Executive Summary

Summary
Titlebind security update
Informations
NameRHSA-2010:1000First vendor Publication2010-12-20
VendorRedHatLast vendor Modification2010-12-20
Severity (Vendor) ImportantRevision01

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:L/Au:S/C:N/I:N/A:P)
Cvss Base Score4Attack RangeNetwork
Cvss Impact Score2.9Attack ComplexityLow
Cvss Expoit Score8AuthenticationRequires single instance
Calculate full CVSS 2.0 Vectors scores

Detail

Problem Description:

Updated bind packages that fix one security issue are now available for Red Hat Enterprise Linux 4.

The Red Hat Security Response Team has rated this update as having important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

2. Relevant releases/architectures:

Red Hat Enterprise Linux AS version 4 - i386, ia64, ppc, s390, s390x, x86_64 Red Hat Enterprise Linux Desktop version 4 - i386, x86_64 Red Hat Enterprise Linux ES version 4 - i386, ia64, x86_64 Red Hat Enterprise Linux WS version 4 - i386, ia64, x86_64

3. Description:

The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating correctly.

It was discovered that named did not invalidate previously cached SIG records when adding an NCACHE record for the same entry to the cache. A remote attacker allowed to send recursive DNS queries to named could use this flaw to crash named. (CVE-2010-3613)

All BIND users are advised to upgrade to these updated packages, which contain a backported patch to resolve this issue. After installing the update, the BIND daemon (named) will be restarted automatically.

4. Solution:

Before applying this update, make sure all previously-released errata relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at http://kbase.redhat.com/faq/docs/DOC-11259

5. Bugs fixed (http://bugzilla.redhat.com/):

658974 - CVE-2010-3613 bind: failure to clear existing RRSIG records when a NO DATA is negatively cached could DoS named

Original Source

Url : https://rhn.redhat.com/errata/RHSA-2010-1000.html

CWE : Common Weakness Enumeration

idName
CWE-264Permissions, Privileges, and Access Controls

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:20922
 
Oval ID: oval:org.mitre.oval:def:20922
Title: Denial of service vulnerability in BIND
Description: named in ISC BIND 9.6.2 before 9.6.2-P3, 9.6-ESV before 9.6-ESV-R3, and 9.7.x before 9.7.2-P3 does not properly handle the combination of signed negative responses and corresponding RRSIG records in the cache, which allows remote attackers to cause a denial of service (daemon crash) via a query for cached data.
Family: unix Class: vulnerability
Reference(s): CVE-2010-3613
Version: 4
Platform(s): IBM AIX 6.1
IBM AIX 7.1
Product(s):
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:20446
 
Oval ID: oval:org.mitre.oval:def:20446
Title: VMware ESX/ESXi SLPD denial of service vulnerability and ESX third party updates for Service Console packages bind, pam, and rpm.
Description: named in ISC BIND 9.6.2 before 9.6.2-P3, 9.6-ESV before 9.6-ESV-R3, and 9.7.x before 9.7.2-P3 does not properly handle the combination of signed negative responses and corresponding RRSIG records in the cache, which allows remote attackers to cause a denial of service (daemon crash) via a query for cached data.
Family: unix Class: vulnerability
Reference(s): CVE-2010-3613
Version: 4
Platform(s): VMWare ESX Server 4.1
VMWare ESX Server 4.0
Product(s):
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:12722
 
Oval ID: oval:org.mitre.oval:def:12722
Title: DSA-2130-1 bind9 -- several
Description: Several remote vulnerabilities have been discovered in BIND, an implementation of the DNS protocol suite. The Common Vulnerabilities and Exposures project identifies the following problems: CVE-2010-3762 When DNSSEC validation is enabled, BIND does not properly handle certain bad signatures if multiple trust anchors exist for a single zone, which allows remote attackers to cause a denial of service via a DNS query. CVE-2010-3614 BIND does not properly determine the security status of an NS RRset during a DNSKEY algorithm rollover, which may lead to zone unavailability during rollovers. CVE-2010-3613 BIND does not properly handle the combination of signed negative responses and corresponding RRSIG records in the cache, which allows remote attackers to cause a denial of service via a query for cached data. In addition, this security update improves compatibility with previously installed versions of the bind9 package. As a result, it is necessary to initiate the update with "apt-get dist-upgrade" instead of "apt-get update". For the stable distribution, these problems have been fixed in version 1:9.6.ESV.R3+dfsg-0+lenny1. For the upcoming stable distribution and the unstable distribution, these problems have been fixed in version 1:9.7.2.dfsg.P3-1. We recommend that you upgrade your bind9 packages.
Family: unix Class: patch
Reference(s): DSA-2130-1
CVE-2010-3762
CVE-2010-3614
CVE-2010-3613
Version: 5
Platform(s): Debian GNU/Linux 5.0
Product(s): bind9
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:12601
 
