bind (SSA:2007-207-01)
Posted on: 07/27/2007 08:16 AM

New bind packages are available for Slackware 8.1, 9.0, 9.1, 10.0, 10.1, 10.2, 11.0, and 12.0 to fix security issues.

The first issue which allows remote attackers to make recursive queries only affects Slackware 12.0. More details about this issue may be found in the Common Vulnerabilities and Exposures (CVE) database:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2925

The second issue is the discovery that BIND9's query IDs are cryptographically weak. This issue affects the versions of BIND9 in all supported Slackware versions. More details about this issue may be found in the Common Vulnerabilities and Exposures (CVE) database:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2926

Here are the details from the Slackware 12.0 ChangeLog:
+--------------------------+
patches/packages/bind-9.4.1_P1-i486-1_slack12.0.tgz:
Upgraded to bind-9.4.1_P1 to fix security issues.
The default access control lists allow remote attackers to make recursive
queries in BIND9 versions 9.4.0 through 9.4.1.
The query IDs in BIND9 prior to BIND 9.4.1-P1 are cryptographically weak.
For more information on these issues, see:
http://www.isc.org/index.pl?/sw/bind/bind-security.php
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2925
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2926
(* Security fix *)
+--------------------------+


Where to find the new packages:
+-----------------------------+

HINT: Getting slow download speeds from ftp.slackware.com?
Give slackware.osuosl.org a try. This is another primary FTP site
for Slackware that can be considerably faster than downloading
from ftp.slackware.com.

Thanks to the friendly folks at the OSU Open Source Lab
(http://osuosl.org) for donating additional FTP and rsync hosting
to the Slackware project! :-)

Also see the "Get Slack" section on http://slackware.com for
additional mirror sites near you.

Updated package for Slackware 8.1:
ftp://ftp.slackware.com/pub/slackware/slackware-8.1/patches/packages/bind-9.2.8_P1-i386-1_slack8.1.tgz

Updated package for Slackware 9.0:
ftp://ftp.slackware.com/pub/slackware/slackware-9.0/patches/packages/bind-9.2.8_P1-i386-1_slack9.0.tgz

Updated package for Slackware 9.1:
ftp://ftp.slackware.com/pub/slackware/slackware-9.1/patches/packages/bind-9.2.8_P1-i486-1_slack9.1.tgz

Updated package for Slackware 10.0:
ftp://ftp.slackware.com/pub/slackware/slackware-10.0/patches/packages/bind-9.2.8_P1-i486-1_slack10.0.tgz

Updated package for Slackware 10.1:
ftp://ftp.slackware.com/pub/slackware/slackware-10.1/patches/packages/bind-9.3.4_P1-i486-1_slack10.1.tgz

Updated package for Slackware 10.2:
ftp://ftp.slackware.com/pub/slackware/slackware-10.2/patches/packages/bind-9.3.4_P1-i486-1_slack10.2.tgz

Updated package for Slackware 11.0:
ftp://ftp.slackware.com/pub/slackware/slackware-11.0/patches/packages/bind-9.3.4_P1-i486-1_slack11.0.tgz

Updated package for Slackware 12.0:
ftp://ftp.slackware.com/pub/slackware/slackware-12.0/patches/packages/bind-9.4.1_P1-i486-1_slack12.0.tgz


MD5 signatures:
+-------------+

Slackware 8.1 package:
4c4416bf01018b5930f8eb4250bb6bb4 bind-9.2.8_P1-i386-1_slack8.1.tgz

Slackware 9.0 package:
60690cd64a251807a8582b0e904772bd bind-9.2.8_P1-i386-1_slack9.0.tgz

Slackware 9.1 package:
6769219553630a1ee75cf7b7021c9168 bind-9.2.8_P1-i486-1_slack9.1.tgz

Slackware 10.0 package:
7f8d1ad2360a9f0ccb38a9c8d83ad8d8 bind-9.2.8_P1-i486-1_slack10.0.tgz

Slackware 10.1 package:
39a4665d83754377d5be50a739100ad1 bind-9.3.4_P1-i486-1_slack10.1.tgz

Slackware 10.2 package:
f6c0d70a75b3a88c2972e359db895f72 bind-9.3.4_P1-i486-1_slack10.2.tgz

Slackware 11.0 package:
e830092ede1eedbcd54e85c370d8b621 bind-9.3.4_P1-i486-1_slack11.0.tgz

Slackware 12.0 package:
8bea2625ec5d0b04afaf12297474684e bind-9.4.1_P1-i486-1_slack12.0.tgz


Installation instructions:
+------------------------+

Upgrade the package as root:
# upgradepkg bind-9.4.1_P1-i486-1_slack12.0.tgz

Then, restart the nameserver:
# /etc/rc.d/rc.bind restart


+-----+

Slackware Linux Security Team
http://slackware.com/gpg-key
security@slackware.com

---