BIND: Incorrect signature verification

Background

ISC BIND is the Internet Systems Consortium implementation of the Domain Name System (DNS) protocol.

Description

BIND does not properly check the return value from the OpenSSL functions to verify DSA (CVE-2009-0025) and RSA (CVE-2009-0265) certificates.

Impact

A remote attacker could bypass validation of the certificate chain to spoof DNSSEC-authenticated records.

Workaround

There is no known workaround at this time.

Resolution

All BIND users should upgrade to the latest version:

 # emerge --sync
 # emerge --ask --oneshot --verbose ">=net-dns/bind-9.4.3_p1"