Mandriva Linux Security Advisory : bind (MDVSA-2010:253)

medium Nessus Plugin ID 51182

Language:

Synopsis

The remote Mandriva Linux host is missing one or more security updates.

Description

Multiple vulnerabilities were discovered and corrected in bind :

named in ISC BIND 9.6.2 before 9.6.2-P3, 9.6-ESV before 9.6-ESV-R3, and 9.7.x before 9.7.2-P3 does not properly handle the combination of signed negative responses and corresponding RRSIG records in the cache, which allows remote attackers to cause a denial of service (daemon crash) via a query for cached data (CVE-2010-3613).

named in ISC BIND 9.x before 9.6.2-P3, 9.7.x before 9.7.2-P3, 9.4-ESV before 9.4-ESV-R4, and 9.6-ESV before 9.6-ESV-R3 does not properly determine the security status of an NS RRset during a DNSKEY algorithm rollover, which might allow remote attackers to cause a denial of service (DNSSEC validation error) by triggering a rollover (CVE-2010-3614).

ISC BIND before 9.7.2-P2, when DNSSEC validation is enabled, does not properly handle certain bad signatures if multiple trust anchors exist for a single zone, which allows remote attackers to cause a denial of service (daemon crash) via a DNS query (CVE-2010-3762).

Packages for 2009.0 are provided as of the Extended Maintenance Program. Please visit this link to learn more:
http://store.mandriva.com/product_info.php?cPath=149&products_id=4 90

The updated packages for Corporate Server 4.0 has been patched to address these issues.

The updated packages for Mandriva Linux 2009.0, 2010.0 and Mandriva Linux Enterprise Server 5.1 has been upgraded to bind-9.6.2-P3 and patched to address the CVE-2010-3762 security issue.

The updated packages for Mandriva Linux 2010.1 has been upgraded to bind-9.7.2-P3 which is not vulnerable to these issues.

Solution

Update the affected packages.

Plugin Details

Severity: Medium

ID: 51182

File Name: mandriva_MDVSA-2010-253.nasl

Version: 1.15

Type: local

Family: Mandriva Local Security Checks

Published: 12/15/2010

Updated: 1/6/2021

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 5.2

CVSS v2

Risk Factor: Medium

Base Score: 6.4

Temporal Score: 4.7

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:P/A:P

Vulnerability Information

CPE: p-cpe:/a:mandriva:linux:bind, p-cpe:/a:mandriva:linux:bind-devel, p-cpe:/a:mandriva:linux:bind-doc, p-cpe:/a:mandriva:linux:bind-utils, cpe:/o:mandriva:linux:2009.0, cpe:/o:mandriva:linux:2010.0, cpe:/o:mandriva:linux:2010.1

Required KB Items: Host/local_checks_enabled, Host/cpu, Host/Mandrake/release, Host/Mandrake/rpm-list

Exploit Ease: No known exploits are available

Patch Publication Date: 12/14/2010

Reference Information

CVE: CVE-2010-3613, CVE-2010-3614, CVE-2010-3762

BID: 45133, 45137, 45385

MDVSA: 2010:253

Detections

Analytics