[gentoo-announce] [ GLSA 201610-07 ] BIND: Multiple vulnerabilities - gentoo-announce

From:	Kristian Fiskerstrand <k_f@g.o>
To:	gentoo-announce@l.g.o
Subject:	[gentoo-announce] [ GLSA 201610-07 ] BIND: Multiple vulnerabilities
Date:	Tue, 11 Oct 2016 18:56:39
Message-Id:	`408422f7-860b-c18b-5583-d2797b33be90@gentoo.org`

1

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

2

Gentoo Linux Security Advisory                           GLSA 201610-07

3

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

4

                                           https://security.gentoo.org/

5

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

6

7

 Severity: Normal

8

    Title: BIND: Multiple vulnerabilities

9

     Date: October 11, 2016

10

     Bugs: #572414, #576902, #588652, #589132, #595340

11

       ID: 201610-07

12

13

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

14

15

Synopsis

16

========

17

18

Multiple vulnerabilities have been found in BIND, the worst of which

19

could cause a Denial of Service condition.

20

21

Background

22

==========

23

24

BIND (Berkeley Internet Name Domain) is a Name Server.

25

26

Affected packages

27

=================

28

29

    -------------------------------------------------------------------

30

     Package              /     Vulnerable     /            Unaffected

31

    -------------------------------------------------------------------

32

  1  net-dns/bind               < 9.10.4_p3              >= 9.10.4_p3

33

34

Description

35

===========

36

37

Multiple vulnerabilities have been discovered in BIND. Please review

38

the CVE identifiers referenced below for details.

39

40

Impact

41

======

42

43

A remote attacker could cause a Denial of Service condition through

44

multiple attack vectors.

45

46

Workaround

47

==========

48

49

There is no known workaround at this time.

50

51

Resolution

52

==========

53

54

All BIND users should upgrade to the latest version:

55

56

  # emerge --sync

57

  # emerge --ask --oneshot --verbose ">=net-dns/bind-9.10.4_p3"

58

59

References

60

==========

61

62

[ 1 ] CVE-2015-8704

63

      http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-8704

64

[ 2 ] CVE-2015-8705

65

      http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-8705

66

[ 3 ] CVE-2016-1285

67

      http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-1285

68

[ 4 ] CVE-2016-1286

69

      http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-1286

70

[ 5 ] CVE-2016-2088

71

      http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-2088

72

[ 6 ] CVE-2016-2775

73

      http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-2775

74

[ 7 ] CVE-2016-2776

75

      http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-2776

76

[ 8 ] CVE-2016-6170

77

      http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-6170

78

79

Availability

80

============

81

82

This GLSA and any updates to it are available for viewing at

83

the Gentoo Security Website:

84

85

 https://security.gentoo.org/glsa/201610-07

86

87

Concerns?

88

=========

89

90

Security is a primary focus of Gentoo Linux and ensuring the

91

confidentiality and security of our users' machines is of utmost

92

importance to us. Any security concerns should be addressed to

93

security@g.o or alternatively, you may file a bug at

94

https://bugs.gentoo.org.

95

96

License

97

=======

98

99

Copyright 2016 Gentoo Foundation, Inc; referenced text

100

belongs to its owner(s).

101

102

The contents of this document are licensed under the

103

Creative Commons - Attribution / Share Alike license.

104

105

http://creativecommons.org/licenses/by-sa/2.5

Gentoo Archives: gentoo-announce

Attachments

1	- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
2	Gentoo Linux Security Advisory GLSA 201610-07
3	- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
4	https://security.gentoo.org/
5	- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
6
7	Severity: Normal
8	Title: BIND: Multiple vulnerabilities
9	Date: October 11, 2016
10	Bugs: #572414, #576902, #588652, #589132, #595340
11	ID: 201610-07
12
13	- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
14
15	Synopsis
16	========
17
18	Multiple vulnerabilities have been found in BIND, the worst of which
19	could cause a Denial of Service condition.
20
21	Background
22	==========
23
24	BIND (Berkeley Internet Name Domain) is a Name Server.
25
26	Affected packages
27	=================
28
29	-------------------------------------------------------------------
30	Package / Vulnerable / Unaffected
31	-------------------------------------------------------------------
32	1 net-dns/bind < 9.10.4_p3 >= 9.10.4_p3
33
34	Description
35	===========
36
37	Multiple vulnerabilities have been discovered in BIND. Please review
38	the CVE identifiers referenced below for details.
39
40	Impact
41	======
42
43	A remote attacker could cause a Denial of Service condition through
44	multiple attack vectors.
45
46	Workaround
47	==========
48
49	There is no known workaround at this time.
50
51	Resolution
52	==========
53
54	All BIND users should upgrade to the latest version:
55
56	# emerge --sync
57	# emerge --ask --oneshot --verbose ">=net-dns/bind-9.10.4_p3"
58
59	References
60	==========
61
62	[ 1 ] CVE-2015-8704
63	http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-8704
64	[ 2 ] CVE-2015-8705
65	http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-8705
66	[ 3 ] CVE-2016-1285
67	http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-1285
68	[ 4 ] CVE-2016-1286
69	http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-1286
70	[ 5 ] CVE-2016-2088
71	http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-2088
72	[ 6 ] CVE-2016-2775
73	http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-2775
74	[ 7 ] CVE-2016-2776
75	http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-2776
76	[ 8 ] CVE-2016-6170
77	http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-6170
78
79	Availability
80	============
81
82	This GLSA and any updates to it are available for viewing at
83	the Gentoo Security Website:
84
85	https://security.gentoo.org/glsa/201610-07
86
87	Concerns?
88	=========
89
90	Security is a primary focus of Gentoo Linux and ensuring the
91	confidentiality and security of our users' machines is of utmost
92	importance to us. Any security concerns should be addressed to
93	security@g.o or alternatively, you may file a bug at
94	https://bugs.gentoo.org.
95
96	License
97	=======
98
99	Copyright 2016 Gentoo Foundation, Inc; referenced text
100	belongs to its owner(s).
101
102	The contents of this document are licensed under the
103	Creative Commons - Attribution / Share Alike license.
104
105	http://creativecommons.org/licenses/by-sa/2.5