Debian Bug report logs -
#408432
BIND remote exploit
Reported by: Christian Hammers <ch@debian.org>
Date: Thu, 25 Jan 2007 20:18:02 UTC
Severity: important
Tags: security
Found in versions 9.2.4-1sarge1, 9.3.2-p1.0-1, 9.3.3-1, 9.4.0~rc1.0-3
Fixed in version 1:9.3.4-2
Done: LaMont Jones <lamont@debian.org>
Bug is archived. No further changes may be made.
Toggle useless messages
Report forwarded to debian-bugs-dist@lists.debian.org, LaMont Jones <lamont@debian.org>:
Bug#408432; Package bind9.
(full text, mbox, link).
Acknowledgement sent to Christian Hammers <ch@debian.org>:
New Bug report received and forwarded. Copy sent to LaMont Jones <lamont@debian.org>.
(full text, mbox, link).
Message #5 received at submit@bugs.debian.org (full text, mbox, reply):
Package: bind9
Version: 9.2.4-1sarge1 9.3.2-P1.0-1 9.3.3-1 9.4.0~rc1.0-3
Tags: security
Severity: grave
Hello
They say "severity low" but if someone causes all nameservers
of my internet provider to "exit unintentionally" continuously,
I guess that becomes a pretty big problem :-)
bye,
-christian-
> ----- "Mark Andrews" <Mark_Andrews@isc.org> wrote:
> > Internet Systems Consortium Security Advisory.
> > BIND 9: dereferencing freed fetch context
> > 12 January 2007
> >
> > Versions affected:
> >
> > BIND 9.3.0, 9.3.1, 9.3.2, 9.3.3
> > BIND 9.4.0a1, 9.4.0a2, 9.4.0a3, 9.4.0a4, 9.4.0a5, 9.4.0a6, 9.4.0b1
> > 9.4.0b2, 9.4.0b3, 9.4.0b4, 9.4.0rc1
> > BIND 9.5.0a1 (Bind Forum only)
> >
> > Severity: Low
> > Exploitable: Remotely
> >
> > Description:
> >
> > It is possible for the named to dereference (read) a freed
> > fetch context. This can cause named to exit unintentionally.
> >
> > Workaround:
> >
> > Disable / restrict recursion (to limit exposure).
> >
> > Fix:
> >
> > Upgrade to BIND 9.2.8, BIND 9.3.4 or BIND 9.4.0rc2.
> > Additionally this will be fixed in the upcoming BIND 9.5.0a2.
Severity set to `important' from `grave'
Request was from Steve Langasek <vorlon@debian.org>
to control@bugs.debian.org.
(full text, mbox, link).
Information forwarded to debian-bugs-dist@lists.debian.org, LaMont Jones <lamont@debian.org>:
Bug#408432; Package bind9.
(full text, mbox, link).
Acknowledgement sent to Lubomir Kundrak <lkundrak@redhat.com>:
Extra info received and forwarded to list. Copy sent to LaMont Jones <lamont@debian.org>.
(full text, mbox, link).
Message #12 received at 408432@bugs.debian.org (full text, mbox, reply):
[Message part 1 (text/plain, inline)]
Here's a patch for two of the issues fixed by the new release. Anyone
isolated a patch for CVE-2007-0494?
--
Lubomir Kundrak (Red Hat Security Response Team)
[bind-advisory-2007-01-25.diff (text/x-patch, attachment)]
Reply sent to LaMont Jones <lamont@debian.org>:
You have taken responsibility.
(full text, mbox, link).
Notification sent to Christian Hammers <ch@debian.org>:
Bug acknowledged by developer.
(full text, mbox, link).
Message #17 received at 408432-done@bugs.debian.org (full text, mbox, reply):
Version: 1:9.3.4-2
lamont
Bug archived.
Request was from Debbugs Internal Request <owner@bugs.debian.org>
to internal_control@bugs.debian.org.
(Sun, 13 Apr 2008 07:36:14 GMT) (full text, mbox, link).
Send a report that this bug log contains spam.
Debian bug tracking system administrator <owner@bugs.debian.org>.
Last modified:
Wed Jun 19 17:40:14 2019;
Machine Name:
buxtehude
Debian Bug tracking system
Debbugs is free software and licensed under the terms of the GNU
Public License version 2. The current version can be obtained
from https://bugs.debian.org/debbugs-source/.
Copyright © 1999 Darren O. Benham,
1997,2003 nCipher Corporation Ltd,
1994-97 Ian Jackson,
2005-2017 Don Armstrong, and many other contributors.
Vulmon