Oval ID: oval:org.mitre.oval:def:12601
Title: HP-UX Running BIND, Remote Denial of Service (DoS)
Description: named in ISC BIND 9.6.2 before 9.6.2-P3, 9.6-ESV before 9.6-ESV-R3, and 9.7.x before 9.7.2-P3 does not properly handle the combination of signed negative responses and corresponding RRSIG records in the cache, which allows remote attackers to cause a denial of service (daemon crash) via a query for cached data.
Family: unix Class: vulnerability
Reference(s): CVE-2010-3613
Version: 7
Platform(s): HP-UX 11
Product(s):
Definition Synopsis:

CPE : Common Platform Enumeration

TypeDescriptionCount
Application22

OpenVAS Exploits

DateDescription
2012-08-10Name : Gentoo Security Advisory GLSA 201206-01 (bind)
File : nvt/glsa_201206_01.nasl
2012-07-30Name : CentOS Update for bind CESA-2010:1000 centos4 x86_64
File : nvt/gb_CESA-2010_1000_bind_centos4_x86_64.nasl
2012-03-16Name : VMSA-2011-0004.3 VMware ESX/ESXi SLPD denial of service vulnerability and ESX...
File : nvt/gb_VMSA-2011-0004.nasl
2011-10-20Name : Mac OS X v10.6.8 Multiple Vulnerabilities (2011-006)
File : nvt/gb_macosx_su11-006.nasl
2011-08-09Name : CentOS Update for bind CESA-2010:0976 centos5 i386
File : nvt/gb_CESA-2010_0976_bind_centos5_i386.nasl
2011-05-05Name : HP-UX Update for BIND HPSBUX02655
File : nvt/gb_hp_ux_HPSBUX02655.nasl
2011-01-31Name : CentOS Update for bind CESA-2010:1000 centos4 i386
File : nvt/gb_CESA-2010_1000_bind_centos4_i386.nasl
2011-01-14Name : ISC BIND 9 'RRSIG' Record Type Negative Cache Remote Denial of Service Vulner...
File : nvt/gb_bind_multiple_vuln_01_11.nasl
2010-12-28Name : Mandriva Update for bind MDVSA-2010:253 (bind)
File : nvt/gb_mandriva_MDVSA_2010_253.nasl
2010-12-28Name : RedHat Update for bind RHSA-2010:0976-01
File : nvt/gb_RHSA-2010_0976-01_bind.nasl
2010-12-28Name : RedHat Update for bind RHSA-2010:1000-01
File : nvt/gb_RHSA-2010_1000-01_bind.nasl
2010-12-23Name : Fedora Update for bind FEDORA-2010-18469
File : nvt/gb_fedora_2010_18469_bind_fc14.nasl
2010-12-23Name : Fedora Update for bind-dyndb-ldap FEDORA-2010-18521
File : nvt/gb_fedora_2010_18521_bind-dyndb-ldap_fc13.nasl
2010-12-23Name : Fedora Update for bind FEDORA-2010-18521
File : nvt/gb_fedora_2010_18521_bind_fc13.nasl
2010-12-23Name : Fedora Update for dnsperf FEDORA-2010-18521
File : nvt/gb_fedora_2010_18521_dnsperf_fc13.nasl
2010-12-09Name : Ubuntu Update for bind9 vulnerabilities USN-1025-1
File : nvt/gb_ubuntu_USN_1025_1.nasl
0000-00-00Name : Slackware Advisory SSA:2010-350-01 bind
File : nvt/esoft_slk_ssa_2010_350_01.nasl

Open Source Vulnerability Database (OSVDB)

idDescription
69558ISC BIND named RRSIG Negative Caching DoS

Information Assurance Vulnerability Management (IAVM)

