be1255c5555729ddc5ae14c4f67cf567 corporate/3.0/SRPMS/bind-9.2.3-6.3.C30mdk.src.rpm
Corporate 3.0/X86_64:
7e73fd8282c1a7953be0b744beed5dd3 corporate/3.0/x86_64/bind-9.2.3-6.3.C30mdk.x86_64.rpm
8902b055a92d2e13e71b823cb3e4a608 corporate/3.0/x86_64/bind-devel-9.2.3-6.3.C30mdk.x86_64.rpm
fcdf343dd8701efa433d64aaeddffcab corporate/3.0/x86_64/bind-utils-9.2.3-6.3.C30mdk.x86_64.rpm
be1255c5555729ddc5ae14c4f67cf567 corporate/3.0/SRPMS/bind-9.2.3-6.3.C30mdk.src.rpm
Corporate 4.0:
068c39ca2498b053ad23e08fdb31c54e corporate/4.0/i586/bind-9.3.2-7.2.20060mlcs4.i586.rpm
c99b3f41d2ca96f615bc26f0e8c169f9 corporate/4.0/i586/bind-devel-9.3.2-7.2.20060mlcs4.i586.rpm
c76a8f92ae138cff33e3dc6fef10ff90 corporate/4.0/i586/bind-utils-9.3.2-7.2.20060mlcs4.i586.rpm
765808e7773555373806de92a7f9457d corporate/4.0/SRPMS/bind-9.3.2-7.2.20060mlcs4.src.rpm
Corporate 4.0/X86_64:
3faee03ce5afe127873cccd06ff2db08 corporate/4.0/x86_64/bind-9.3.2-7.2.20060mlcs4.x86_64.rpm
33fffd8bfdba90e241651572c0bfc9c5 corporate/4.0/x86_64/bind-devel-9.3.2-7.2.20060mlcs4.x86_64.rpm
d934cd748f381f2e3b0b9f64557abf23 corporate/4.0/x86_64/bind-utils-9.3.2-7.2.20060mlcs4.x86_64.rpm
765808e7773555373806de92a7f9457d corporate/4.0/SRPMS/bind-9.3.2-7.2.20060mlcs4.src.rpm
Multi Network Firewall 2.0:
0a3fe311cabb513919db7732cb6acaf7 mnf/2.0/i586/bind-9.2.3-6.3.M20mdk.i586.rpm
503e3482f93a90c25540cbe1b00328b0 mnf/2.0/i586/bind-devel-9.2.3-6.3.M20mdk.i586.rpm
4f0c2e87628bd66fe88daddc5e5c9c41 mnf/2.0/i586/bind-utils-9.2.3-6.3.M20mdk.i586.rpm
f8abc9e26c5ae868793741a1552d622e mnf/2.0/SRPMS/bind-9.2.3-6.3.M20mdk.src.rpm
_______________________________________________________________________
To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.
All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:
gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98
You can view other update advisories for Mandriva Linux at:
http://www.mandriva.com/security/advisories
If you want to report vulnerabilities, please contact
security_(at)_mandriva.com
_______________________________________________________________________
Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
<security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)
iD8DBQFFv5WJmqjQ0CJFipgRAkNvAKDCYPL7wX8/14BumOwVPYVfihuVhACg01FS
HT6Qr3arS3FWBkmzvAUnCa4=
=cv5V
-----END PGP SIGNATURE-----
