-----BEGIN PGP SIGNED MESSAGE-----

______________________________________________________________________________

                        SuSE Security Announcement

        Package: bind8
        Announcement-ID: SuSE-SA:2001:03
        Date: Tuesday, January 30th, 2000 23:40 MEST
        Affected SuSE versions: 6.0, 6.1, 6.2, 6.3, 6.4, 7.0, 7.1
        Vulnerability Type: remote root compromise
        Severity (1-10): 9
        SuSE default package: no
        Other affected systems: all systems using bind, versions before
                                8.2.3-REL

    Content of this advisory:
        1) security vulnerability resolved: bind8
           problem description, discussion, solution and upgrade information
        2) pending vulnerabilities, solutions, workarounds
        3) standard appendix (further information)

______________________________________________________________________________

1) problem description, brief discussion, solution, upgrade information

    bind-8.x in all versions of the SuSE distributions contain a bug in the
    transaction signature handling code that can allow to remotely over-
    flow a buffer and thereby execute arbitrary code as the user running
    the nameserver (this is user named by default on SuSE systems).
    In addition to this bug, another problem allows for a remote attacker
    to collect information about the running bind process (this has been
    found by Claudio Musmarra <a9605121unet.univie.ac.at>).
    For more information on these bugs, please visit the CERT webpage at
    http://www.cert.org/advisories/CA-2001-02.html and the bind bugs
    webpage at http://www.isc.org/products/BIND/bind-security.html .

    The problem is existent in the upcoming SuSE distribution 7.1 that
    will be available by February 10th in the CD/DVD version.

    There exists no reasonable method to circumvent the problems other than
    to update the package as described below.

    Please choose the update package for your distribution from the
    URLs listed below and download the necessary rpm files. Then,
    install the package using the command `rpm -Uhv file.rpm´. rpm
    packages have an internal md5 checksum that protects against file
    corruption. You can verify this checksum using the command
    (independently from the md5 signatures below)
        `rpm --checksig --nogpg file.rpm',
    The md5 sums under each package are to prove the package authenticity,
    independently from the md5 checksums in the rpm package format.

    SPECIAL INSTALL INSTRUCTIONS:
    ==============================
    If you run a bind8 nameserver on your system, please update the package
    immediately. In order for the updated package to become active, the
    nameserver process "named" needs to be restarted. Do this using the
    command
        `rcnamed restart´
    as root after performing the rpm command as shown above. Afterwards,
    check for the running daemon using the ps command as `ps aux´. The
    named process should show a new starting time. Repeat the
    `rcnamed restart´ command if the nameserver shut down too slowly to
    release the socket for the new server.

    i386 Intel Platform:
    SuSE-7.1
    ftp://ftp.suse.com/pub/suse/i386/update/7.1/n2/bind8-8.2.3-92.i386.rpm
      e9b354dbd96f6216b9da01f2b3a0a166
    source rpm:
    ftp://ftp.suse.com/pub/suse/i386/update/7.1/zq1/bind8-8.2.3-92.src.rpm
      f77200a6c476b58980f68b5db3fd7c4b

    SuSE-7.0
    ftp://ftp.suse.com/pub/suse/i386/update/7.0/n1/bind8-8.2.3-61.i386.rpm
      4fdee7483fce85f2a31a1a53d2b01b76
    source rpm:
    ftp://ftp.suse.com/pub/suse/i386/update/7.0/zq1/bind8-8.2.3-61.src.rpm
      e53896d1ddfb405774a492469621af02

    SuSE-6.4
    ftp://ftp.suse.com/pub/suse/i386/update/6.4/n1/bind8-8.2.3-0.i386.rpm
      bb25cb6ba2e54bf929f61c14b3663b3e
    source rpm:
    ftp://ftp.suse.com/pub/suse/i386/update/6.4/zq1/bind8-8.2.3-0.src.rpm
      1033f0df4b747f1d2758fdae69a5fa17

    SuSE-6.3
    ftp://ftp.suse.com/pub/suse/i386/update/6.3/n1/bind8-8.2.3-0.i386.rpm
      73fe798d4afb87beecb2546ecf076f64
    source rpm:
    ftp://ftp.suse.com/pub/suse/i386/update/6.3/zq1/bind8-8.2.3-0.src.rpm
      dfe4e452d8d0a0a8ff0994e514353b3f

    SuSE-6.2
    ftp://ftp.suse.com/pub/suse/i386/update/6.2/n1/bind8-8.2.3-0.i386.rpm
      48b45d14724e852810de130864ab8281
    source rpm:
    ftp://ftp.suse.com/pub/suse/i386/update/6.2/zq1/bind8-8.2.3-0.src.rpm
      22ca23ed06739effc887370bfef2d83e

    SuSE-6.1
    ftp://ftp.suse.com/pub/suse/i386/update/6.1/n1/bind8-8.2.3-0.i386.rpm
      fc9cd0970c15246599f90ce1f5955f29
    source rpm:
    ftp://ftp.suse.com/pub/suse/i386/update/6.1/zq1/bind8-8.2.3-0.src.rpm
      6cdf2e5c3a9a25ca98f8916de677cb70

    SuSE-6.0
    Please use the SuSE-6.1 packages for the SuSE-6.0 distribution on the
    i386 Intel Platform.

