U radu programskog paketa BIND uočen je sigurnosni nedostatak. Moguće ga je iskoristiti udaljeno za izvođenje napada uskraćivanjem usluge (eng. Denial of Service).
Paket:
BIND 9.x
Operacijski sustavi:
Mandriva Linux 2010.1, Mandriva Linux 2011, Mandriva Linux Enterprise Server 5.0
Problem:
neodgovarajuće rukovanje datotekama
Iskorištavanje:
udaljeno
Posljedica:
uskraćivanje usluga (DoS)
Rješenje:
programska zakrpa proizvođača
CVE:
CVE-2011-4313
Izvorni ID preporuke:
MDVSA-2011:176
Izvor:
Mandriva
Problem:
Nedostatak je uzrokovan nepravilnošću koja se očituje prilikom zapisivanja pogreške u datoteci "query.c".
Posljedica:
Napadaču omogućuje izvođenje DoS napada.
Rješenje:
Korisnicima se savjetuje instalacija ispravljenih inačica.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
_______________________________________________________________________
Mandriva Linux Security Advisory MDVSA-2011:176
http://www.mandriva.com/security/
_______________________________________________________________________
Package : bind
Date : November 16, 2011
Affected: 2010.1, 2011., Enterprise Server 5.0
_______________________________________________________________________
Problem Description:
A vulnerability was discovered and corrected in bind:
Cache lookup could return RRSIG data associated with nonexistent
records, leading to an assertion failure. [ISC RT #26590]
(CVE-2011-4313).
The updated packages have been upgraded to bind 9.7.4-P1 and 9.8.1-P1
which is not vulnerable to this issue.
_______________________________________________________________________
References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4313
http://www.isc.org/software/bind/advisories/cve-2011-4313
_______________________________________________________________________
Updated Packages:
Mandriva Linux 2010.1:
2d3b31654b6494187749b4f871b14923
2010.1/i586/bind-9.7.4-0.0.P1.1.1mdv2010.2.i586.rpm
a8792938bf48338166220b905440ee54
2010.1/i586/bind-devel-9.7.4-0.0.P1.1.1mdv2010.2.i586.rpm
8b6cc9af1985e1cc70ca9a185ecd7d88
2010.1/i586/bind-doc-9.7.4-0.0.P1.1.1mdv2010.2.i586.rpm
b66d1e222c2fff043b98c4fbd68bad99
2010.1/i586/bind-utils-9.7.4-0.0.P1.1.1mdv2010.2.i586.rpm
492789df209a55647a4ccc5cf87e2e91
2010.1/SRPMS/bind-9.7.4-0.0.P1.1.1mdv2010.2.src.rpm
Mandriva Linux 2010.1/X86_64:
62e1a52fd185b94d86eeeb0a8e66bfdc
2010.1/x86_64/bind-9.7.4-0.0.P1.1.1mdv2010.2.x86_64.rpm
f16cab9fcd24b3a61c387f50207b46a6
2010.1/x86_64/bind-devel-9.7.4-0.0.P1.1.1mdv2010.2.x86_64.rpm
1103883750bae0e68ed333f00dd4b36e
2010.1/x86_64/bind-doc-9.7.4-0.0.P1.1.1mdv2010.2.x86_64.rpm
92438b3290af09ba21a5f6d5187ee326
2010.1/x86_64/bind-utils-9.7.4-0.0.P1.1.1mdv2010.2.x86_64.rpm
492789df209a55647a4ccc5cf87e2e91
