BIND: Incorrect signature verification

BIND: Incorrect signature verification Incomplete verification of RSA and DSA certificates might lead to spoofed records authenticated using DNSSEC. bind 2009-03-09 2009-03-09: 01 254134 257949 remote 9.4.3_p1 9.4.3_p1

ISC BIND is the Internet Systems Consortium implementation of the Domain Name System (DNS) protocol.

BIND does not properly check the return value from the OpenSSL functions to verify DSA (CVE-2009-0025) and RSA (CVE-2009-0265) certificates.

A remote attacker could bypass validation of the certificate chain to spoof DNSSEC-authenticated records.

There is no known workaround at this time.

All BIND users should upgrade to the latest version:


    # emerge --sync
    # emerge --ask --oneshot --verbose ">=net-dns/bind-9.4.3_p1"

CVE-2009-0025 CVE-2009-0265 p-y rbu rbu