Säkerhetsbulletin från Debian

DSA-2054-1 bind9 -- DNS-cacheförgiftning

Rapporterat den:
2010-06-04
Berörda paket:
bind9
Sårbara:
Ja
Referenser i säkerhetsdatabaser:
I Mitres CVE-förteckning: CVE-2010-0097, CVE-2010-0290, CVE-2010-0382.
Ytterligare information:

Flera cacheförgiftningssårbarheter har upptäckts i BIND. Dessa sårbarheter kan bara utnyttjas om DNSSEC-validering är aktiverad och tillitsankare har installerats, vilket inte gäller som standard.

Projektet Common Vulnerabilities and Exposures identifierar följande problem:

  • CVE-2010-0097

    BIND validerar inte DNSSEC NSEC-poster korrekt, vilket tillåter angripare utifrån att lägga till AD-flaggan (Authenticated Data) till ett förfalskat NXDOMAIN-svar för en existerande domän.

  • CVE-2010-0290

    Vid behandling av specialskrivna svar som innehåller CNAME- eller DNAME-poster, är BIND sårbar för ett DNS-cacheförgiftningsproblem, under förutsättning att DNSSEC-validering är aktiverad och tillitsankare har installerats.

  • CVE-2010-0382

    Vid behandling av särskilda svar som innehåller out-of-bailiwick-data, är BIND sårbar för ett DNS-cacheförgiftningsproblem, under förutsättning att DNSSEC-validering är aktiverad och tillitsankare har installerats.

Dessutom introducerar denna uppdatering ett konservative frågebeteende vid förekomst av upprepade DNSSEC-valideringsfel, för att ta itu med rulla runt och dö-fenomenet. Den nya versionen stödjer också den kryptografiska algoritm som används av den kommande, signerade ICANN DNS-roten (RSASHA256 från RFC 5702) och den NSEC3-säkra algoritmen för förnekande av existens som används av några signerade toppnivådomäner.

Denna uppdatering baseras på en ny uppströms version av BIND 9, 9.6-ESV-R1. På grund av omfattningen av ändringar rekommenderas extra försiktighet vid installation av uppdateringen. På grund av ABI-förändringar inkluderas nya Debian-paket och uppdatering måste installeras med hjälp av apt-get dist-upgrade (eller motsvarande aptitude-kommando).

För den stabila utgåvan (Lenny) har dessa problem rättats i version 1:9.6.ESV.R1+dfsg-0+lenny1.

För den instabila utgåvan (Sid) har dessa problem rättats i version 1:9.7.0.dfsg-1.

Vi rekommenderar att ni uppgraderar era bind9-paket.

Rättat i:

Debian GNU/Linux 5.0 (lenny)

