Csomag: bind
Sebezhetőség: számos
Probléma típus: távoli
Debian-specifikus: nem
CVE Id: CAN-2002-1219 CAN-2002-1220 CAN-2002-1221
CERT advisory: VU#844360 VU#852283 VU#229595 VU#542971
[A Bind 9-es verziója, a bind9 csomag, nem érintett ezekben a hibákban.]
A hibák leírását angolul idéztem be, a folytatásban:
ISS X-Force has discovered several serious vulnerabilities in the Berkeley Internet Name Domain Server (BIND). BIND is the most common implementation of the DNS (Domain Name Service) protocol, which is used on the vast majority of DNS servers on the Internet. DNS is a vital Internet protocol that maintains a database of easy-to-remember domain names (host names) and their corresponding numerical IP addresses.
Circumstancial evidence suggests that the Internet Software Consortium (ISC), maintainers of BIND, was made aware of these issues in mid-October. Distributors of Open Source operating systems, including Debian, were notified of these vulnerabilities via CERT about 12 hours before the release
of the advisories on November 12th. This notification did not include any details that allowed us to identify the vulnerable code, much less prepare timely fixes.
Unfortunately ISS and the ISC released their security advisories with only descriptions of the vulnerabilities, without any patches. Even though there were no signs that these exploits are known to the black-hat community, and there were no reports of active attacks, such attacks could have been developed in the meantime - with no fixes available.
We can all express our regret at the inability of the ironically named Internet Software Consortium to work with the Internet community in handling this problem. Hopefully this will not become a model for dealing with security issues in the future.
The Common Vulnerabilities and Exposures (CVE) project identified the following vulnerabilities:
1. CAN-2002-1219: A buffer overflow in BIND 8 versions 8.3.3 and earlier allows a remote attacker to execute arbitrary code via a certain DNS server response containing SIG resource records (RR). This buffer overflow can be exploited to obtain access to the victim host under the account the named process is running with, usually root.
2. CAN-2002-1220: BIND 8 versions 8.3.x through 8.3.3 allows a remote attacker to cause a denial of service (termination due to assertion failure) via a request for a subdomain that does not exist, with an OPT resource record with a large UDP payload size.
3. CAN-2002-1221: BIND 8 versions 8.x through 8.3.3 allows a remote attacker to cause a denial of service (crash) via SIG RR elements with invalid expiry times, which are removed from the internal BIND database and later cause a null dereference.
A probléma javítva van a 8.3.3-2.0woody1 verzióban, az aktuális stabil terjesztésben (woody), illetve a 8.2.3-0.potato.3 verzióban a régi stabil terjesztésben (potato), és a 8.3.3-3 verzióban az instabil (sid) terjesztésben. A javított csomagok még a mai napon (Dan Jacobowitz Nov 14-én küldte be a DS-re a levelet) az archívumba kerülnek.The fixed packages for unstable will enter the archive today.
A bind csomag azonnali frissítését javasoljuk, illetve bind9-re frissítést, vagy egy másik DNS szerver implementációra váltást.
Dan Jacobowitz levele a debian-security-announce listán.
A frissítésről szóló FAQ-nk.