Date: Thu, 12 Jul 2007 18:49:11 -0600
From: [email protected]Subject: [ MDKSA-2007:146 ] - Updated perl-Net-DNS packages fix multiple
vulnerabilities
To: [email protected]
Reply-To: [email protected]
Message-id: <E1I99LL-0002lq-Hq@artemis.annvix.ca.>
X-SA-Exim-Connect-IP: 10.0.5.11
X-SA-Exim-Mail-From: [email protected]
X-SA-Exim-Version: 4.2.1 (built Fri, 02 Feb 2007 19:02:33 -0700)
X-SA-Exim-Scanned: Yes (on hades.annvix.org)
X-Virus-Scanned: antivirus-gw at tyumen.ru
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
_______________________________________________________________________
Mandriva Linux Security Advisory MDKSA-2007:146
http://www.mandriva.com/security/
_______________________________________________________________________
Package : perl-Net-DNS
Date : July 12, 2007
Affected: 2007.0, 2007.1, Corporate 3.0, Corporate 4.0
_______________________________________________________________________
Problem Description:
A flaw was discovered in the perl Net::DNS module in the way it
generated the ID field in a DNS query. Because it is so predictable,
a remote attacker could exploit this to return invalid DNS data
(CVE-2007-3377).
A denial of service vulnerability was found in how Net::DNS parsed
certain DNS requests. A malformed response to a DNS request could
cause the application using Net::DNS to crash or stop responding
(CVE-2007-3409).
The updated packages have been patched to prevent these issues.
_______________________________________________________________________
References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3377http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3409
_______________________________________________________________________
Updated Packages:
Mandriva Linux 2007.0:
92d215a4965bb8d944c030cf1dd73a11 2007.0/i586/perl-Net-DNS-0.58-1.1mdv2007.0.i586.rpm
06c1dd9d596004e261a9706060a4c167 2007.0/SRPMS/perl-Net-DNS-0.58-1.1mdv2007.0.src.rpm
Mandriva Linux 2007.0/X86_64:
34bc7cfb39bd239dea991559a05f66b7 2007.0/x86_64/perl-Net-DNS-0.58-1.1mdv2007.0.x86_64.rpm
06c1dd9d596004e261a9706060a4c167 2007.0/SRPMS/perl-Net-DNS-0.58-1.1mdv2007.0.src.rpm
Mandriva Linux 2007.1:
cd6db816556ae5f3c172dafb5ee98002 2007.1/i586/perl-Net-DNS-0.59-1.1mdv2007.1.i586.rpm
dc954016fe3924ab2a362285cd780636 2007.1/SRPMS/perl-Net-DNS-0.59-1.1mdv2007.1.src.rpm
Mandriva Linux 2007.1/X86_64:
d9cbd72d34d8eab851473716740290f3 2007.1/x86_64/perl-Net-DNS-0.59-1.1mdv2007.1.x86_64.rpm
dc954016fe3924ab2a362285cd780636 2007.1/SRPMS/perl-Net-DNS-0.59-1.1mdv2007.1.src.rpm
Corporate 3.0:
338edc98b82b661a4245c8dfdea463fa corporate/3.0/i586/perl-Net-DNS-0.39-2.1.C30mdk.i586.rpm
eeeb5c182365d9726f36326892065015 corporate/3.0/SRPMS/perl-Net-DNS-0.39-2.1.C30mdk.src.rpm
Corporate 3.0/X86_64:
e47654bec20760643ce0e4d7b78ab394 corporate/3.0/x86_64/perl-Net-DNS-0.39-2.1.C30mdk.x86_64.rpm
eeeb5c182365d9726f36326892065015 corporate/3.0/SRPMS/perl-Net-DNS-0.39-2.1.C30mdk.src.rpm
Corporate 4.0:
51e6714b343575136bf296a495c32de3 corporate/4.0/i586/perl-Net-DNS-0.52-1.1.20060mlcs4.i586.rpm
862ceacd8ba656dee551039d5074dd46 corporate/4.0/SRPMS/perl-Net-DNS-0.52-1.1.20060mlcs4.src.rpm
Corporate 4.0/X86_64:
99cb67c8f400c7f826ce63702e863508 corporate/4.0/x86_64/perl-Net-DNS-0.52-1.1.20060mlcs4.x86_64.rpm
862ceacd8ba656dee551039d5074dd46 corporate/4.0/SRPMS/perl-Net-DNS-0.52-1.1.20060mlcs4.src.rpm
_______________________________________________________________________
To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.
All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:
gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98
You can view other update advisories for Mandriva Linux at:
http://www.mandriva.com/security/advisories
If you want to report vulnerabilities, please contact
security_(at)_mandriva.com
_______________________________________________________________________
Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
<security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.7 (GNU/Linux)
iD8DBQFGlqB9mqjQ0CJFipgRAtR2AJ9k0gv3DiQhhRnitqXz+ZDG2OimbwCfacXe
aq9g2vyl8V79tBNKBAMG5VY=
=OBVo
-----END PGP SIGNATURE-----