Källkod:
http://security.debian.org/pool/updates/main/b/bind9/bind9_9.6.ESV.R1+dfsg-0+lenny1.diff.gz
http://security.debian.org/pool/updates/main/b/bind9/bind9_9.6.ESV.R1+dfsg.orig.tar.gz
http://security.debian.org/pool/updates/main/b/bind9/bind9_9.6.ESV.R1+dfsg-0+lenny1.dsc
Arkitekturoberoende komponent:
http://security.debian.org/pool/updates/main/b/bind9/bind9-doc_9.6.ESV.R1+dfsg-0+lenny1_all.deb
Alpha:
http://security.debian.org/pool/updates/main/b/bind9/libisc52_9.6.ESV.R1+dfsg-0+lenny1_alpha.deb
http://security.debian.org/pool/updates/main/b/bind9/libbind-dev_9.6.ESV.R1+dfsg-0+lenny1_alpha.deb
http://security.debian.org/pool/updates/main/b/bind9/lwresd_9.6.ESV.R1+dfsg-0+lenny1_alpha.deb
http://security.debian.org/pool/updates/main/b/bind9/libbind9-50_9.6.ESV.R1+dfsg-0+lenny1_alpha.deb
http://security.debian.org/pool/updates/main/b/bind9/bind9-host_9.6.ESV.R1+dfsg-0+lenny1_alpha.deb
http://security.debian.org/pool/updates/main/b/bind9/liblwres50_9.6.ESV.R1+dfsg-0+lenny1_alpha.deb
http://security.debian.org/pool/updates/main/b/bind9/libisccc50_9.6.ESV.R1+dfsg-0+lenny1_alpha.deb
http://security.debian.org/pool/updates/main/b/bind9/libisccfg50_9.6.ESV.R1+dfsg-0+lenny1_alpha.deb
http://security.debian.org/pool/updates/main/b/bind9/bind9utils_9.6.ESV.R1+dfsg-0+lenny1_alpha.deb
http://security.debian.org/pool/updates/main/b/bind9/libdns55_9.6.ESV.R1+dfsg-0+lenny1_alpha.deb
http://security.debian.org/pool/updates/main/b/bind9/bind9_9.6.ESV.R1+dfsg-0+lenny1_alpha.deb
http://security.debian.org/pool/updates/main/b/bind9/dnsutils_9.6.ESV.R1+dfsg-0+lenny1_alpha.deb
AMD64:
http://security.debian.org/pool/updates/main/b/bind9/libbind-dev_9.6.ESV.R1+dfsg-0+lenny1_amd64.deb
http://security.debian.org/pool/updates/main/b/bind9/bind9-host_9.6.ESV.R1+dfsg-0+lenny1_amd64.deb
http://security.debian.org/pool/updates/main/b/bind9/dnsutils_9.6.ESV.R1+dfsg-0+lenny1_amd64.deb
http://security.debian.org/pool/updates/main/b/bind9/libisc52_9.6.ESV.R1+dfsg-0+lenny1_amd64.deb
http://security.debian.org/pool/updates/main/b/bind9/libisccc50_9.6.ESV.R1+dfsg-0+lenny1_amd64.deb
http://security.debian.org/pool/updates/main/b/bind9/libisccfg50_9.6.ESV.R1+dfsg-0+lenny1_amd64.deb
http://security.debian.org/pool/updates/main/b/bind9/bind9utils_9.6.ESV.R1+dfsg-0+lenny1_amd64.deb
http://security.debian.org/pool/updates/main/b/bind9/libbind9-50_9.6.ESV.R1+dfsg-0+lenny1_amd64.deb
http://security.debian.org/pool/updates/main/b/bind9/libdns55_9.6.ESV.R1+dfsg-0+lenny1_amd64.deb
http://security.debian.org/pool/updates/main/b/bind9/bind9_9.6.ESV.R1+dfsg-0+lenny1_amd64.deb
http://security.debian.org/pool/updates/main/b/bind9/lwresd_9.6.ESV.R1+dfsg-0+lenny1_amd64.deb
http://security.debian.org/pool/updates/main/b/bind9/liblwres50_9.6.ESV.R1+dfsg-0+lenny1_amd64.deb
ARM:
http://security.debian.org/pool/updates/main/b/bind9/dnsutils_9.6.ESV.R1+dfsg-0+lenny1_arm.deb
http://security.debian.org/pool/updates/main/b/bind9/libbind9-50_9.6.ESV.R1+dfsg-0+lenny1_arm.deb
