[Full-disclosure] [ MDVSA-2011:176 ] bind



-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

_______________________________________________________________________

Mandriva Linux Security Advisory MDVSA-2011:176
http://www.mandriva.com/security/
_______________________________________________________________________

Package : bind
Date : November 16, 2011
Affected: 2010.1, 2011., Enterprise Server 5.0
_______________________________________________________________________

Problem Description:

A vulnerability was discovered and corrected in bind:

Cache lookup could return RRSIG data associated with nonexistent
records, leading to an assertion failure. [ISC RT #26590]
(CVE-2011-4313).

The updated packages have been upgraded to bind 9.7.4-P1 and 9.8.1-P1
which is not vulnerable to this issue.
_______________________________________________________________________

References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4313
http://www.isc.org/software/bind/advisories/cve-2011-4313
_______________________________________________________________________

Updated Packages:

Mandriva Linux 2010.1:
2d3b31654b6494187749b4f871b14923 2010.1/i586/bind-9.7.4-0.0.P1.1.1mdv2010.2.i586.rpm
a8792938bf48338166220b905440ee54 2010.1/i586/bind-devel-9.7.4-0.0.P1.1.1mdv2010.2.i586.rpm
8b6cc9af1985e1cc70ca9a185ecd7d88 2010.1/i586/bind-doc-9.7.4-0.0.P1.1.1mdv2010.2.i586.rpm
b66d1e222c2fff043b98c4fbd68bad99 2010.1/i586/bind-utils-9.7.4-0.0.P1.1.1mdv2010.2.i586.rpm
492789df209a55647a4ccc5cf87e2e91 2010.1/SRPMS/bind-9.7.4-0.0.P1.1.1mdv2010.2.src.rpm

Mandriva Linux 2010.1/X86_64:
62e1a52fd185b94d86eeeb0a8e66bfdc 2010.1/x86_64/bind-9.7.4-0.0.P1.1.1mdv2010.2.x86_64.rpm
f16cab9fcd24b3a61c387f50207b46a6 2010.1/x86_64/bind-devel-9.7.4-0.0.P1.1.1mdv2010.2.x86_64.rpm
1103883750bae0e68ed333f00dd4b36e 2010.1/x86_64/bind-doc-9.7.4-0.0.P1.1.1mdv2010.2.x86_64.rpm
92438b3290af09ba21a5f6d5187ee326 2010.1/x86_64/bind-utils-9.7.4-0.0.P1.1.1mdv2010.2.x86_64.rpm
492789df209a55647a4ccc5cf87e2e91 2010.1/SRPMS/bind-9.7.4-0.0.P1.1.1mdv2010.2.src.rpm

Mandriva Linux 2011:
c37eb09a2ed979d4bf4fa4fb792f15af 2011/i586/bind-9.8.1-0.0.P1.0.1-mdv2011.0.i586.rpm
91a4c4e3db01e88e527663b405ef4571 2011/i586/bind-devel-9.8.1-0.0.P1.0.1-mdv2011.0.i586.rpm
bc0c40ec0685d07f976e6e834c23c3be 2011/i586/bind-doc-9.8.1-0.0.P1.0.1-mdv2011.0.i586.rpm
3cdc252def4b8eac42f2d4d0ff04b800 2011/i586/bind-utils-9.8.1-0.0.P1.0.1-mdv2011.0.i586.rpm
e46827c8d77ec5b00bbec1f93b6fe499 2011/SRPMS/bind-9.8.1-0.0.P1.0.1.src.rpm

Mandriva Linux 2011/X86_64:
494a59c1827d2cec1efe93db373c1752 2011/x86_64/bind-9.8.1-0.0.P1.0.1-mdv2011.0.x86_64.rpm
96b000b967c1a01bdf0118741f099b81 2011/x86_64/bind-devel-9.8.1-0.0.P1.0.1-mdv2011.0.x86_64.rpm
ddae31ec6a490758570c722e51344001 2011/x86_64/bind-doc-9.8.1-0.0.P1.0.1-mdv2011.0.x86_64.rpm
764ec90bb6cfc9c4218c4cb397d89f6d 2011/x86_64/bind-utils-9.8.1-0.0.P1.0.1-mdv2011.0.x86_64.rpm
e46827c8d77ec5b00bbec1f93b6fe499 2011/SRPMS/bind-9.8.1-0.0.P1.0.1.src.rpm

Mandriva Enterprise Server 5:
11c499a9ab0cac4c8c716e8a220c3552 mes5/i586/bind-9.7.4-0.0.P1.1.1mdvmes5.2.i586.rpm
9261b3ba8efaabc2ca7cfc229b2d9d57 mes5/i586/bind-devel-9.7.4-0.0.P1.1.1mdvmes5.2.i586.rpm
cf550b499f63ae0d52e88f4fae180888 mes5/i586/bind-doc-9.7.4-0.0.P1.1.1mdvmes5.2.i586.rpm
c68ffe41db6fcf89e551f63bdf8daf1b mes5/i586/bind-utils-9.7.4-0.0.P1.1.1mdvmes5.2.i586.rpm
eaa7fa5deb5a2573f948405de34e1ab8 mes5/SRPMS/bind-9.7.4-0.0.P1.1.1mdvmes5.2.src.rpm

Mandriva Enterprise Server 5/X86_64:
e6368866d024f416ed02d0f7d6fd25d5 mes5/x86_64/bind-9.7.4-0.0.P1.1.1mdvmes5.2.x86_64.rpm
e5bded5a3074bbb9105aa045ea9d2c19 mes5/x86_64/bind-devel-9.7.4-0.0.P1.1.1mdvmes5.2.x86_64.rpm
d7bb912ea4b8d55fefe9a30d7c591937 mes5/x86_64/bind-doc-9.7.4-0.0.P1.1.1mdvmes5.2.x86_64.rpm
e96231f2e22f7e0f36d0ee9c1cd929b9 mes5/x86_64/bind-utils-9.7.4-0.0.P1.1.1mdvmes5.2.x86_64.rpm
eaa7fa5deb5a2573f948405de34e1ab8 mes5/SRPMS/bind-9.7.4-0.0.P1.1.1mdvmes5.2.src.rpm
_______________________________________________________________________

To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.

All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:

gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

You can view other update advisories for Mandriva Linux at:

http://www.mandriva.com/security/advisories

If you want to report vulnerabilities, please contact

security_(at)_mandriva.com
_______________________________________________________________________

Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
<security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)

iD8DBQFOxClwmqjQ0CJFipgRAiq4AKCGYSRwM6CcQe+fN3Kzw6+FslS34wCg7BL+
QPH+z7nL/3qDzWL26oEn7Ec=
=4U7e
-----END PGP SIGNATURE-----

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/



Relevant Pages