    AXP Alpha Platform:

    SuSE-7.0
    ftp://ftp.suse.com/pub/suse/axp/update/7.0/n1/bind8-8.2.3-39.alpha.rpm
      84014e0f19e52a09b90897e18d8eb774
    source rpm:
    ftp://ftp.suse.com/pub/suse/axp/update/7.0/zq1/bind8-8.2.3-39.src.rpm
      99df556319e0c232d78cdb69d5d28ac0

    SuSE-6.4
    ftp://ftp.suse.com/pub/suse/axp/update/6.4/n1/bind8-8.2.3-0.alpha.rpm
      2e2a8f6c3c6838a7fd49bd7926fc3de3
    source rpm:
    ftp://ftp.suse.com/pub/suse/axp/update/6.4/zq1/bind8-8.2.3-0.src.rpm
      9b0c2e8469f597f43010a125af8f54fe

    SuSE-6.3
    ftp://ftp.suse.com/pub/suse/axp/update/6.3/n1/bind8-8.2.3-0.alpha.rpm
      0194fc4461ef902c46b75f28fa8f2ef6
    source rpm:
    ftp://ftp.suse.com/pub/suse/axp/update/6.3/zq1/bind8-8.2.3-0.src.rpm
      dffa2d911f6dae9092301bd8ad4f026f

    SuSE-6.1
    ftp://ftp.suse.com/pub/suse/axp/update/6.1/n1/bind8-8.2.3-0.alpha.rpm
      ebd233233829eef3d73db7d0a828c35a
    source rpm:
    ftp://ftp.suse.com/pub/suse/axp/update/6.1/zq1/bind8-8.2.3-0.src.rpm
      582e7985719d3f7da86a77349aa1611d

    PPC Power PC Platform:

    SuSE-7.0
    ftp://ftp.suse.com/pub/suse/ppc/update/7.0/n1/bind8-8.2.3-39.ppc.rpm
      b9354106b0b89edf8f1883b2ea50e656
    source rpm:
    ftp://ftp.suse.com/pub/suse/ppc/update/7.0/zq1/bind8-8.2.3-39.src.rpm
      534d84e900c6edf3fa8f2ef546d08c0a

    SuSE-6.4
    ftp://ftp.suse.com/pub/suse/ppc/update/6.4/n1/bind8-8.2.3-0.ppc.rpm
      5c3a00ebd3ddb0388e460673bfec88d0
    source rpm:
    ftp://ftp.suse.com/pub/suse/ppc/update/6.4/zq1/bind8-8.2.3-0.src.rpm
      418ae09b44885199f4a4403748b6ab2b

    Sparc Platform:
    Due to build bottlenecks, the update package for the sparc platform
    (SuSE-7.0 distribution) is delayed.

______________________________________________________________________________

2) Pending vulnerabilities in SuSE Distributions and Workarounds:

    SuSE distributions contain the bind nameserver in Version 4 as well.
    bind-4.x in the currently used version has security-related bugs,
    some of which are similar to the ones in the 8.x versions. We will
    provide update packages as well as an announcement for the bind
    (not bind8) package shortly, along with an own announcement.
______________________________________________________________________________

3) standard appendix:

    SuSE runs two security mailing lists to which any interested party may
    subscribe:

    suse-securitysuse.com
        - general/linux/SuSE security discussion.
            All SuSE security announcements are sent to this list.
            To subscribe, send an email to
                <suse-security-subscribesuse.com>.

    suse-security-announcesuse.com
        - SuSE's announce-only mailing list.
            Only SuSE's security annoucements are sent to this list.
            To subscribe, send an email to
                <suse-security-announce-subscribesuse.com>.

    For general information or the frequently asked questions (faq)
    send mail to:
        <suse-security-infosuse.com> or
        <suse-security-faqsuse.com> respectively.