http://security.debian.org/pool/updates/main/b/bind9/lwresd_9.6.ESV.R1+dfsg-0+lenny1_arm.deb
http://security.debian.org/pool/updates/main/b/bind9/libisccc50_9.6.ESV.R1+dfsg-0+lenny1_arm.deb
http://security.debian.org/pool/updates/main/b/bind9/bind9utils_9.6.ESV.R1+dfsg-0+lenny1_arm.deb
http://security.debian.org/pool/updates/main/b/bind9/libisccfg50_9.6.ESV.R1+dfsg-0+lenny1_arm.deb
http://security.debian.org/pool/updates/main/b/bind9/libdns55_9.6.ESV.R1+dfsg-0+lenny1_arm.deb
http://security.debian.org/pool/updates/main/b/bind9/bind9_9.6.ESV.R1+dfsg-0+lenny1_arm.deb
http://security.debian.org/pool/updates/main/b/bind9/bind9-host_9.6.ESV.R1+dfsg-0+lenny1_arm.deb
http://security.debian.org/pool/updates/main/b/bind9/libbind-dev_9.6.ESV.R1+dfsg-0+lenny1_arm.deb
http://security.debian.org/pool/updates/main/b/bind9/liblwres50_9.6.ESV.R1+dfsg-0+lenny1_arm.deb
http://security.debian.org/pool/updates/main/b/bind9/libisc52_9.6.ESV.R1+dfsg-0+lenny1_arm.deb
ARM EABI:
http://security.debian.org/pool/updates/main/b/bind9/bind9_9.6.ESV.R1+dfsg-0+lenny1_armel.deb
http://security.debian.org/pool/updates/main/b/bind9/libdns55_9.6.ESV.R1+dfsg-0+lenny1_armel.deb
http://security.debian.org/pool/updates/main/b/bind9/libisccc50_9.6.ESV.R1+dfsg-0+lenny1_armel.deb
http://security.debian.org/pool/updates/main/b/bind9/libisccfg50_9.6.ESV.R1+dfsg-0+lenny1_armel.deb
http://security.debian.org/pool/updates/main/b/bind9/lwresd_9.6.ESV.R1+dfsg-0+lenny1_armel.deb
http://security.debian.org/pool/updates/main/b/bind9/bind9-host_9.6.ESV.R1+dfsg-0+lenny1_armel.deb
http://security.debian.org/pool/updates/main/b/bind9/libbind9-50_9.6.ESV.R1+dfsg-0+lenny1_armel.deb
http://security.debian.org/pool/updates/main/b/bind9/liblwres50_9.6.ESV.R1+dfsg-0+lenny1_armel.deb
http://security.debian.org/pool/updates/main/b/bind9/bind9utils_9.6.ESV.R1+dfsg-0+lenny1_armel.deb
http://security.debian.org/pool/updates/main/b/bind9/libbind-dev_9.6.ESV.R1+dfsg-0+lenny1_armel.deb
http://security.debian.org/pool/updates/main/b/bind9/dnsutils_9.6.ESV.R1+dfsg-0+lenny1_armel.deb
http://security.debian.org/pool/updates/main/b/bind9/libisc52_9.6.ESV.R1+dfsg-0+lenny1_armel.deb
HP Precision:
http://security.debian.org/pool/updates/main/b/bind9/lwresd_9.6.ESV.R1+dfsg-0+lenny1_hppa.deb
http://security.debian.org/pool/updates/main/b/bind9/libbind-dev_9.6.ESV.R1+dfsg-0+lenny1_hppa.deb
http://security.debian.org/pool/updates/main/b/bind9/bind9-host_9.6.ESV.R1+dfsg-0+lenny1_hppa.deb
http://security.debian.org/pool/updates/main/b/bind9/libisccfg50_9.6.ESV.R1+dfsg-0+lenny1_hppa.deb
http://security.debian.org/pool/updates/main/b/bind9/libisccc50_9.6.ESV.R1+dfsg-0+lenny1_hppa.deb
http://security.debian.org/pool/updates/main/b/bind9/liblwres50_9.6.ESV.R1+dfsg-0+lenny1_hppa.deb
http://security.debian.org/pool/updates/main/b/bind9/libisc52_9.6.ESV.R1+dfsg-0+lenny1_hppa.deb
http://security.debian.org/pool/updates/main/b/bind9/libbind9-50_9.6.ESV.R1+dfsg-0+lenny1_hppa.deb