DateDescription
2011-05-12IAVM : 2011-A-0066 - Multiple Vulnerabilities in VMware Products
Severity : Category I - VMSKEY : V0027158

Nessus® Vulnerability Scanner

DateDescription
2014-06-13Name : The remote openSUSE host is missing a security update.
File : suse_11_3_bind-101207.nasl - Type : ACT_GATHER_INFO
2013-07-12Name : The remote Oracle Linux host is missing one or more security updates.
File : oraclelinux_ELSA-2010-0975.nasl - Type : ACT_GATHER_INFO
2013-07-12Name : The remote Oracle Linux host is missing one or more security updates.
File : oraclelinux_ELSA-2010-0976.nasl - Type : ACT_GATHER_INFO
2013-07-12Name : The remote Oracle Linux host is missing one or more security updates.
File : oraclelinux_ELSA-2010-1000.nasl - Type : ACT_GATHER_INFO
2013-01-24Name : The remote AIX host is missing a security patch.
File : aix_IZ99391.nasl - Type : ACT_GATHER_INFO
2013-01-24Name : The remote AIX host is missing a security patch.
File : aix_IV01118.nasl - Type : ACT_GATHER_INFO
2013-01-24Name : The remote AIX host is missing a security patch.
File : aix_IV01119.nasl - Type : ACT_GATHER_INFO
2012-08-01Name : The remote Scientific Linux host is missing one or more security updates.
File : sl_20101213_bind_on_SL5_x.nasl - Type : ACT_GATHER_INFO
2012-08-01Name : The remote Scientific Linux host is missing one or more security updates.
File : sl_20101220_bind_on_SL4_x.nasl - Type : ACT_GATHER_INFO
2012-06-21Name : The remote Gentoo host is missing one or more security-related patches.
File : gentoo_GLSA-201206-01.nasl - Type : ACT_GATHER_INFO
2011-10-13Name : The remote host is missing a Mac OS X update that fixes several security issues.
File : macosx_SecUpd2011-006.nasl - Type : ACT_GATHER_INFO
2011-05-28Name : The remote Slackware host is missing a security update.
File : Slackware_SSA_2010-350-01.nasl - Type : ACT_GATHER_INFO
2011-05-05Name : The remote openSUSE host is missing a security update.
File : suse_11_2_bind-101207.nasl - Type : ACT_GATHER_INFO
2011-03-08Name : The remote VMware ESXi / ESX host is missing one or more security-related pat...
File : vmware_VMSA-2011-0004.nasl - Type : ACT_GATHER_INFO
2011-01-28Name : The remote CentOS host is missing one or more security updates.
File : centos_RHSA-2010-1000.nasl - Type : ACT_GATHER_INFO
2010-12-21Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2010-1000.nasl - Type : ACT_GATHER_INFO
2010-12-15Name : The remote Mandriva Linux host is missing one or more security updates.
File : mandriva_MDVSA-2010-253.nasl - Type : ACT_GATHER_INFO
2010-12-14Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2010-0975.nasl - Type : ACT_GATHER_INFO
2010-12-14Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2010-0976.nasl - Type : ACT_GATHER_INFO
2010-12-14Name : The remote CentOS host is missing one or more security updates.
File : centos_RHSA-2010-0976.nasl - Type : ACT_GATHER_INFO
2010-12-12Name : The remote Debian host is missing a security-related update.
File : debian_DSA-2130.nasl - Type : ACT_GATHER_INFO
2010-12-09Name : The remote Fedora host is missing a security update.
File : fedora_2010-18469.nasl - Type : ACT_GATHER_INFO
2010-12-08Name : The remote Fedora host is missing one or more security updates.
File : fedora_2010-18521.nasl - Type : ACT_GATHER_INFO
2010-12-03Name : The remote name server is affected by multiple vulnerabilities.
File : bind9_972_p3.nasl - Type : ACT_GATHER_INFO
2010-12-02Name : The remote Ubuntu host is missing one or more security-related patches.
File : ubuntu_USN-1025-1.nasl - Type : ACT_GATHER_INFO

Alert History

If you want to see full details history, please login or register.
0
DateInformations
2014-02-17 11:54:12
  • Multiple Updates