[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <20090728180825.GE3577@redhat.com>
Date: Tue, 28 Jul 2009 12:08:25 -0600
From: Vincent Danen <vdanen@...hat.com>
To: oss-security@...ts.openwall.com
Subject: debian bug report on bind9 DoS
There's a bind 9 DoS reported in Debian's BTS [1] that provides a
reproducer and some interesting info on a bind9 crash. I don't think
it's a huge problem with a well-secured bind9 configuration, but could
be quite problematic for bind config's that allow updates without an
RNDC key (typical of some dynamic DNS implementations), or on a system
that has lax enough permissions that the RNDC key is exposed.
We don't ship bind 8 so I cannot say whether or not it only affects bind
9 or earlier versions. Some further information is in our bugzilla from
some quick testing I did [2].
This probably requires a CVE name.
[1] http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=538975
[2] https://bugzilla.redhat.com/show_bug.cgi?id=514292
--
Vincent Danen / Red Hat Security Response Team
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
