| Summary: | net-dns/bind: Zone Transfer TSIG Handling Denial of Service (CVE-2006-2073) | ||
|---|---|---|---|
| Product: | Gentoo Security | Reporter: | Raphael Marichez (Falco) (RETIRED) <falco> |
| Component: | Vulnerabilities | Assignee: | Gentoo Security <security> |
| Status: | RESOLVED FIXED | ||
| Severity: | minor | CC: | bernd, bind+disabled, chainsaw, gengor, voxus, wschlich |
| Priority: | High | ||
| Version: | unspecified | ||
| Hardware: | All | ||
| OS: | Linux | ||
| URL: | http://secunia.com/advisories/19808/ | ||
| Whiteboard: | C3 [noglsa] jaervosz | ||
| Package list: | Runtime testing required: | --- | |
| Bug Depends on: | 158217, 181556 | ||
| Bug Blocks: | |||
|
Description
Raphael Marichez (Falco) (RETIRED)
2006-04-26 07:02:20 UTC
i mark it as a B3 and not A3, since the attacker must be authorized for zone transfer, and have valid TSIG. This is CVE-2006-2073. It may be fixed in an upcoming release, if this corresponds : * Handle unexpected TSIGs on unsigned AXFR/IXFR responses more gracefully. [RT #15941] Still nothing upstream apparently (according to Secunia). fyi: 9.2.7/9.3.3 added to portage. x86 stable for both versions IMHO this is not fixed upstream yet. (In reply to comment #6) > IMHO this is not fixed upstream yet. > and according to secunia too seems that version 9.4 fixes it: http://www.isc.org/index.pl?/sw/bind/ Pierre-Yves do you have a more exact reference? hmm sorry the link doesn't work (perl url...crap). But if you click on "BIND 9.4.0" under current release, and then scroll down to the release notes, you see: 2066. [security] Handle SIG queries gracefully. [RT #16300] So I think 9.4.0 is ok sorry I misread, in fact it's not entry 2066 but 2013: 2013. [bug] Handle unexpected TSIGs on unsigned AXFR/IXFR responses more gracefully. [RT #15941] Fixed in 9.4.0a5. Thx that is all I need. Bind what are your plans on stabling 9.4? Thanks Pierre-Yves; voxus / bind team, any decision here? any news here? I see that ~9.4.1 is in the tree, is it ok for asking stabilisation? I run BIND 9.4.1 on x86. As the junior member of the bind herd, I support stabilization. :) Bind what are your plans on stabling 9.4? Bind what are your plans on stabling 9.4? Bind what are your plans on stabling 9.4? i'm a (rather *silent* listener-)member of the BIND herd, as I've to do really *much* of DNS administration at work. however, I don't feel well in stabelizing an arch I'm not on, so I stabelized for amd64 for bind and bind-tools as I'm already using them quite a while now. So it's stable on: alpha amd64 ppc64 sparc x86 and still testing on: ~hppa ~ia64 ~mips ~ppc looks to me, as if the main archs already stabelized bind so far, jaervosz. CCing arch, so they do know about. ppc stable as per #181556 Sorry Christian, I didn't check wether it was stabled since I first started asking and I even upgraded to 9.4 myself, duh! This one is ready for GLSA decision. I vote NO. Stable on hppa. I tend to vote NO. mips stable on both bind and bind-tools. ia64 stable Security please vote. I also vote no, since the remote server has to already be authorized for zone transfer. 2 NO votes, closing without glsa. feel free to reopen if you disagree. |