You are here
Home > Preporuke > Sigurnosni nedostaci programskog paketa bind

Sigurnosni nedostaci programskog paketa bind

  • Detalji os-a: WN7
  • Važnost: IMP
  • Operativni sustavi: L
  • Kategorije: LSU

openSUSE Security Update: Security update for bind
______________________________________________________________________________

Announcement ID: openSUSE-SU-2017:1809-1
Rating: important
References: #1046554 #1046555
Cross-References: CVE-2017-3142 CVE-2017-3143
Affected Products:
openSUSE Leap 42.2
______________________________________________________________________________

An update that fixes two vulnerabilities is now available.

Description:

This update for bind fixes the following issues:

– An attacker with the ability to send and receive messages to an
authoritative DNS server was able to circumvent TSIG authentication of
AXFR requests. A server that relied solely on TSIG keys for protection
could be manipulated into (1) providing an AXFR of a zone to an
unauthorized recipient and (2) accepting bogus Notify packets.
[bsc#1046554, CVE-2017-3142]

– An attacker who with the ability to send and receive messages to an
authoritative DNS server and who had knowledge of a valid TSIG key name
for the zone and service being targeted was able to manipulate BIND into
accepting an unauthorized dynamic update. [bsc#1046555, CVE-2017-3143]

This update was imported from the SUSE:SLE-12-SP1:Update update project.

Patch Instructions:

To install this openSUSE Security Update use YaST online_update.
Alternatively you can run the command listed for your product:

– openSUSE Leap 42.2:

zypper in -t patch openSUSE-2017-783=1

To bring your system up-to-date, use “zypper patch”.

Package List:

– openSUSE Leap 42.2 (i586 x86_64):

bind-9.9.9P1-48.6.1
bind-chrootenv-9.9.9P1-48.6.1
bind-debuginfo-9.9.9P1-48.6.1
bind-debugsource-9.9.9P1-48.6.1
bind-devel-9.9.9P1-48.6.1
bind-libs-9.9.9P1-48.6.1
bind-libs-debuginfo-9.9.9P1-48.6.1
bind-lwresd-9.9.9P1-48.6.1
bind-lwresd-debuginfo-9.9.9P1-48.6.1
bind-utils-9.9.9P1-48.6.1
bind-utils-debuginfo-9.9.9P1-48.6.1

– openSUSE Leap 42.2 (x86_64):

bind-libs-32bit-9.9.9P1-48.6.1
bind-libs-debuginfo-32bit-9.9.9P1-48.6.1

– openSUSE Leap 42.2 (noarch):

bind-doc-9.9.9P1-48.6.1

References:

https://www.suse.com/security/cve/CVE-2017-3142.html
https://www.suse.com/security/cve/CVE-2017-3143.html
https://bugzilla.suse.com/1046554
https://bugzilla.suse.com/1046555


To unsubscribe, e-mail: opensuse-security-announce+unsubscribe@opensuse.org
For additional commands, e-mail: opensuse-security-announce+help@opensuse.org

AutorDanijel Kozinovic
Cert idNCERT-REF-2017-07-0036-ADV
CveCERT-CVE-DUMMY
ID izvornikaCERT-ORIGID-DUMMY
ProizvodCERT-DUMMY-PRODUCT
Izvorhttp://www.adobe.com/
Top
More in Preporuke
Sigurnosni nedostatak programskog paketa clamav

Otkriven je sigurnosni nedostatak u programskom paketu clamav za operacijski sustav openSUSE. Otkriveni nedostatak potencijalnim napadačima omogućuje zapisivanje podataka izvan...

Close