Bug 176677

Summary:	net-dns/bind<9.4.1 querry_addsoa() DoS
Product:	Gentoo Security	Reporter:	Sune Kloppenborg Jeppesen (RETIRED) <jaervosz>
Component:	Vulnerabilities	Assignee:	Gentoo Security <security>
Status:	RESOLVED FIXED
Severity:	normal	CC:	bind+disabled
Priority:	High
Version:	unspecified
Hardware:	All
OS:	Linux
Whiteboard:	~3 [noglsa] jaervosz
Package list:		Runtime testing required:	---

Description Sune Kloppenborg Jeppesen (RETIRED) gentoo-dev

2007-05-01 12:38:38 UTC

Description:
A vulnerability has been reported in BIND, which can be exploited by malicious people to cause a DoS (Denial of Service).
 
 The vulnerability is caused due to an error when invoking the "query_addsoa()" function. This can be exploited to cause the nameserver to exit by sending a specially crafted sequence of queries.
 
 Successful exploitation requires that "recursion" is enabled.
 
 The vulnerability is reported in BIND version 9.4.0, and BIND versions 9.5.0a1, 9.5.0a2, and 9.5.0a3.

Solution:
Update to BIND 9.4.1.

Comment 1 Konstantin Arkhipov (RETIRED) gentoo-dev

2007-05-01 13:23:44 UTC

bind and bind-tools bumped to 9.4.1.

Comment 2 Sune Kloppenborg Jeppesen (RETIRED) gentoo-dev

2007-05-01 14:36:55 UTC

Thx Konstantin.

Closing with NO GLSA since 9.4 is not stable yet.