Package name
bind
Date
2001-01-29
Advisory ID
MDKSA-2001:017
Affected versions
CS1.0 i586 , 6.1 i586 , 6.0 i586 , 7.0 i586 , 7.1 i586 , 7.2 i586

Problem description

Four problems exists in all versions of ISC BIND 4.9.x prior to 4.9.8 and 8.2.x prior to 8.2.3 (9.x is not affected). Version 8.2.x contains a buffer overflow in transaction signature (TSIG) handling code that can be exploited by an attacker to gain unauthorized privileged access to the system, allowing execution of arbitrary code. BIND 4 contains both a buffer overflow in the nslookupComplain() function, as well as an input validation error in the same function. These two flaws in BIND 4 can result in a Denial of Service or the execution of arbitrary code if successfully exploited. Finally, both BIND 4 and BIND 8 suffer from an information leak in the query processing code that allows a remote attacker to access the program stack, possibly exposing program and/or environment variables. This flaw is triggered by sending a specially formatted query to vulnerable BIND servers. Linux-Mandrake ships with ISC BIND 8 and is therefore vulnerable to the first and final vulnerabilities previously mentioned. The first vulnerability is limited because any access gained exploiting it will result in restricted access due to the named server running as the user and group named, not as root. It is highly recommended that all Linux-Mandrake users upgrade BIND immediately to the latest 8.2.3 version that fixes these vulnerabilities.

Updated packages

CS1.0 i586

 5ab9bf322cecb913c6649540d5819e3d  1.0.1/RPMS/bind-8.2.3-1.2mdk.i586.rpm
eac8d15ebdfaeb5add97c8a9e0058fa7  1.0.1/RPMS/bind-devel-8.2.3-1.2mdk.i586.rpm
df714be43fe1f122dcff839c85d00719  1.0.1/RPMS/bind-utils-8.2.3-1.2mdk.i586.rpm
066b6ff50f9ba62d76ecbc198d70b9dd  1.0.1/SRPMS/bind-8.2.3-1.2mdk.src.rpm

6.1 i586

 dc329783fa290dac8cd5a738df8a82d8  6.1/RPMS/bind-8.2.3-1.2mdk.i586.rpm
ad9b06a8481ccde39ef1eb7c597d043e  6.1/RPMS/bind-devel-8.2.3-1.2mdk.i586.rpm
3df3e8047e198aa0be440308ba74adb6  6.1/RPMS/bind-utils-8.2.3-1.2mdk.i586.rpm
066b6ff50f9ba62d76ecbc198d70b9dd  6.1/SRPMS/bind-8.2.3-1.2mdk.src.rpm

6.0 i586

 b21032656e21606c2163fa92e708b9d1  6.0/RPMS/bind-8.2.3-1.3mdk.i586.rpm
d685e01c45302c7bfad0da9635590f37  6.0/RPMS/bind-devel-8.2.3-1.3mdk.i586.rpm
5da61ce349d02aa15ac94190934e7b7b  6.0/RPMS/bind-utils-8.2.3-1.3mdk.i586.rpm
b1e26aa2666c5a35cff0496a863748b4  6.0/SRPMS/bind-8.2.3-1.3mdk.src.rpm

7.0 i586

 6d1b647fe11e466a4ee3ef75424da068  7.0/RPMS/bind-8.2.3-1.2mdk.i586.rpm
45d5e366eaf3b2c1cf7c9820e681de1d  7.0/RPMS/bind-devel-8.2.3-1.2mdk.i586.rpm
b3cc1eed184505ec95e34a9fd78e65e3  7.0/RPMS/bind-utils-8.2.3-1.2mdk.i586.rpm
066b6ff50f9ba62d76ecbc198d70b9dd  7.0/SRPMS/bind-8.2.3-1.2mdk.src.rpm

7.1 i586

 5ab9bf322cecb913c6649540d5819e3d  7.1/RPMS/bind-8.2.3-1.2mdk.i586.rpm
eac8d15ebdfaeb5add97c8a9e0058fa7  7.1/RPMS/bind-devel-8.2.3-1.2mdk.i586.rpm
df714be43fe1f122dcff839c85d00719  7.1/RPMS/bind-utils-8.2.3-1.2mdk.i586.rpm
066b6ff50f9ba62d76ecbc198d70b9dd  7.1/SRPMS/bind-8.2.3-1.2mdk.src.rpm

7.2 i586

 d4b18a2076c22cfc0df869195cc814bf  7.2/RPMS/bind-8.2.3-1.1mdk.i586.rpm
dcf1a804d54a64f7129e4b06addf8cae  7.2/RPMS/bind-devel-8.2.3-1.1mdk.i586.rpm
e8e3d17f7eff95611128ffaa9c43c65d  7.2/RPMS/bind-utils-8.2.3-1.1mdk.i586.rpm
d0b55e4166fc6470dad18aa91c1143c5  7.2/SRPMS/bind-8.2.3-1.1mdk.src.rpm

References