FS#10880 - Big security issue in DNS protocol. bind must be upgraded.

Attached to Project: Arch Linux
Opened by Damien Herraud (bapman) - Thursday, 10 July 2008, 16:25 GMT
Last edited by Kevin Piche (kpiche) - Monday, 14 July 2008, 02:07 GMT
Task Type Bug Report
Category Packages: Extra
Status Closed
Assigned To Kevin Piche (kpiche)
Architecture All
Severity Critical
Priority Normal
Reported Version 2007.08-2
Due in Version Undecided
Due Date Undecided
Percent Complete 100%
Votes 5
Private No

Details

Description:

The security issue is described here : http://www.kb.cert.org/vuls/id/800113
or : http://www.isc.org/sw/bind/bind-security.php.

bind must be upgraded to 9.5.0-P1

I doubt that anybody uses Arch to run a public DNS server so I didn't put a critical security level !

Note that every DNS server software must be upgraded since the issue is in the DNS protocol, not in the code. I only know bind...



Additional info:
* package version(s) : bind 9.4.2-1 in Extra and bind 9.5.0-1 in Testing are not up-to-date and so concerned by the security issue.
This task depends upon

Closed by  Kevin Piche (kpiche)
Monday, 14 July 2008, 02:07 GMT
Reason for closing:  Fixed
Additional comments about closing:  Fixed in dnsutils/bind 9.5.0-2
Comment by Pierre Rossi (Despeboy) - Thursday, 10 July 2008, 19:07 GMT
I figured this might help:
http://www.isc.org/index.pl?/sw/bind/bind-security.php
Comment by Pierre Rossi (Despeboy) - Thursday, 10 July 2008, 19:12 GMT
my bad !
I didn't even take the time to read the description !
Comment by Jan de Groot (JGC) - Thursday, 10 July 2008, 22:06 GMT
Not every DNS server software is vulnerable. First of all, it's only the recursor part that is vulnerable, a bind server which only hosts zones is completely safe. All recursor software based on BIND code is insecure. dns recursors like pdns-recursor and dnscache from djbdns are safe to use, they don't have this bug, as they do proper source port randomization.

Note that glibc's internal resolver library is based on BIND8 and is also vulnerable to some extent. If traffic between your DNS server in resolv.conf and your box can be spoofed, your machine can suffer from this issue also.
Comment by Kevin Piche (kpiche) - Saturday, 12 July 2008, 04:10 GMT
I've already rebuilt it but am having svn troubles.

Loading...