Get Gentoo!
gentoo.org sites
gentoo.org Wiki Bugs Forums Packages
Planet Archives Sources
Infra Status

Gentoo Archives: gentoo-announce

From: Yury German <blueknight@g.o>
To: gentoo-announce@l.g.o
Subject: [gentoo-announce] [ GLSA 201708-01 ] BIND: Multiple vulnerabilities
Date: Thu, 17 Aug 2017 03:03:24
Message-Id: 59f2d002-1df6-0e98-c92d-85827d3ae66a@gentoo.org
1 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
2 Gentoo Linux Security Advisory GLSA 201708-01
3 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
4 https://security.gentoo.org/
5 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
6
7 Severity: Normal
8 Title: BIND: Multiple vulnerabilities
9 Date: August 17, 2017
10 Bugs: #605454, #608740, #615420, #621730
11 ID: 201708-01
12
13 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
14
15 Synopsis
16 ========
17
18 Multiple vulnerabilities have been found in BIND, the worst of which
19 allows remote attackers to cause a Denial of Service condition.
20
21 Background
22 ==========
23
24 BIND (Berkeley Internet Name Domain) is a Name Server.
25
26 Affected packages
27 =================
28
29 -------------------------------------------------------------------
30 Package / Vulnerable / Unaffected
31 -------------------------------------------------------------------
32 1 net-dns/bind < 9.11.1_p1 >= 9.11.1_p1
33
34 Description
35 ===========
36
37 Multiple vulnerabilities have been discovered in BIND. Please review
38 the CVE identifiers referenced below for details.
39
40 Impact
41 ======
42
43 A remote attacker could send a specially crafted DNS request to the
44 BIND resolver resulting in a Denial of Service condition.
45
46 Workaround
47 ==========
48
49 There is no known workaround at this time.
50
51 Resolution
52 ==========
53
54 All BIND users should upgrade to the latest version:
55
56 # emerge --sync
57 # emerge --ask --oneshot --verbose ">=net-dns/bind-9.11.1_p1"
58
59 References
60 ==========
61
62 [ 1 ] CVE-2016-9131
63 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-9131
64 [ 2 ] CVE-2016-9147
65 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-9147
66 [ 3 ] CVE-2016-9444
67 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-9444
68 [ 4 ] CVE-2016-9778
69 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-9778
70 [ 5 ] CVE-2017-3135
71 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-3135
72 [ 6 ] CVE-2017-3136
73 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-3136
74 [ 7 ] CVE-2017-3137
75 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-3137
76 [ 8 ] CVE-2017-3138
77 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-3138
78 [ 9 ] CVE-2017-3140
79 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-3140
80 [ 10 ] CVE-2017-3141
81 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-3141
82
83 Availability
84 ============
85
86 This GLSA and any updates to it are available for viewing at
87 the Gentoo Security Website:
88
89 https://security.gentoo.org/glsa/201708-01
90
91 Concerns?
92 =========
93
94 Security is a primary focus of Gentoo Linux and ensuring the
95 confidentiality and security of our users' machines is of utmost
96 importance to us. Any security concerns should be addressed to
97 security@g.o or alternatively, you may file a bug at
98 https://bugs.gentoo.org.
99
100 License
101 =======
102
103 Copyright 2017 Gentoo Foundation, Inc; referenced text
104 belongs to its owner(s).
105
106 The contents of this document are licensed under the
107 Creative Commons - Attribution / Share Alike license.
108
109 http://creativecommons.org/licenses/by-sa/2.5

Attachments

File name MIME type
signature.asc application/pgp-signature
Report Message
Find on MARC Find on Google Groups