Re: Waiting for BIND security announcement



Simon L. Nielsen wrote:
[freebsd-security@ CC'ed to avoid answering the same there again
shorly :) - if following up, please drop either freebsd-questions or
freebsd-securiy to avoid "spamming" both lists]

On 2007.07.24 18:15:43 -0500, Jeffrey Goldberg wrote:

As I'm sure many people know there is a newly discovered BIND vulnerability
allowing cache injection (pharming). See

I think it's worth pointing out that cache injection and pharming are
not the same thing, although cache injection can be used as part of a
pharming attack.

I also think it's worth noting that this isn't an "all your queries
are belong to us" type of attack. The attack involves _predicting_
query id numbers which at _best_ will be successful only once in 16
tries. Then you have to actually time it right so that you can use
your guess.

Still, it is worth upgrading to avoid this issue.

http://www.isc.org/index.pl?/sw/bind/bind-security.php

for details.

The version of bind on 6.2, 9.3.3,

RELENG_6 was updated shortly after the release of 9.3.4. I'll be
updating RELENG_[56] with the new 9.3.4-P1 version after I'm done
regression testing it, which should be some time tonight. Same for
updating HEAD with 9.4.1-P1.

The ports for bind9 and bind94 are already updated, so those with
urgent needs can use that route to upgrade immediately.


hope this helps,

Doug

--

This .signature sanitized for your protection

_______________________________________________
freebsd-security@xxxxxxxxxxx mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-security
To unsubscribe, send any mail to "freebsd-security-unsubscribe@xxxxxxxxxxx"