2010.1/SRPMS/bind-9.7.4-0.0.P1.1.1mdv2010.2.src.rpm
Mandriva Linux 2011:
c37eb09a2ed979d4bf4fa4fb792f15af
2011/i586/bind-9.8.1-0.0.P1.0.1-mdv2011.0.i586.rpm
91a4c4e3db01e88e527663b405ef4571
2011/i586/bind-devel-9.8.1-0.0.P1.0.1-mdv2011.0.i586.rpm
bc0c40ec0685d07f976e6e834c23c3be
2011/i586/bind-doc-9.8.1-0.0.P1.0.1-mdv2011.0.i586.rpm
3cdc252def4b8eac42f2d4d0ff04b800
2011/i586/bind-utils-9.8.1-0.0.P1.0.1-mdv2011.0.i586.rpm
e46827c8d77ec5b00bbec1f93b6fe499 2011/SRPMS/bind-9.8.1-0.0.P1.0.1.src.rpm
Mandriva Linux 2011/X86_64:
494a59c1827d2cec1efe93db373c1752
2011/x86_64/bind-9.8.1-0.0.P1.0.1-mdv2011.0.x86_64.rpm
96b000b967c1a01bdf0118741f099b81
2011/x86_64/bind-devel-9.8.1-0.0.P1.0.1-mdv2011.0.x86_64.rpm
ddae31ec6a490758570c722e51344001
2011/x86_64/bind-doc-9.8.1-0.0.P1.0.1-mdv2011.0.x86_64.rpm
764ec90bb6cfc9c4218c4cb397d89f6d
2011/x86_64/bind-utils-9.8.1-0.0.P1.0.1-mdv2011.0.x86_64.rpm
e46827c8d77ec5b00bbec1f93b6fe499 2011/SRPMS/bind-9.8.1-0.0.P1.0.1.src.rpm
Mandriva Enterprise Server 5:
11c499a9ab0cac4c8c716e8a220c3552
mes5/i586/bind-9.7.4-0.0.P1.1.1mdvmes5.2.i586.rpm
9261b3ba8efaabc2ca7cfc229b2d9d57
mes5/i586/bind-devel-9.7.4-0.0.P1.1.1mdvmes5.2.i586.rpm
cf550b499f63ae0d52e88f4fae180888
mes5/i586/bind-doc-9.7.4-0.0.P1.1.1mdvmes5.2.i586.rpm
c68ffe41db6fcf89e551f63bdf8daf1b
mes5/i586/bind-utils-9.7.4-0.0.P1.1.1mdvmes5.2.i586.rpm
eaa7fa5deb5a2573f948405de34e1ab8
mes5/SRPMS/bind-9.7.4-0.0.P1.1.1mdvmes5.2.src.rpm
Mandriva Enterprise Server 5/X86_64:
e6368866d024f416ed02d0f7d6fd25d5
mes5/x86_64/bind-9.7.4-0.0.P1.1.1mdvmes5.2.x86_64.rpm
e5bded5a3074bbb9105aa045ea9d2c19
mes5/x86_64/bind-devel-9.7.4-0.0.P1.1.1mdvmes5.2.x86_64.rpm
d7bb912ea4b8d55fefe9a30d7c591937
mes5/x86_64/bind-doc-9.7.4-0.0.P1.1.1mdvmes5.2.x86_64.rpm
e96231f2e22f7e0f36d0ee9c1cd929b9
mes5/x86_64/bind-utils-9.7.4-0.0.P1.1.1mdvmes5.2.x86_64.rpm
eaa7fa5deb5a2573f948405de34e1ab8
mes5/SRPMS/bind-9.7.4-0.0.P1.1.1mdvmes5.2.src.rpm
_______________________________________________________________________
To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.
All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:
gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98
You can view other update advisories for Mandriva Linux at:
http://www.mandriva.com/security/advisories
If you want to report vulnerabilities, please contact
security_(at)_mandriva.com
_______________________________________________________________________
Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
<security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
iD8DBQFOxClwmqjQ0CJFipgRAiq4AKCGYSRwM6CcQe+fN3Kzw6+FslS34wCg7BL+
QPH+z7nL/3qDzWL26oEn7Ec=
=4U7e
-----END PGP SIGNATURE-----
Posljednje sigurnosne preporuke