Security Bulletin: PowerKVM is affected by a bind vulnerability (CVE-2015-1349)

Summary

PowerKVM is affected by bind vulnerability CVE-2015-1349.

Vulnerability Details

CVEID: CVE-2015-1349**
DESCRIPTION:** ISC BIND is vulnerable to a denial of service, caused by an error in the managed trust anchors on systems configured to perform DNSSEC validation and using managed-keys. By sending specially-crafted data, a remote attacker could exploit this vulnerability to cause the target “named” service to crash.
CVSS Base Score: 5.4
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/#/vulnerabilities/100968 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:H/Au:N/C:N/I:N/A:C)

Affected Products and Versions

PowerKVM 2.1

Remediation/Fixes

Fix is made available via Fix Central in 2.1.1 build 52 and all later builds and fix packs. For systems currently running fix levels of PowerKVM prior to 2.1.1, please see the README at <http://delivery04.dhe.ibm.com/sar/CMA/OSA/04xig/0/README&gt; for prerequisite fixes and instructions.

Workarounds and Mitigations

none