-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ________________________________________________________________________ OpenPKG Security Advisory The OpenPKG Project http://www.openpkg.org/security.html http://www.openpkg.org openpkg-securityat_private openpkgat_private OpenPKG-SA-2002.006 04-Jul-2002 ________________________________________________________________________ Package: bind Vulnerability: buffer overflow vulnerability OpenPKG Specific: no Affected Releases: OpenPKG 1.0 Affected Packages: <= bind-8.2.5-1.0.0 Corrected Packages: >= bind-8.2.6-1.0.1 Dependent Packages: - Description: According to CERT Advisory CA-2002-19 [5] a buffer overflow vulnerability exists in multiple implementations of DNS resolver libraries. Applications that utilize vulnerable DNS resolver libraries may be affected. For the OpenPKG bind package this means that the included utilities dig, host, nslookup and nsupdate are affected. Please note that the named server itself is not affected. A remote attacker who is able to send malicious DNS responses could potentially exploit this vulnerability to execute arbitrary code or cause a denial of service on a vulnerable system. Note that a possible attack would be performed by a DNS response, thus bypassing any firewall. For more details and background information see the corresponding NetBSD Security Advisory 2002-006 [6]. The Internet Software Consortium (ISC) Berkeley Internet Name Domain (BIND) Vulnerabilities Summary table [7] shows that for the 8.2.x track of BIND the DNS resolver library (libbind) issue is fixed in 8.2.6. Please check whether you are affected by running "<prefix>/bin/rpm -q bind". If you have the "bind" package installed and its version is affected (see above), we recommend that you immediately upgrade it (see Solution). Solution: Select the updated source RPM appropriate for your OpenPKG release [4], fetch it from the OpenPKG FTP service [3] or a mirror location, verify its integrity [1], build a corresponding binary RPM from it and update your OpenPKG installation by applying the binary RPM [2]. For the latest OpenPKG 1.0 release, perform the following operations to permanently fix the security problem (for other releases adjust accordingly). $ ftp ftp.openpkg.org ftp> bin ftp> cd release/1.0/UPD ftp> get bind-8.2.6-1.0.1.src.rpm ftp> bye $ <prefix>/bin/rpm --checksig bind-8.2.6-1.0.1.src.rpm $ <prefix>/bin/rpm --rebuild bind-8.2.6-1.0.1.src.rpm $ su - # <prefix>/bin/rpm -Fvh <prefix>/RPM/PKG/bind-8.2.6-1.0.1.*.rpm # <prefix>/etc/rc bind stop start ________________________________________________________________________ References: [1] http://www.openpkg.org/security.html#signature [2] http://www.openpkg.org/tutorial.html#regular-source [3] ftp://ftp.openpkg.org/release/1.0/UPD/ [4] ftp://ftp.openpkg.org/release/1.0/UPD/bind-8.2.6-1.0.1.src.rpm [5] http://www.cert.org/advisories/CA-2002-19.html [6] ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2002-006.txt.asc [7] http://www.isc.org/products/BIND/bind-security.html ________________________________________________________________________ For security reasons, this advisory was digitally signed with the OpenPGP public key "OpenPKG <openpkgat_private>" (ID 63C4CB9F) of the OpenPKG project which you can find under the official URL http://www.openpkg.org/openpkg.pgp or on http://keyserver.pgp.com/. To check the integrity of this advisory, verify its digital signature by using GnuPG (http://www.gnupg.org/). For instance, pipe this message to the command "gpg --verify --keyserver keyserver.pgp.com". ________________________________________________________________________ -----BEGIN PGP SIGNATURE----- Comment: OpenPKG <openpkgat_private> iEYEARECAAYFAj0kV/0ACgkQgHWT4GPEy5947gCeMeR04Bag/GP3Oo7CzJxyHx2n RwkAnA5vN0nnuPNEZ7uiFFhgG07o2w0k =fugf -----END PGP SIGNATURE-----
This archive was generated by hypermail 2b30 : Thu Jul 04 2002 - 08:46:32 PDT