news 28 Posted September 2, 2015 -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 [slackware-security] bind (SSA:2015-245-01) New bind packages are available for Slackware 13.0, 13.1, 13.37, 14.0, 14.1, and -current to fix security issues. Here are the details from the Slackware 14.1 ChangeLog: +--------------------------+ patches/packages/bind-9.9.7_P3-i486-1_slack14.1.txz: Upgraded. This update fixes two denial-of-service vulnerabilities: + CVE-2015-5722 is a denial-of-service vector which can be exploited remotely against a BIND server that is performing validation on DNSSEC-signed records. Vali[censored] recursive resolvers are at the greatest risk from this defect, but it has not been ruled out that it could be exploited against an authoritative-only nameserver under limited conditions. Servers that are not performing validation are not vulnerable. However, ISC does not recommend disabling validation as a workaround to this issue as it exposes the server to other types of attacks. Upgrading to the patched versions is the recommended solution. All versions of BIND since 9.0.0 are vulnerable to CVE-2015-5722. + CVE-2015-5986 is a denial-of-service vector which can be used against a BIND server that is performing recursion. Validation is not required. Recursive resolvers are at the greatest risk from this defect, but it has not been ruled out that it could be exploited against an authoritative-only nameserver under limited conditions. Only versions of BIND since 9.9.7 and 9.10.2 are vulnerable to CVE-2015-5986. For more information, see: https://kb.isc.org/article/AA-01287/0 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5722 https://kb.isc.org/article/AA-01291/0 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5986 (* Security fix *) +--------------------------+ Where to find the new packages: +-----------------------------+ Thanks to the friendly folks at the OSU Open Source Lab (http://osuosl.org) for donating FTP and rsync hosting to the Slackware project! :-) Also see the "Get Slack" section on http://slackware.com for additional mirror sites near you. Updated package for Slackware 13.0: ftp://ftp.slackware.com/pub/slackware/slackware-13.0/patches/packages/bind-9.9.7_P3-i486-1_slack13.0.txz Updated package for Slackware x86_64 13.0: ftp://ftp.slackware.com/pub/slackware/slackware64-13.0/patches/packages/bind-9.9.7_P3-x86_64-1_slack13.0.txz Updated package for Slackware 13.1: ftp://ftp.slackware.com/pub/slackware/slackware-13.1/patches/packages/bind-9.9.7_P3-i486-1_slack13.1.txz Updated package for Slackware x86_64 13.1: ftp://ftp.slackware.com/pub/slackware/slackware64-13.1/patches/packages/bind-9.9.7_P3-x86_64-1_slack13.1.txz Updated package for Slackware 13.37: ftp://ftp.slackware.com/pub/slackware/slackware-13.37/patches/packages/bind-9.9.7_P3-i486-1_slack13.37.txz Updated package for Slackware x86_64 13.37: ftp://ftp.slackware.com/pub/slackware/slackware64-13.37/patches/packages/bind-9.9.7_P3-x86_64-1_slack13.37.txz Updated package for Slackware 14.0: ftp://ftp.slackware.com/pub/slackware/slackware-14.0/patches/packages/bind-9.9.7_P3-i486-1_slack14.0.txz Updated package for Slackware x86_64 14.0: ftp://ftp.slackware.com/pub/slackware/slackware64-14.0/patches/packages/bind-9.9.7_P3-x86_64-1_slack14.0.txz Updated package for Slackware 14.1: ftp://ftp.slackware.com/pub/slackware/slackware-14.1/patches/packages/bind-9.9.7_P3-i486-1_slack14.1.txz Updated package for Slackware x86_64 14.1: ftp://ftp.slackware.com/pub/slackware/slackware64-14.1/patches/packages/bind-9.9.7_P3-x86_64-1_slack14.1.txz Updated package for Slackware -current: ftp://ftp.slackware.com/pub/slackware/slackware-current/slackware/n/bind-9.10.2_P4-i586-1.txz Updated package for Slackware x86_64 -current: ftp://ftp.slackware.com/pub/slackware/slackware64-current/slackware64/n/bind-9.10.2_P4-x86_64-1.txz MD5 signatures: +-------------+ Slackware 13.0 package: 627f6c6827eca24776d790166801de25 bind-9.9.7_P3-i486-1_slack13.0.txz Slackware x86_64 13.0 package: 49082f50322af84efe8d91459599b837 bind-9.9.7_P3-x86_64-1_slack13.0.txz Slackware 13.1 package: 4dd375df46e84dbecb9f296e2fec692a bind-9.9.7_P3-i486-1_slack13.1.txz Slackware x86_64 13.1 package: 90b4376b145544d9a63c28dcb891ca47 bind-9.9.7_P3-x86_64-1_slack13.1.txz Slackware 13.37 package: 181ce9e11eb9d909c5c06b8ddd5bb1b5 bind-9.9.7_P3-i486-1_slack13.37.txz Slackware x86_64 13.37 package: 368f7a3b977865b0132bdcd129e70813 bind-9.9.7_P3-x86_64-1_slack13.37.txz Slackware 14.0 package: 3bb80a54fb5d0f76d17ef33cf06a074d bind-9.9.7_P3-i486-1_slack14.0.txz Slackware x86_64 14.0 package: d77b36e48e2c033ffa9d99816979304f bind-9.9.7_P3-x86_64-1_slack14.0.txz Slackware 14.1 package: ada9c70208885b4c7904364e040360f9 bind-9.9.7_P3-i486-1_slack14.1.txz Slackware x86_64 14.1 package: a78fbe27ba2834d2918fa26ce96d5083 bind-9.9.7_P3-x86_64-1_slack14.1.txz Slackware -current package: 450614c08d5fac56c8d2701394d1af50 n/bind-9.10.2_P4-i586-1.txz Slackware x86_64 -current package: 32e680d6bce8dac3ad5ba54958f68f95 n/bind-9.10.2_P4-x86_64-1.txz Installation instructions: +------------------------+ Upgrade the package as root: # upgradepkg bind-9.9.7_P3-i486-1_slack14.1.txz Then, restart the name server: # /etc/rc.d/rc.bind restart +-----+ Slackware Linux Security Team http://slackware.com/gpg-key security ( -at -) slackware.com +------------------------------------------------------------------------+ Share this post Link to post
