patch for named buffer overflow now available (fwd)

From: Jonas Eriksson (jeat_private)
Date: Fri Nov 15 2002 - 00:25:46 PST

Next message: securityat_private: "[Full-Disclosure] Security Update: [CSSA-2002-048.0] Linux: wwwoffled remote access vulnerability"

Previous message: mark_salaat_private: "bind 8 info update regarding ISS"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

---------- Forwarded message ----------
Date: Thu, 14 Nov 2002 19:12:41 -0700
From: Todd C. Miller <Todd.Millerat_private>
To: security-announceat_private
Subject: patch for named buffer overflow now available

A patch for the named buffer overflow is now available.  The bug
could allow an attacker to execute code as the user that named runs
as.  In the default OpenBSD named configuration, named runs as its
own, non-root, user in a chrooted jail.  This lessens the impact
of the bug to the level of a denial of service.  Anyone not running
named chrooted should start to do so immediately.

For more information on the bug, please see:
http://www.isc.org/products/BIND/bind-security.html
http://bvlive01.iss.net/issEn/delivery/xforce/alertdetail.jsp?oid=21469

The fix has been committed to OpenBSD-current as well as to the
3.2, 3.1 and 3.0 -stable branches.

The following patches are also available for OpenBSD 3.2, 3.1 and 3.0
respectively:

ftp://ftp.openbsd.org/pub/OpenBSD/patches/3.2/common/005_named.patch
ftp://ftp.openbsd.org/pub/OpenBSD/patches/3.1/common/019_named.patch
ftp://ftp.openbsd.org/pub/OpenBSD/patches/3.0/common/036_named.patch

Next message: securityat_private: "[Full-Disclosure] Security Update: [CSSA-2002-048.0] Linux: wwwoffled remote access vulnerability"
Previous message: mark_salaat_private: "bind 8 info update regarding ISS"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

This archive was generated by hypermail 2b30 : Mon Nov 18 2002 - 06:32:47 PST