    ===============================================
    SuSE's security contact is <securitysuse.com>.
    ===============================================

Regards,
Roman Drahtmüller.
- - --
 - -
| Roman Drahtmüller <drahtsuse.de> // "Caution: Cape does |
  SuSE GmbH - Security Phone: // not enable user to fly."
| Nürnberg, Germany +49-911-740530 // (Batman Costume warning label) |
 - -
______________________________________________________________________________

    The information in this advisory may be distributed or reproduced,
    provided that the advisory is not modified in any way.
    SuSE GmbH makes no warranties of any kind whatsoever with respect
    to the information contained in this security advisory.

Type Bits/KeyID Date User ID
pub 2048/3D25D3D9 1999/03/06 SuSE Security Team <securitysuse.de>

- -----BEGIN PGP PUBLIC KEY BLOCK-----
Version: 2.6.3i

mQENAzbhLQQAAAEIAKAkXHe0lWRBXLpn38hMHy03F0I4Sszmoc8aaKJrhfhyMlOA
BqvklPLE2f9UrI4Xc860gH79ZREwAgPt0pi6+SleNFLNcNFAuuHMLQOOsaMFatbz
JR9i4m/lf6q929YROu5zB48rBAlcfTm+IBbijaEdnqpwGib45wE/Cfy6FAttBHQh
1Kp+r/jPbf1mYAvljUfHKuvbg8t2EIQz/5yGp+n5trn9pElfQO2cRBq8LFpf1l+U
P7EKjFmlOq+Gs/fF98/dP3DfniSd78LQPq5vp8RL8nr/o2i7jkAQ33m4f1wOBWd+
cZovrKXYlXiR+Bf7m2hpZo+/sAzhd7LmAD0l09kABRG0JVN1U0UgU2VjdXJpdHkg
VGVhbSA8c2VjdXJpdHlAc3VzZS5kZT6JARUDBRA24S1H5Fiyh7HKPEUBAVcOB/9b
yHYji1/+4Xc2GhvXK0FSJN0MGgeXgW47yxDL7gmR4mNgjlIOUHZj0PEpVjWepOJ7
tQS3L9oP6cpj1Fj/XxuLbkp5VCQ61hpt54coQAvYrnT9rtWEGN+xmwejT1WmYmDJ
xG+EGBXKr+XP69oIUl1E2JO3rXeklulgjqRKos4cdXKgyjWZ7CP9V9daRXDtje63
Om8gwSdU/nCvhdRIWp/Vwbf7Ia8iZr9OJ5YuQl0DBG4qmGDDrvImgPAFkYFzwlqo
choXFQ9y0YVCV41DnR+GYhwl2qBd81T8aXhihEGPIgaw3g8gd8B5o6mPVgl+nJqI
BkEYGBusiag2pS6qwznZiQEVAwUQNuEtBHey5gA9JdPZAQFtOAf+KVh939b0J94u
v/kpg4xs1LthlhquhbHcKNoVTNspugiC3qMPyvSX4XcBr2PC0cVkS4Z9PY9iCfT+
x9WM96g39dAF+le2CCx7XISk9XXJ4ApEy5g4AuK7NYgAJd39PPbERgWnxjxir9g0
Ix30dS30bW39D+3NPU5Ho9TD/B7UDFvYT5AWHl3MGwo3a1RhTs6sfgL7yQ3U+mvq
MkTExZb5mfN1FeaYKMopoI4VpzNVeGxQWIz67VjJHVyUlF20ekOz4kWVgsxkc8G2
saqZd6yv2EwqYTi8BDAduweP33KrQc4KDDommQNDOXxaKOeCoESIdM4p7Esdjq1o
L0oixF12Cg==
=pIeS
- -----END PGP PUBLIC KEY BLOCK-----

-----BEGIN PGP SIGNATURE-----
Version: 2.6.3i
Charset: noconv

iQEVAwUBOndmjXey5gA9JdPZAQGwCwf/U0uWMe9nA8sQmu9C2scFsK5MYpNT0rgu
uEUnChBznoc7FzeeWt2I1sube0DiVx5qcZDY4M7u0/BK4VJCacZIHFgWpye1GseP
RU8bKhsUiujoplyiWb0Fm39AoKa5HGvAAdRFDNuMC7vt8FtKZic6JGm76MOlqVoD
a0hXd6E0Jr55juGxZ5eQqpKWPAR+EjUjEE+R79LQMG8K5FWKHqfwgO2tMNUASaj9
VDkdSTkZS2DX8JIoII6s4g9ksYS0gJds1zivfFdj0fVYcHzwPEvn/ZUv/Mukf2/b
MMDFIaTSGM/G751wRD7sYUhcJ5hxJ8qulsdMvLO8nBorh7IjMZSJrw==
=zKPn
-----END PGP SIGNATURE-----

-- 
To unsubscribe, e-mail: suse-security-announce-unsubscribesuse.com
For additional commands, e-mail: suse-security-announce-helpsuse.com

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]