[gentoo-announce] [ GLSA 201510-01 ] BIND: Denial of Service - gentoo-announce

From:	Mikle Kolyada <zlogene@g.o>
To:	gentoo-announce@l.g.o
Subject:	[gentoo-announce] [ GLSA 201510-01 ] BIND: Denial of Service
Date:	Sun, 18 Oct 2015 19:52:34
Message-Id:	`5623F775.8060004@gentoo.org`

1

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

2

Gentoo Linux Security Advisory                           GLSA 201510-01

3

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

4

                                           https://security.gentoo.org/

5

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

6

7

 Severity: Normal

8

    Title: BIND: Denial of Service

9

     Date: October 18, 2015

10

     Bugs: #540640, #553584, #556150, #559462

11

       ID: 201510-01

12

13

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

14

15

Synopsis

16

========

17

18

A vulnerability in BIND could lead to a Denial of Service condition.

19

20

Background

21

==========

22

23

BIND (Berkeley Internet Name Domain) is a Name Server.

24

25

Affected packages

26

=================

27

28

    -------------------------------------------------------------------

29

     Package              /     Vulnerable     /            Unaffected

30

    -------------------------------------------------------------------

31

  1  net-dns/bind               < 9.10.2_p4              >= 9.10.2_p4 

32

33

Description

34

===========

35

36

A vulnerability has been discovered in BIND's named utility leading to

37

a Denial of Service condition.

38

39

Impact

40

======

41

42

A remote attacker may be able to cause Denial of Service condition via

43

specially constructed zone data.

44

45

Workaround

46

==========

47

48

There is no known workaround at this time.

49

50

Resolution

51

==========

52

53

All BIND users should upgrade to the latest version:

54

55

  # emerge --sync

56

  # emerge --ask --oneshot --verbose ">=net-dns/bind-9.10.2_p4"

57

58

References

59

==========

60

61

[ 1 ] CVE-2015-1349

62

      http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-1349

63

[ 2 ] CVE-2015-4620

64

      http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-4620

65

[ 3 ] CVE-2015-5477

66

      http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5477

67

[ 4 ] CVE-2015-5722

68

      http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5722

69

[ 5 ] CVE-2015-5986

70

      http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5986

71

72

Availability

73

============

74

75

This GLSA and any updates to it are available for viewing at

76

the Gentoo Security Website:

77

78

 https://security.gentoo.org/glsa/201510-01

79

80

Concerns?

81

=========

82

83

Security is a primary focus of Gentoo Linux and ensuring the

84

confidentiality and security of our users' machines is of utmost

85

importance to us. Any security concerns should be addressed to

86

security@g.o or alternatively, you may file a bug at

87

https://bugs.gentoo.org.

88

89

License

90

=======

91

92

Copyright 2015 Gentoo Foundation, Inc; referenced text

93

belongs to its owner(s).

94

95

The contents of this document are licensed under the

96

Creative Commons - Attribution / Share Alike license.

97

98

http://creativecommons.org/licenses/by-sa/2.5

Gentoo Archives: gentoo-announce

Attachments

1	- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
2	Gentoo Linux Security Advisory GLSA 201510-01
3	- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
4	https://security.gentoo.org/
5	- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
6
7	Severity: Normal
8	Title: BIND: Denial of Service
9	Date: October 18, 2015
10	Bugs: #540640, #553584, #556150, #559462
11	ID: 201510-01
12
13	- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
14
15	Synopsis
16	========
17
18	A vulnerability in BIND could lead to a Denial of Service condition.
19
20	Background
21	==========
22
23	BIND (Berkeley Internet Name Domain) is a Name Server.
24
25	Affected packages
26	=================
27
28	-------------------------------------------------------------------
29	Package / Vulnerable / Unaffected
30	-------------------------------------------------------------------
31	1 net-dns/bind < 9.10.2_p4 >= 9.10.2_p4
32
33	Description
34	===========
35
36	A vulnerability has been discovered in BIND's named utility leading to
37	a Denial of Service condition.
38
39	Impact
40	======
41
42	A remote attacker may be able to cause Denial of Service condition via
43	specially constructed zone data.
44
45	Workaround
46	==========
47
48	There is no known workaround at this time.
49
50	Resolution
51	==========
52
53	All BIND users should upgrade to the latest version:
54
55	# emerge --sync
56	# emerge --ask --oneshot --verbose ">=net-dns/bind-9.10.2_p4"
57
58	References
59	==========
60
61	[ 1 ] CVE-2015-1349
62	http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-1349
63	[ 2 ] CVE-2015-4620
64	http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-4620
65	[ 3 ] CVE-2015-5477
66	http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5477
67	[ 4 ] CVE-2015-5722
68	http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5722
69	[ 5 ] CVE-2015-5986
70	http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5986
71
72	Availability
73	============
74
75	This GLSA and any updates to it are available for viewing at
76	the Gentoo Security Website:
77
78	https://security.gentoo.org/glsa/201510-01
79
80	Concerns?
81	=========
82
83	Security is a primary focus of Gentoo Linux and ensuring the
84	confidentiality and security of our users' machines is of utmost
85	importance to us. Any security concerns should be addressed to
86	security@g.o or alternatively, you may file a bug at
87	https://bugs.gentoo.org.
88
89	License
90	=======
91
92	Copyright 2015 Gentoo Foundation, Inc; referenced text
93	belongs to its owner(s).
94
95	The contents of this document are licensed under the
96	Creative Commons - Attribution / Share Alike license.
97
98	http://creativecommons.org/licenses/by-sa/2.5