Mandrake Linux Security Advisory : bind (MDKSA-2001:017)

high Nessus Plugin ID 61891

Language:

Synopsis

The remote Mandrake Linux host is missing one or more security updates.

Description

Four problems exists in all versions of ISC BIND 4.9.x prior to 4.9.8 and 8.2.x prior to 8.2.3 (9.x is not affected). Version 8.2.x contains a buffer overflow in transaction signature (TSIG) handling code that can be exploited by an attacker to gain unauthorized privileged access to the system, allowing execution of arbitrary code. BIND 4 contains both a buffer overflow in the nslookupComplain() function, as well as an input validation error in the same function. These two flaws in BIND 4 can result in a Denial of Service or the execution of arbitrary code if successfully exploited. Finally, both BIND 4 and BIND 8 suffer from an information leak in the query processing code that allows a remote attacker to access the program stack, possibly exposing program and/or environment variables. This flaw is triggered by sending a specially formatted query to vulnerable BIND servers.

Linux-Mandrake ships with ISC BIND 8 and is therefore vulnerable to the first and final vulnerabilities previously mentioned. The first vulnerability is limited because any access gained exploiting it will result in restricted access due to the named server running as the user and group named, not as root.

It is highly recommended that all Linux-Mandrake users upgrade BIND immediately to the latest 8.2.3 version that fixes these vulnerabilities.

Solution

Update the affected bind, bind-devel and / or bind-utils packages.

Plugin Details

Severity: High

ID: 61891

File Name: mandrake_MDKSA-2001-017.nasl

Version: 1.8

Type: local

Family: Mandriva Local Security Checks

Published: 9/6/2012

Updated: 1/6/2021

Supported Sensors: Nessus

Vulnerability Information

CPE: p-cpe:/a:mandriva:linux:bind, p-cpe:/a:mandriva:linux:bind-devel, p-cpe:/a:mandriva:linux:bind-utils, cpe:/o:mandrakesoft:mandrake_linux:6.0, cpe:/o:mandrakesoft:mandrake_linux:6.1, cpe:/o:mandrakesoft:mandrake_linux:7.0, cpe:/o:mandrakesoft:mandrake_linux:7.1, cpe:/o:mandrakesoft:mandrake_linux:7.2

Required KB Items: Host/local_checks_enabled, Host/cpu, Host/Mandrake/release, Host/Mandrake/rpm-list

Patch Publication Date: 1/29/2001

Reference Information

CERT-CC: CA-2001-02

MDKSA: 2001:017

Detections

Analytics