7.6 High
CVSS2
Access Vector
NETWORK
Access Complexity
HIGH
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:H/Au:N/C:C/I:C/A:C
Several cache-poisoning vulnerabilities have been discovered in BIND.
These vulnerabilities apply only if DNSSEC validation is enabled and
trust anchors have been installed, which is not the default.
The Common Vulnerabilities and Exposures project identifies the
following problems:
In addition, this update introduce a more conservative query behavior
in the presence of repeated DNSSEC validation failures, addressing the
“roll over and die” phenomenon. The new version also supports the
cryptographic algorithm used by the upcoming signed ICANN DNS root
(RSASHA256 from RFC 5702), and the NSEC3 secure denial of existence
algorithm used by some signed top-level domains.
This update is based on a new upstream version of BIND 9, 9.6-ESV-R1.
Because of the scope of changes, extra care is recommended when
installing the update. Due to ABI changes, new Debian packages are
included, and the update has to be installed using “apt-get
dist-upgrade” (or an equivalent aptitude command).
For the stable distribution (lenny), these problems have been fixed in
version 1:9.6.ESV.R1+dfsg-0+lenny1.
For the unstable distribution (sid), these problems have been fixed in
version 1:9.7.0.dfsg-1.
We recommend that you upgrade your bind9 packages.