http://security.debian.org/pool/updates/main/b/bind9/bind9utils_9.6.ESV.R1+dfsg-0+lenny1_hppa.deb
http://security.debian.org/pool/updates/main/b/bind9/dnsutils_9.6.ESV.R1+dfsg-0+lenny1_hppa.deb
http://security.debian.org/pool/updates/main/b/bind9/libdns55_9.6.ESV.R1+dfsg-0+lenny1_hppa.deb
http://security.debian.org/pool/updates/main/b/bind9/bind9_9.6.ESV.R1+dfsg-0+lenny1_hppa.deb
Intel IA-32:
http://security.debian.org/pool/updates/main/b/bind9/bind9utils_9.6.ESV.R1+dfsg-0+lenny1_i386.deb
http://security.debian.org/pool/updates/main/b/bind9/bind9-host_9.6.ESV.R1+dfsg-0+lenny1_i386.deb
http://security.debian.org/pool/updates/main/b/bind9/liblwres50_9.6.ESV.R1+dfsg-0+lenny1_i386.deb
http://security.debian.org/pool/updates/main/b/bind9/dnsutils_9.6.ESV.R1+dfsg-0+lenny1_i386.deb
http://security.debian.org/pool/updates/main/b/bind9/libisc52_9.6.ESV.R1+dfsg-0+lenny1_i386.deb
http://security.debian.org/pool/updates/main/b/bind9/libbind-dev_9.6.ESV.R1+dfsg-0+lenny1_i386.deb
http://security.debian.org/pool/updates/main/b/bind9/libisccc50_9.6.ESV.R1+dfsg-0+lenny1_i386.deb
http://security.debian.org/pool/updates/main/b/bind9/libisccfg50_9.6.ESV.R1+dfsg-0+lenny1_i386.deb
http://security.debian.org/pool/updates/main/b/bind9/bind9_9.6.ESV.R1+dfsg-0+lenny1_i386.deb
http://security.debian.org/pool/updates/main/b/bind9/libdns55_9.6.ESV.R1+dfsg-0+lenny1_i386.deb
http://security.debian.org/pool/updates/main/b/bind9/libbind9-50_9.6.ESV.R1+dfsg-0+lenny1_i386.deb
http://security.debian.org/pool/updates/main/b/bind9/lwresd_9.6.ESV.R1+dfsg-0+lenny1_i386.deb
Intel IA-64:
http://security.debian.org/pool/updates/main/b/bind9/libisc52_9.6.ESV.R1+dfsg-0+lenny1_ia64.deb
http://security.debian.org/pool/updates/main/b/bind9/bind9-host_9.6.ESV.R1+dfsg-0+lenny1_ia64.deb
http://security.debian.org/pool/updates/main/b/bind9/libbind9-50_9.6.ESV.R1+dfsg-0+lenny1_ia64.deb
http://security.debian.org/pool/updates/main/b/bind9/bind9_9.6.ESV.R1+dfsg-0+lenny1_ia64.deb
http://security.debian.org/pool/updates/main/b/bind9/dnsutils_9.6.ESV.R1+dfsg-0+lenny1_ia64.deb
http://security.debian.org/pool/updates/main/b/bind9/bind9utils_9.6.ESV.R1+dfsg-0+lenny1_ia64.deb
http://security.debian.org/pool/updates/main/b/bind9/liblwres50_9.6.ESV.R1+dfsg-0+lenny1_ia64.deb
http://security.debian.org/pool/updates/main/b/bind9/libdns55_9.6.ESV.R1+dfsg-0+lenny1_ia64.deb
http://security.debian.org/pool/updates/main/b/bind9/libisccc50_9.6.ESV.R1+dfsg-0+lenny1_ia64.deb
http://security.debian.org/pool/updates/main/b/bind9/libisccfg50_9.6.ESV.R1+dfsg-0+lenny1_ia64.deb
http://security.debian.org/pool/updates/main/b/bind9/libbind-dev_9.6.ESV.R1+dfsg-0+lenny1_ia64.deb
http://security.debian.org/pool/updates/main/b/bind9/lwresd_9.6.ESV.R1+dfsg-0+lenny1_ia64.deb
Big-endian MIPS:
http://security.debian.org/pool/updates/main/b/bind9/libdns55_9.6.ESV.R1+dfsg-0+lenny1_mips.deb
