OpenPKG Security Advisory

Publisher Name:          OpenPKG GmbH
Publisher Home:          http://openpkg.com/

Advisory Id (public):    OpenPKG-SA-2006.019
Advisory Type:           OpenPKG Security Advisory (SA)
Advisory Directory:      http://openpkg.com/go/OpenPKG-SA
Advisory Document:       http://openpkg.com/go/OpenPKG-SA-2006.019
Advisory Published:      2008-08-07 22:04 UTC

Issue Id (internal):     OpenPKG-SI-20060907.01
Issue First Created:     2006-09-07
Issue Last Modified:     2006-12-07
Issue Revision:          10


Subject Name:            BIND
Subject Summary:         Berkeley Internet Name Domain (BIND)
Subject Home:            http://www.isc.org/products/BIND/
Subject Versions:        * <= 9.3.2

Vulnerability Id:        CVE-2006-4095, CVE-2006-4096,
                         niscc:re-20060905-00590, cert:VN-915404,
                         cert:VN-697164
Vulnerability Scope:     global (not OpenPKG specific)

Attack Feasibility:      run-time
Attack Vector:           remote network
Attack Impact:           denial of service

Description:
    Two vulnerabilities were discovered in the DNS server BIND [0]:
    
    1. SIG Query Processing [1][2][3]: On recursive servers queries
    for SIG records will trigger a assertion failure if more than one
    SIG (covered) RR set is returned. On authoritative servers, if a
    nameserver is serving a RFC 2535 DNSSEC zone and is queried for the
    SIG records where multiple SIG (covered) RRsets (e.g. a zone apex)
    exist, then BIND will trigger a assertion failure when it trys to
    construct the response. CVE-2006-4095
    
    2. Excessive Recursive Queries INSIST failure [1][2][5]: It is
    possible to trigger an INSIST failure by sending enough recursive
    queries that the response to the query arrives after all the
    clients looking for the response have left the recursion queue.
    CVE-2006-4096

References:
    [0] http://www.isc.org/sw/bind/
    [1] http://www.isc.org/sw/bind/bind9.3.php#security
    [2] http://www.niscc.gov.uk/niscc/docs/re-20060905-00590.pdf?lang=en
    [3] http://www.kb.cert.org/vuls/id/915404
    [4] http://www.kb.cert.org/vuls/id/697164


Primary Package Name:    bind
Primary Package Home:    http://openpkg.org/go/package/bind

Affected Distribution:   Affected Branch:  Affected Package:
OpenPKG Community        2.5-SOLID         bind-9.3.1-2.5.0
OpenPKG Community        CURRENT           bind-9.3.2-20060825

Corrected Distribution:  Corrected Branch: Corrected Package:
OpenPKG Community        2.5-SOLID         bind-9.3.1-2.5.1
OpenPKG Community        CURRENT           bind-9.3.2-20060907