Lucene search

K
slackwareSlackware Linux ProjectSSA-2016-271-01
HistorySep 27, 2016 - 7:49 p.m.

[slackware-security] bind

2016-09-2719:49:07
Slackware Linux Project
www.slackware.com
14

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

7.8 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:N/I:N/A:C

0.973 High

EPSS

Percentile

99.8%

New bind packages are available for Slackware 13.0, 13.1, 13.37, 14.0, 14.1,
14.2, and -current to fix a security issue.

Here are the details from the Slackware 14.2 ChangeLog:

patches/packages/bind-9.10.4_P3-i586-1_slack14.2.txz: Upgraded.
This update fixes a denial-of-service vulnerability. Testing by ISC has
uncovered a critical error condition which can occur when a nameserver is
constructing a response. A defect in the rendering of messages into
packets can cause named to exit with an assertion failure in buffer.c while
constructing a response to a query that meets certain criteria.
For more information, see:
https://kb.isc.org/article/AA-01419/0
https://vulners.com/cve/CVE-2016-2776
(* Security fix *)

Where to find the new packages:

Thanks to the friendly folks at the OSU Open Source Lab
(http://osuosl.org) for donating FTP and rsync hosting
to the Slackware project! :-)

Also see the “Get Slack” section on http://slackware.com for
additional mirror sites near you.

Updated package for Slackware 13.0:
ftp://ftp.slackware.com/pub/slackware/slackware-13.0/patches/packages/bind-9.9.9_P3-i486-1_slack13.0.txz

Updated package for Slackware x86_64 13.0:
ftp://ftp.slackware.com/pub/slackware/slackware64-13.0/patches/packages/bind-9.9.9_P3-x86_64-1_slack13.0.txz

Updated package for Slackware 13.1:
ftp://ftp.slackware.com/pub/slackware/slackware-13.1/patches/packages/bind-9.9.9_P3-i486-1_slack13.1.txz

Updated package for Slackware x86_64 13.1:
ftp://ftp.slackware.com/pub/slackware/slackware64-13.1/patches/packages/bind-9.9.9_P3-x86_64-1_slack13.1.txz

Updated package for Slackware 13.37:
ftp://ftp.slackware.com/pub/slackware/slackware-13.37/patches/packages/bind-9.9.9_P3-i486-1_slack13.37.txz

Updated package for Slackware x86_64 13.37:
ftp://ftp.slackware.com/pub/slackware/slackware64-13.37/patches/packages/bind-9.9.9_P3-x86_64-1_slack13.37.txz

Updated package for Slackware 14.0:
ftp://ftp.slackware.com/pub/slackware/slackware-14.0/patches/packages/bind-9.9.9_P3-i486-1_slack14.0.txz

Updated package for Slackware x86_64 14.0:
ftp://ftp.slackware.com/pub/slackware/slackware64-14.0/patches/packages/bind-9.9.9_P3-x86_64-1_slack14.0.txz

Updated package for Slackware 14.1:
ftp://ftp.slackware.com/pub/slackware/slackware-14.1/patches/packages/bind-9.9.9_P3-i486-1_slack14.1.txz

Updated package for Slackware x86_64 14.1:
ftp://ftp.slackware.com/pub/slackware/slackware64-14.1/patches/packages/bind-9.9.9_P3-x86_64-1_slack14.1.txz

Updated package for Slackware 14.2:
ftp://ftp.slackware.com/pub/slackware/slackware-14.2/patches/packages/bind-9.10.4_P3-i586-1_slack14.2.txz

Updated package for Slackware x86_64 14.2:
ftp://ftp.slackware.com/pub/slackware/slackware64-14.2/patches/packages/bind-9.10.4_P3-x86_64-1_slack14.2.txz

Updated package for Slackware -current:
ftp://ftp.slackware.com/pub/slackware/slackware-current/slackware/n/bind-9.10.4_P3-i586-1.txz

Updated package for Slackware x86_64 -current:
ftp://ftp.slackware.com/pub/slackware/slackware64-current/slackware64/n/bind-9.10.4_P3-x86_64-1.txz

MD5 signatures:

Slackware 13.0 package:
ab51d9ac6707b0bfd5c93cbcad7f4781 bind-9.9.9_P3-i486-1_slack13.0.txz

Slackware x86_64 13.0 package:
d9e28b1579217f4007f621237771ebef bind-9.9.9_P3-x86_64-1_slack13.0.txz

Slackware 13.1 package:
de4f0a1f2fb41df7a18f80b5f2fd6ea0 bind-9.9.9_P3-i486-1_slack13.1.txz

Slackware x86_64 13.1 package:
39dc9476268fddc108527556e54511a1 bind-9.9.9_P3-x86_64-1_slack13.1.txz

Slackware 13.37 package:
73c0b3bfa6a0f049e9765e34f95a7659 bind-9.9.9_P3-i486-1_slack13.37.txz

Slackware x86_64 13.37 package:
dd772fed4ab33f83290400ea6a803895 bind-9.9.9_P3-x86_64-1_slack13.37.txz

Slackware 14.0 package:
e3c00b78b92de59451e39a61d00d8b37 bind-9.9.9_P3-i486-1_slack14.0.txz

Slackware x86_64 14.0 package:
baf936532b15bccd2b1cdfa5c400619c bind-9.9.9_P3-x86_64-1_slack14.0.txz

Slackware 14.1 package:
11031ad0191333afaf0fc8225aca5464 bind-9.9.9_P3-i486-1_slack14.1.txz

Slackware x86_64 14.1 package:
f4ce795b56bc3e21ace27aff01e91194 bind-9.9.9_P3-x86_64-1_slack14.1.txz

Slackware 14.2 package:
c8b239b473edf073cbac5863aa6f1038 bind-9.10.4_P3-i586-1_slack14.2.txz

Slackware x86_64 14.2 package:
7207ababf09ad1788446d2aba78aa9db bind-9.10.4_P3-x86_64-1_slack14.2.txz

Slackware -current package:
14c4becc3dc41398ecc99c82818f3d67 n/bind-9.10.4_P3-i586-1.txz

Slackware x86_64 -current package:
b11c33727c0eb6525df942f54befd5ff n/bind-9.10.4_P3-x86_64-1.txz

Installation instructions:

Upgrade the package as root:
> upgradepkg bind-9.10.4_P3-i586-1_slack14.2.txz

Then, restart the name server:

> /etc/rc.d/rc.bind restart

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

7.8 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:N/I:N/A:C

0.973 High

EPSS

Percentile

99.8%