U radu programskog paketa unbound, na operacijskom sustavu Fedora 15, uočen je novi problem koji može dovesti do izvođenja DoS napada.
Paket:
unbound 1.x
Operacijski sustavi:
Fedora 15
Problem:
pogreška u programskoj komponenti
Iskorištavanje:
lokalno/udaljeno
Posljedica:
uskraćivanje usluga (DoS)
Rješenje:
programska zakrpa proizvođača
CVE:
CVE-2011-1922
Izvorni ID preporuke:
FEDORA-2011-7540
Izvor:
Fedora
Problem:
Problem se javlja u programskom kodu prilikom obrade određenih DNS upita koji uzrokuju da ranjivi paket generira poruku o pogrešci (prazna UDP poruka).
Posljedica:
Potencijalni, zlonamjerni korisnik može iskorititi navedeni nedostatak za izvođenje napada uskraćivanja usluge (DoS).
Rješenje:
Svi se korisnici upućuju na instalaciju dostupne nadogradnje.
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2011-7540
2011-05-26 21:13:10
--------------------------------------------------------------------------------
Name : unbound
Product : Fedora 15
Version : 1.4.8
Release : 5.fc15
URL : http://www.nlnetlabs.nl/unbound/
Summary : Validating, recursive, and caching DNS(SEC) resolver
Description :
Unbound is a validating, recursive, and caching DNS(SEC) resolver.
The C implementation of Unbound is developed and maintained by NLnet
Labs. It is based on ideas and algorithms taken from a java prototype
developed by Verisign labs, Nominet, Kirei and ep.net.
Unbound is designed as a set of modular components, so that also
DNSSEC (secure DNS) validation and stub-resolvers (that do not run
as a server, but are linked into an application) are easily possible.
--------------------------------------------------------------------------------
Update Information:
Denial of Service fix: CVE-2011-1922
--------------------------------------------------------------------------------
ChangeLog:
* Wed May 25 2011 Paul Wouters <Ova e-mail adresa je zaštićena od spambota. Potrebno je omogućiti JavaScript da je vidite.> - 1.4.8-5
- Applied patch for CVE-2011-1922 DoS vulnerability
--------------------------------------------------------------------------------
This update can be installed with the "yum" update program. Use
su -c 'yum update unbound' at the command line.
For more information, refer to "Managing Software with yum",
available at http://docs.fedoraproject.org/yum/.
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
_______________________________________________
package-announce mailing list
Ova e-mail adresa je zaštićena od spambota. Potrebno je omogućiti JavaScript da je vidite.
https://admin.fedoraproject.org/mailman/listinfo/package-announce
Posljednje sigurnosne preporuke