Subject: [FreeBSD-Announce] FreeBSD Security Advisory FreeBSD-SA-07:07.bind

From: FreeBSD Security Advisories <security-advisories@...> · Date: Wednesday, August 1, 2007 - 5:27 pm

Affects:        FreeBSD 5.3 and later.

Corrected:      2007-07-25 08:23:08 UTC (RELENG_6, 6.2-STABLE)

                2007-08-01 20:44:58 UTC (RELENG_6_2, 6.2-RELEASE-p7)

                2007-08-01 20:45:49 UTC (RELENG_6_1, 6.1-RELEASE-p19)

                2007-07-25 08:24:40 UTC (RELENG_5, 5.5-STABLE)

                2007-08-01 20:48:19 UTC (RELENG_5_5, 5.5-RELEASE-p15)

CVE Name:       CVE-2007-2926
For general information regarding FreeBSD Security Advisories,

including descriptions of the fields above, security branches, and the

following sections, please visit .
I.   Background
BIND 9 is an implementation of the Domain Name System (DNS) protocols.

The named(8) daemon is an Internet Domain Name Server.  DNS requests

contain a query id which is used match a DNS request with the response

and to make it harder for anybody but the DNS server which received the

request to send a valid response.
II.  Problem Description
When named(8) is operating as a recursive DNS server or sending NOTIFY

requests to slave DNS servers, named(8) uses a predictable query id.
III. Impact
An attacker who can see the query id for some request(s) sent by named(8)

is likely to be able to perform DNS cache poisoning by predicting the

query id for other request(s).
IV.  Workaround
No workaround is available.
V.   Solution
Perform one of the following:
1) Upgrade your vulnerable system to 5-STABLE, or 6-STABLE, or to the

RELENG_6_2, RELENG_6_1, or RELENG_5_5 security branch dated after the

correction date.
2) To patch your present system:
The following patches have been verified to apply to FreeBSD 5.5, 6.1,

and 6.2 systems.
a) Download the relevant patch from the location below, and verify the

detached PGP signature using your PGP utility.
# fetch http://security.FreeBSD.org/patches/SA-07:07/bind.patch

# fetch http://security.FreeBSD.org/patches/SA-07:07/bind.patch.asc
b) Execute the following commands as root:
# cd /usr/src

# patch < /path/to/patch

# cd /usr/src/lib/bind

# make obj && make depend && make && make install

# cd /usr/src/usr.sbin/named

# make obj && make depend && make && make install
VI.  Correction details
The following list contains the revision numbers of each file that was

corrected in FreeBSD.
Branch                                                           Revision

  Path

- -------------------------------------------------------------------------

RELENG_5

  src/contrib/bind9/bin/named/client.c                        1.1.1.1.2.5

  src/contrib/bind9/lib/dns/dispatch.c                        1.1.1.1.2.3

  src/contrib/bind9/lib/dns/include/dns/dispatch.h            1.1.1.1.2.2

RELENG_5_5

  src/UPDATING                                            1.342.2.35.2.15

  src/sys/conf/newvers.sh                                  1.62.2.21.2.17

  src/contrib/bind9/bin/named/client.c                    1.1.1.1.2.3.2.1

  src/contrib/bind9/lib/dns/dispatch.c                    1.1.1.1.2.1.6.1

  src/contrib/bind9/lib/dns/include/dns/dispatch.h        1.1.1.1.2.1.6.1

RELENG_6

  src/contrib/bind9/bin/named/client.c                        1.1.1.2.2.3

  src/contrib/bind9/lib/dns/dispatch.c                        1.1.1.1.4.2

  src/contrib/bind9/lib/dns/include/dns/dispatch.h            1.1.1.1.4.1

RELENG_6_2

  src/UPDATING                                            1.416.2.29.2.10

  src/sys/conf/newvers.sh                                  1.69.2.13.2.10

  src/contrib/bind9/bin/named/client.c                    1.1.1.2.2.1.4.2

  src/contrib/bind9/lib/dns/dispatch.c                       1.1.1.1.10.2

  src/contrib/bind9/lib/dns/include/dns/dispatch.h           1.1.1.1.10.1

RELENG_6_1

  src/UPDATING                                            1.416.2.22.2.21

  src/sys/conf/newvers.sh                                  1.69.2.11.2.21

  src/contrib/bind9/bin/named/client.c                    1.1.1.2.2.1.2.1

  src/contrib/bind9/lib/dns/dispatch.c                        1.1.1.1.8.1

  src/contrib/bind9/lib/dns/include/dns/dispatch.h            1.1.1.1.8.1

- -------------------------------------------------------------------------
VII. References
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2926

http://www.isc.org/sw/bind/bind-security.php

http://www.trusteer.com/docs/bind9dns_s.html
The latest revision of this advisory is available at

http://security.FreeBSD.org/advisories/FreeBSD-SA-07:07.bind.asc

-----BEGIN PGP SIGNATURE-----

Version: GnuPG v1.4.7 (FreeBSD)
iD8DBQFGsPfzFdaIBMps37IRAgIfAJ9cO2LUUc0eb8T+6pltpha91wR2IgCeITpx

H3SHyAkPMSICqnT9nY/UBE8=

=Fop4

-----END PGP SIGNATURE-----

_______________________________________________

freebsd-announce@freebsd.org mailing list

http://lists.freebsd.org/mailman/listinfo/freebsd-announce

To unsubscribe, send any mail to "freebsd-announce-unsubscribe@freebsd.org"


linux-kernel:
Andrew Morton	-mm merge plans for 2.6.23
Greg Kroah-Hartman	[PATCH 004/196] Chinese: add translation of SubmittingPatches
Tarkan Erimer	Re: Dual-Licensing Linux Kernel with GPL V2 and GPL V3
Gabriel C	Re: [Announce] [patch] Modular Scheduler Core and Completely Fair Scheduler [CFS]
git:

linux-netdev:
Gerrit Renker	[PATCH 03/37] dccp: List management for new feature negotiation
David Miller	[GIT]: Networking
Thomas Jarosch	Re: TCP connection stalls under 2.6.24.7
Jarek Poplawski	[PATCH] pkt_sched: Destroy gen estimators under rtnl_lock().
openbsd-misc:

[FreeBSD-Announce] FreeBSD Security Advisory FreeBSD-SA-07:07.bind

Online users