Mandrake Linux Security Advisory : bind (MDKSA-2002:038-1)

High Nessus Plugin ID 13943


The remote Mandrake Linux host is missing one or more security updates.


A vulnerability was discovered in the BIND9 DNS server in versions prior to 9.2.1. An error condition will trigger the shutdown of the server when the rdataset parameter to the dns_message_findtype() function in message.c is not NULL as expected. This condition causes the server to assert an error message and shutdown the BIND server.
The error condition can be remotely exploited by a special DNS packet.
This can only be used to create a Denial of Service on the server; the error condition is correctly detected, so it will not allow an attacker to execute arbitrary code on the server.

Update :

Sascha Kettler noticed that the version of BIND9 supplied originally was in fact 9.2.1RC1 and mis-labelled as 9.2.1. The packages provided in this update are BIND 9.2.1 final. Likewise, the buffer overflow in the DNS resolver libraries, as noted in MDKSA-2002:043, has also been fixed. Thanks to Bernhard Rosenkraenzer at Red Hat for backporting the patches from 8.3.3 to 9.2.1.


Update the affected packages.

Plugin Details

Severity: High

ID: 13943

File Name: mandrake_MDKSA-2002-038.nasl

Version: $Revision: 1.19 $

Type: local

Published: 2004/07/31

Modified: 2013/05/31

Dependencies: 12634

Risk Information

Risk Factor: High


Base Score: 7.5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

Vulnerability Information

CPE: p-cpe:/a:mandriva:linux:bind, p-cpe:/a:mandriva:linux:bind-devel, p-cpe:/a:mandriva:linux:bind-utils, p-cpe:/a:mandriva:linux:caching-nameserver, cpe:/o:mandrakesoft:mandrake_linux:8.0, cpe:/o:mandrakesoft:mandrake_linux:8.1, cpe:/o:mandrakesoft:mandrake_linux:8.2

Required KB Items: Host/local_checks_enabled, Host/cpu, Host/Mandrake/release, Host/Mandrake/rpm-list

Patch Publication Date: 2002/08/15

Reference Information

CVE: CVE-2002-0400, CVE-2002-0651

CERT: 739123, 803539

MDKSA: 2002:038-1