Date: Wed, 31 Jan 2001 02:18:25 +0100
From: Roman Drahtmueller draht@SUSE.DE
To: BUGTRAQ@SECURITYFOCUS.COM
Subject: SuSE Security Announcement: bind8 (SuSE-SA:2001:03)
SuSE Security Announcement
Package: bind8
Announcement-ID: SuSE-SA:2001:03
Date: Tuesday, January 30th, 2000 23:40 MEST
Affected SuSE versions: 6.0, 6.1, 6.2, 6.3, 6.4, 7.0, 7.1
Vulnerability Type: remote root compromise
Severity (1-10): 9
SuSE default package: no
Other affected systems: all systems using bind, versions before
8.2.3-REL
Content of this advisory:
1) security vulnerability resolved: bind8
problem description, discussion, solution and upgrade information
2) pending vulnerabilities, solutions, workarounds
3) standard appendix (further information)
1) problem description, brief discussion, solution, upgrade
information
bind-8.x in all versions of the SuSE distributions contain a bug
in the transaction signature handling code that can allow to
remotely over- flow a buffer and thereby execute arbitrary code as
the user running the nameserver (this is user named by default on
SuSE systems). In addition to this bug, another problem allows for
a remote attacker to collect information about the running bind
process (this has been found by Claudio Musmarra ). For more
information on these bugs, please visit the CERT webpage at
http://www.cert.org/advisories/CA-2001-02.html
and the bind bugs webpage at http://www.isc.org/products/BIND/bind-security.html
.
The problem is existent in the upcoming SuSE distribution 7.1
that will be available by February 10th in the CD/DVD version.
There exists no reasonable method to circumvent the problems
other than to update the package as described below.
Please choose the update package for your distribution from the
URLs listed below and download the necessary rpm files. Then,
install the package using the command `rpm -Uhv file.rpm´.
rpm packages have an internal md5 checksum that protects against
file corruption. You can verify this checksum using the command
(independently from the md5 signatures below)
`rpm –checksig –nogpg file.rpm’,
The md5 sums under each package are to prove the package
authenticity, independently from the md5 checksums in the rpm
package format.
SPECIAL INSTALL INSTRUCTIONS:
If you run a bind8 nameserver on your system, please update the
package immediately. In order for the updated package to become
active, the nameserver process “named” needs to be restarted. Do
this using the command
`rcnamed restart´
as root after performing the rpm command as shown above.
Afterwards, check for the running daemon using the ps command as
`ps aux´. The named process should show a new starting time.
Repeat the `rcnamed restart´ command if the nameserver shut
down too slowly to release the socket for the new server.
i386 Intel Platform:
SuSE-7.1
ftp://ftp.suse.com/pub/suse/i386/update/7.1/n2/bind8-8.2.3-92.i386.rpm
e9b354dbd96f6216b9da01f2b3a0a166
source rpm:
ftp://ftp.suse.com/pub/suse/i386/update/7.1/zq1/bind8-8.2.3-92.src.rpm
f77200a6c476b58980f68b5db3fd7c4b
SuSE-7.0
ftp://ftp.suse.com/pub/suse/i386/update/7.0/n1/bind8-8.2.3-61.i386.rpm
4fdee7483fce85f2a31a1a53d2b01b76
source rpm:
ftp://ftp.suse.com/pub/suse/i386/update/7.0/zq1/bind8-8.2.3-61.src.rpm
e53896d1ddfb405774a492469621af02
SuSE-6.4
ftp://ftp.suse.com/pub/suse/i386/update/6.4/n1/bind8-8.2.3-0.i386.rpm
bb25cb6ba2e54bf929f61c14b3663b3e
source rpm:
ftp://ftp.suse.com/pub/suse/i386/update/6.4/zq1/bind8-8.2.3-0.src.rpm
1033f0df4b747f1d2758fdae69a5fa17
SuSE-6.3
ftp://ftp.suse.com/pub/suse/i386/update/6.3/n1/bind8-8.2.3-0.i386.rpm
73fe798d4afb87beecb2546ecf076f64
source rpm:
ftp://ftp.suse.com/pub/suse/i386/update/6.3/zq1/bind8-8.2.3-0.src.rpm
dfe4e452d8d0a0a8ff0994e514353b3f
SuSE-6.2
ftp://ftp.suse.com/pub/suse/i386/update/6.2/n1/bind8-8.2.3-0.i386.rpm
48b45d14724e852810de130864ab8281
source rpm:
ftp://ftp.suse.com/pub/suse/i386/update/6.2/zq1/bind8-8.2.3-0.src.rpm
22ca23ed06739effc887370bfef2d83e
SuSE-6.1
ftp://ftp.suse.com/pub/suse/i386/update/6.1/n1/bind8-8.2.3-0.i386.rpm
fc9cd0970c15246599f90ce1f5955f29
source rpm:
ftp://ftp.suse.com/pub/suse/i386/update/6.1/zq1/bind8-8.2.3-0.src.rpm
6cdf2e5c3a9a25ca98f8916de677cb70
SuSE-6.0
Please use the SuSE-6.1 packages for the SuSE-6.0 distribution on
the i386 Intel Platform.