http://security.debian.org/pool/updates/main/b/bind9/bind9-host_9.6.ESV.R1+dfsg-0+lenny1_mips.deb
http://security.debian.org/pool/updates/main/b/bind9/libbind-dev_9.6.ESV.R1+dfsg-0+lenny1_mips.deb
http://security.debian.org/pool/updates/main/b/bind9/bind9_9.6.ESV.R1+dfsg-0+lenny1_mips.deb
http://security.debian.org/pool/updates/main/b/bind9/libisc52_9.6.ESV.R1+dfsg-0+lenny1_mips.deb
http://security.debian.org/pool/updates/main/b/bind9/libisccfg50_9.6.ESV.R1+dfsg-0+lenny1_mips.deb
http://security.debian.org/pool/updates/main/b/bind9/libisccc50_9.6.ESV.R1+dfsg-0+lenny1_mips.deb
http://security.debian.org/pool/updates/main/b/bind9/liblwres50_9.6.ESV.R1+dfsg-0+lenny1_mips.deb
http://security.debian.org/pool/updates/main/b/bind9/libbind9-50_9.6.ESV.R1+dfsg-0+lenny1_mips.deb
http://security.debian.org/pool/updates/main/b/bind9/lwresd_9.6.ESV.R1+dfsg-0+lenny1_mips.deb
http://security.debian.org/pool/updates/main/b/bind9/bind9utils_9.6.ESV.R1+dfsg-0+lenny1_mips.deb
http://security.debian.org/pool/updates/main/b/bind9/dnsutils_9.6.ESV.R1+dfsg-0+lenny1_mips.deb
Little-endian MIPS:
http://security.debian.org/pool/updates/main/b/bind9/libdns55_9.6.ESV.R1+dfsg-0+lenny1_mipsel.deb
http://security.debian.org/pool/updates/main/b/bind9/libisccc50_9.6.ESV.R1+dfsg-0+lenny1_mipsel.deb
http://security.debian.org/pool/updates/main/b/bind9/libisccfg50_9.6.ESV.R1+dfsg-0+lenny1_mipsel.deb
http://security.debian.org/pool/updates/main/b/bind9/libbind9-50_9.6.ESV.R1+dfsg-0+lenny1_mipsel.deb
http://security.debian.org/pool/updates/main/b/bind9/lwresd_9.6.ESV.R1+dfsg-0+lenny1_mipsel.deb
http://security.debian.org/pool/updates/main/b/bind9/bind9utils_9.6.ESV.R1+dfsg-0+lenny1_mipsel.deb
http://security.debian.org/pool/updates/main/b/bind9/libbind-dev_9.6.ESV.R1+dfsg-0+lenny1_mipsel.deb
http://security.debian.org/pool/updates/main/b/bind9/bind9_9.6.ESV.R1+dfsg-0+lenny1_mipsel.deb
http://security.debian.org/pool/updates/main/b/bind9/liblwres50_9.6.ESV.R1+dfsg-0+lenny1_mipsel.deb
http://security.debian.org/pool/updates/main/b/bind9/bind9-host_9.6.ESV.R1+dfsg-0+lenny1_mipsel.deb
http://security.debian.org/pool/updates/main/b/bind9/libisc52_9.6.ESV.R1+dfsg-0+lenny1_mipsel.deb
http://security.debian.org/pool/updates/main/b/bind9/dnsutils_9.6.ESV.R1+dfsg-0+lenny1_mipsel.deb
PowerPC:
http://security.debian.org/pool/updates/main/b/bind9/libisccfg50_9.6.ESV.R1+dfsg-0+lenny1_powerpc.deb
http://security.debian.org/pool/updates/main/b/bind9/libisccc50_9.6.ESV.R1+dfsg-0+lenny1_powerpc.deb
http://security.debian.org/pool/updates/main/b/bind9/libdns55_9.6.ESV.R1+dfsg-0+lenny1_powerpc.deb
http://security.debian.org/pool/updates/main/b/bind9/bind9_9.6.ESV.R1+dfsg-0+lenny1_powerpc.deb
http://security.debian.org/pool/updates/main/b/bind9/bind9utils_9.6.ESV.R1+dfsg-0+lenny1_powerpc.deb
http://security.debian.org/pool/updates/main/b/bind9/dnsutils_9.6.ESV.R1+dfsg-0+lenny1_powerpc.deb
http://security.debian.org/pool/updates/main/b/bind9/libisc52_9.6.ESV.R1+dfsg-0+lenny1_powerpc.deb
