[Security Announce] [ MDKSA-2007:146 ] - Updated perl-Net-DNS packages fix multiple vulnerabilities

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

_______________________________________________________________________

Mandriva Linux Security Advisory MDKSA-2007:146
http://www.mandriva.com/security/
_______________________________________________________________________

Package : perl-Net-DNS
Date : July 12, 2007
Affected: 2007.0, 2007.1, Corporate 3.0, Corporate 4.0
_______________________________________________________________________

Problem Description:

A flaw was discovered in the perl Net: NS module in the way it
generated the ID field in a DNS query. Because it is so predictable,
a remote attacker could exploit this to return invalid DNS data
(CVE-2007-3377).

A denial of service vulnerability was found in how Net: NS parsed
certain DNS requests. A malformed response to a DNS request could
cause the application using Net: NS to crash or stop responding
(CVE-2007-3409).

The updated packages have been patched to prevent these issues.
_______________________________________________________________________

References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3377
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3409
_______________________________________________________________________

Updated Packages:

Mandriva Linux 2007.0:
92d215a4965bb8d944c030cf1dd73a11 2007.0/i586/perl-Net-DNS-0.58-1.1mdv2007.0.i586.rpm
06c1dd9d596004e261a9706060a4c167 2007.0/SRPMS/perl-Net-DNS-0.58-1.1mdv2007.0.src.rpm

Mandriva Linux 2007.0/X86_64:
34bc7cfb39bd239dea991559a05f66b7 2007.0/x86_64/perl-Net-DNS-0.58-1.1mdv2007.0.x86_64.rpm
06c1dd9d596004e261a9706060a4c167 2007.0/SRPMS/perl-Net-DNS-0.58-1.1mdv2007.0.src.rpm

Mandriva Linux 2007.1:
cd6db816556ae5f3c172dafb5ee98002 2007.1/i586/perl-Net-DNS-0.59-1.1mdv2007.1.i586.rpm
dc954016fe3924ab2a362285cd780636 2007.1/SRPMS/perl-Net-DNS-0.59-1.1mdv2007.1.src.rpm

Mandriva Linux 2007.1/X86_64:
d9cbd72d34d8eab851473716740290f3 2007.1/x86_64/perl-Net-DNS-0.59-1.1mdv2007.1.x86_64.rpm
dc954016fe3924ab2a362285cd780636 2007.1/SRPMS/perl-Net-DNS-0.59-1.1mdv2007.1.src.rpm

Corporate 3.0:
338edc98b82b661a4245c8dfdea463fa corporate/3.0/i586/perl-Net-DNS-0.39-2.1.C30mdk.i586.rpm
eeeb5c182365d9726f36326892065015 corporate/3.0/SRPMS/perl-Net-DNS-0.39-2.1.C30mdk.src.rpm

Corporate 3.0/X86_64:
e47654bec20760643ce0e4d7b78ab394 corporate/3.0/x86_64/perl-Net-DNS-0.39-2.1.C30mdk.x86_64.rpm
eeeb5c182365d9726f36326892065015 corporate/3.0/SRPMS/perl-Net-DNS-0.39-2.1.C30mdk.src.rpm

Corporate 4.0:
51e6714b343575136bf296a495c32de3 corporate/4.0/i586/perl-Net-DNS-0.52-1.1.20060mlcs4.i586.rpm
862ceacd8ba656dee551039d5074dd46 corporate/4.0/SRPMS/perl-Net-DNS-0.52-1.1.20060mlcs4.src.rpm

Corporate 4.0/X86_64:
99cb67c8f400c7f826ce63702e863508 corporate/4.0/x86_64/perl-Net-DNS-0.52-1.1.20060mlcs4.x86_64.rpm
862ceacd8ba656dee551039d5074dd46 corporate/4.0/SRPMS/perl-Net-DNS-0.52-1.1.20060mlcs4.src.rpm
_______________________________________________________________________

To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.

All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:

gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

You can view other update advisories for Mandriva Linux at:

http://www.mandriva.com/security/advisories

If you want to report vulnerabilities, please contact

security_(at)_mandriva.com
_______________________________________________________________________

Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
lt;security*mandriva.comgt;
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.7 (GNU/Linux)

iD8DBQFGlqB9mqjQ0CJFipgRAtR2AJ9k0gv3DiQhhRnitqXz+ZDG2OimbwCfacXe
aq9g2vyl8V79tBNKBAMG5VY=
=OBVo
-----END PGP SIGNATURE-----