Gentoo Logo

BIND: Multiple vulnerabilities

Content:

1.  Gentoo Linux Security Advisory

Version Information

Advisory Reference GLSA 201209-04 / bind
Release Date September 24, 2012
Latest Revision September 24, 2012: 1
Impact normal
Exploitable remote
Package Vulnerable versions Unaffected versions Architecture(s)
net-dns/bind < 9.9.1_p3 >= 9.9.1_p3 All supported architectures

Related bugreports: #402661, #419637, #427966, #434876

Synopsis

Multiple vulnerabilities have been found in BIND, the worst of which may allow remote Denial of Service.

2.  Impact Information

Background

BIND is the Berkeley Internet Name Domain Server.

Description

Multiple vulnerabilities have been discovered in BIND:

  • Domain names are not properly revoked due to an error in the cache update policy (CVE-2012-1033).
  • BIND accepts records with zero-length RDATA fields (CVE-2012-1667).
  • An assertion failure from the failing-query cache could occur when DNSSEC validation is enabled (CVE-2012-3817).
  • A memory leak may occur under high TCP query loads (CVE-2012-3868).
  • An assertion error can occur when a query is performed for a record with RDATA greater than 65535 bytes (CVE-2012-4244).

Impact

A remote attacker may be able to cause a Denial of Service condition or keep domain names resolvable after it has been deleted from registration.

3.  Resolution Information

Workaround

There is no known workaround at this time.

Resolution

All BIND users should upgrade to the latest version:

Code Listing 3.1: Resolution

  # emerge --sync
  # emerge --ask --oneshot --verbose ">=net-dns/bind-9.9.1_p3"

4.  References



Print

Page updated September 24, 2012

Summary: This is a Gentoo Linux Security Advisory

Security Team
Contact Address

Donate to support our development efforts.

Copyright 2001-2014 Gentoo Foundation, Inc. Questions, Comments? Contact us.