http://security.debian.org/pool/updates/main/b/bind9/lwresd_9.6.ESV.R1+dfsg-0+lenny1_powerpc.deb
http://security.debian.org/pool/updates/main/b/bind9/bind9-host_9.6.ESV.R1+dfsg-0+lenny1_powerpc.deb
http://security.debian.org/pool/updates/main/b/bind9/libbind-dev_9.6.ESV.R1+dfsg-0+lenny1_powerpc.deb
http://security.debian.org/pool/updates/main/b/bind9/liblwres50_9.6.ESV.R1+dfsg-0+lenny1_powerpc.deb
http://security.debian.org/pool/updates/main/b/bind9/libbind9-50_9.6.ESV.R1+dfsg-0+lenny1_powerpc.deb
IBM S/390:
http://security.debian.org/pool/updates/main/b/bind9/bind9utils_9.6.ESV.R1+dfsg-0+lenny1_s390.deb
http://security.debian.org/pool/updates/main/b/bind9/libbind-dev_9.6.ESV.R1+dfsg-0+lenny1_s390.deb
http://security.debian.org/pool/updates/main/b/bind9/liblwres50_9.6.ESV.R1+dfsg-0+lenny1_s390.deb
http://security.debian.org/pool/updates/main/b/bind9/bind9_9.6.ESV.R1+dfsg-0+lenny1_s390.deb
http://security.debian.org/pool/updates/main/b/bind9/dnsutils_9.6.ESV.R1+dfsg-0+lenny1_s390.deb
http://security.debian.org/pool/updates/main/b/bind9/libdns55_9.6.ESV.R1+dfsg-0+lenny1_s390.deb
http://security.debian.org/pool/updates/main/b/bind9/libisccfg50_9.6.ESV.R1+dfsg-0+lenny1_s390.deb
http://security.debian.org/pool/updates/main/b/bind9/libisccc50_9.6.ESV.R1+dfsg-0+lenny1_s390.deb
http://security.debian.org/pool/updates/main/b/bind9/lwresd_9.6.ESV.R1+dfsg-0+lenny1_s390.deb
http://security.debian.org/pool/updates/main/b/bind9/libisc52_9.6.ESV.R1+dfsg-0+lenny1_s390.deb
http://security.debian.org/pool/updates/main/b/bind9/libbind9-50_9.6.ESV.R1+dfsg-0+lenny1_s390.deb
http://security.debian.org/pool/updates/main/b/bind9/bind9-host_9.6.ESV.R1+dfsg-0+lenny1_s390.deb
Sun Sparc:
http://security.debian.org/pool/updates/main/b/bind9/libdns55_9.6.ESV.R1+dfsg-0+lenny1_sparc.deb
http://security.debian.org/pool/updates/main/b/bind9/libbind9-50_9.6.ESV.R1+dfsg-0+lenny1_sparc.deb
http://security.debian.org/pool/updates/main/b/bind9/bind9-host_9.6.ESV.R1+dfsg-0+lenny1_sparc.deb
http://security.debian.org/pool/updates/main/b/bind9/liblwres50_9.6.ESV.R1+dfsg-0+lenny1_sparc.deb
http://security.debian.org/pool/updates/main/b/bind9/bind9utils_9.6.ESV.R1+dfsg-0+lenny1_sparc.deb
http://security.debian.org/pool/updates/main/b/bind9/libisc52_9.6.ESV.R1+dfsg-0+lenny1_sparc.deb
http://security.debian.org/pool/updates/main/b/bind9/libbind-dev_9.6.ESV.R1+dfsg-0+lenny1_sparc.deb
http://security.debian.org/pool/updates/main/b/bind9/libisccfg50_9.6.ESV.R1+dfsg-0+lenny1_sparc.deb
http://security.debian.org/pool/updates/main/b/bind9/libisccc50_9.6.ESV.R1+dfsg-0+lenny1_sparc.deb
http://security.debian.org/pool/updates/main/b/bind9/lwresd_9.6.ESV.R1+dfsg-0+lenny1_sparc.deb
http://security.debian.org/pool/updates/main/b/bind9/dnsutils_9.6.ESV.R1+dfsg-0+lenny1_sparc.deb
http://security.debian.org/pool/updates/main/b/bind9/bind9_9.6.ESV.R1+dfsg-0+lenny1_sparc.deb

MD5-kontrollsummor för dessa filer finns i originalbulletinen.