pdns-server: CVE-2008-3217 ( PowerDNS Recursor before 3.1.6 does not always use the strongest random number generator... )

Debian Bug report logs - #493576
pdns-server: CVE-2008-3217 ( PowerDNS Recursor before 3.1.6 does not always use the strongest random number generator... )

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Thomas Bläsing <thomasbl@pool.math.tu-berlin.de>

To: submit@bugs.debian.org

Subject: pdns-server: CVE-2008-3217 ( PowerDNS Recursor before 3.1.6 does not always use the strongest random number generator... )

Date: Sun, 3 Aug 2008 12:34:42 +0200

[Message part 1 (text/plain, inline)]

Package: pdns-server
Version: 2.9.21-6
Severity: serious
Tags: security

Hi,
the following CVE (Common Vulnerabilities & Exposures) id was
published for pdns-server.

CVE-2008-3217[0]:
| PowerDNS Recursor before 3.1.6 does not always use the strongest
| random number generator for source port selection, which makes it
| easier for remote attack vectors to conduct DNS cache poisoning.
NOTE:
| this is related to incomplete integration of security improvements
| associated with addressing CVE-2008-1637.

If you fix the vulnerability please also make sure to include the
CVE id in your changelog entry.

For further information see:

[0] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3217
    http://security-tracker.debian.net/tracker/CVE-2008-3217

Kind regards,
Thomas.

[signature.asc (application/pgp-signature, inline)]

Message #14 received at 493576@bugs.debian.org (full text, mbox, reply):

From: Christoph Haas <email@christoph-haas.de>

To: Thomas Bläsing <thomasbl@pool.math.tu-berlin.de>, 493576@bugs.debian.org

Subject: Re: Bug#493576: pdns-server: CVE-2008-3217 ( PowerDNS Recursor before 3.1.6 does not always use the strongest random number generator... )

Date: Sun, 3 Aug 2008 21:37:31 +0200

[Message part 1 (text/plain, inline)]

On Sonntag, 3. August 2008, Thomas Bläsing wrote:
> the following CVE (Common Vulnerabilities & Exposures) id was
> published for pdns-server.

Not exactly - the CVE was assigned to the pdns-recursor package. 
pdns-server and pdns-recursor are seperate packages. I have added the CVE 
to pdns-recursor's changelog. I'm downgrading the priority the priority of 
the bug because it's mainly cosmetical.

Thanks anyway for the report.

 Christoph

[signature.asc (application/pgp-signature, inline)]

Message #21 received at 493576-done@bugs.debian.org (full text, mbox, reply):

From: Christoph Haas <email@christoph-haas.de>

To: 493576-done@bugs.debian.org

Subject: Issue fixed by 3.1.4-1+etch4

Date: Sun, 14 Sep 2008 16:36:51 +0200

[Message part 1 (text/plain, inline)]

This bug doesn't warrant a new upload fixing it in the 'changelog' file. 
The issue has apparently been fixed already in revision 3.1.4-1+etch4. So 
I'm closing this bug.

 Christoph

[signature.asc (application/pgp-signature, inline)]

Send a report that this bug log contains spam.