You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

78 lines
2.5 KiB

<?xml version="1.0" encoding="utf-8"?>
<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
<glsa id="200702-06">
<title>BIND: Denial of Service</title>
<synopsis>
ISC BIND contains two vulnerabilities allowing a Denial of Service under
certain conditions.
</synopsis>
<product type="ebuild">bind</product>
<announced>2007-02-17</announced>
<revised count="01">2007-02-17</revised>
<bug>163692</bug>
<access>remote</access>
<affected>
<package name="net-dns/bind" auto="yes" arch="*">
<unaffected range="ge">9.3.4</unaffected>
<unaffected range="rge">9.2.8</unaffected>
<vulnerable range="lt">9.3.4</vulnerable>
</package>
</affected>
<background>
<p>
ISC BIND is the Internet Systems Consortium implementation of the
Domain Name System (DNS) protocol.
</p>
</background>
<description>
<p>
An unspecified improper usage of an already freed context has been
reported. Additionally, an assertion error could be triggered in the
DNSSEC validation of some responses to type ANY queries with multiple
RRsets.
</p>
</description>
<impact type="normal">
<p>
A remote attacker could crash the server through unspecified vectors
or, if DNSSEC validation is enabled, by sending certain crafted ANY
queries.
</p>
</impact>
<workaround>
<p>
There is no known workaround at this time for the first issue. The
DNSSEC validation Denial of Service can be prevented by disabling
DNSSEC validation until the upgrade to a fixed version. Note that
DNSSEC validation is disabled on a default configuration.
</p>
</workaround>
<resolution>
<p>
All ISC BIND 9.3 users should upgrade to the latest version:
</p>
<code>
# emerge --sync
# emerge --ask --oneshot --verbose "&gt;=net-dns/bind-9.3.4"</code>
<p>
All ISC BIND 9.2 users should upgrade to the latest version:
</p>
<code>
# emerge --sync
# emerge --ask --oneshot --verbose "&gt;=net-dns/bind-9.2.8"</code>
</resolution>
<references>
<uri link="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0493">CVE-2007-0493</uri>
<uri link="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0494">CVE-2007-0494</uri>
</references>
<metadata tag="requester" timestamp="2007-02-16T09:07:21Z">
falco
</metadata>
<metadata tag="submitter" timestamp="2007-02-16T17:39:52Z">
falco
</metadata>
<metadata tag="bugReady" timestamp="2007-02-17T15:53:00Z">
falco
</metadata>
</glsa>