AXP Alpha Platform:
SuSE-7.0
ftp://ftp.suse.com/pub/suse/axp/update/7.0/n1/bind8-8.2.3-39.alpha.rpm
84014e0f19e52a09b90897e18d8eb774
source rpm:
ftp://ftp.suse.com/pub/suse/axp/update/7.0/zq1/bind8-8.2.3-39.src.rpm
99df556319e0c232d78cdb69d5d28ac0
SuSE-6.4
ftp://ftp.suse.com/pub/suse/axp/update/6.4/n1/bind8-8.2.3-0.alpha.rpm
2e2a8f6c3c6838a7fd49bd7926fc3de3
source rpm:
ftp://ftp.suse.com/pub/suse/axp/update/6.4/zq1/bind8-8.2.3-0.src.rpm
9b0c2e8469f597f43010a125af8f54fe
SuSE-6.3
ftp://ftp.suse.com/pub/suse/axp/update/6.3/n1/bind8-8.2.3-0.alpha.rpm
0194fc4461ef902c46b75f28fa8f2ef6
source rpm:
ftp://ftp.suse.com/pub/suse/axp/update/6.3/zq1/bind8-8.2.3-0.src.rpm
dffa2d911f6dae9092301bd8ad4f026f
SuSE-6.1
ftp://ftp.suse.com/pub/suse/axp/update/6.1/n1/bind8-8.2.3-0.alpha.rpm
ebd233233829eef3d73db7d0a828c35a
source rpm:
ftp://ftp.suse.com/pub/suse/axp/update/6.1/zq1/bind8-8.2.3-0.src.rpm
582e7985719d3f7da86a77349aa1611d
PPC Power PC Platform:
SuSE-7.0
ftp://ftp.suse.com/pub/suse/ppc/update/7.0/n1/bind8-8.2.3-39.ppc.rpm
b9354106b0b89edf8f1883b2ea50e656
source rpm:
ftp://ftp.suse.com/pub/suse/ppc/update/7.0/zq1/bind8-8.2.3-39.src.rpm
534d84e900c6edf3fa8f2ef546d08c0a
SuSE-6.4
ftp://ftp.suse.com/pub/suse/ppc/update/6.4/n1/bind8-8.2.3-0.ppc.rpm
5c3a00ebd3ddb0388e460673bfec88d0
source rpm:
ftp://ftp.suse.com/pub/suse/ppc/update/6.4/zq1/bind8-8.2.3-0.src.rpm
418ae09b44885199f4a4403748b6ab2b
Sparc Platform:
Due to build bottlenecks, the update package for the sparc platform
(SuSE-7.0 distribution) is delayed.
2) Pending vulnerabilities in SuSE Distributions and
Workarounds:
SuSE distributions contain the bind nameserver in Version 4 as
well. bind-4.x in the currently used version has security-related
bugs, some of which are similar to the ones in the 8.x versions. We
will provide update packages as well as an announcement for the
bind (not bind8) package shortly, along with an own
announcement.
3) standard appendix:
SuSE runs two security mailing lists to which any interested
party may subscribe:
suse-security@suse.com
– general/linux/SuSE security discussion.
All SuSE security announcements are sent to this list. To
subscribe, send an email to suse-security-subscribe@suse.com.
suse-security-announce@suse.com
– SuSE’s announce-only mailing list.
Only SuSE’s security annoucements are sent to this list. To
subscribe, send an email to suse-security-announce-subscribe@suse.com.
For general information or the frequently asked questions (faq)
send mail to:
suse-security-info@suse.com
or
suse-security-faq@suse.com
respectively.
SuSE’s security contact is security@suse.com.
Regards,
Roman Drahtmüller.
- - --
- - | Roman Drahtmüller draht@suse.de // "Caution: Cape does | SuSE GmbH - Security Phone: // not enable user to fly." | Nürnberg, Germany +49-911-740530 // (Batman Costume warning label) | -