USN-3346-3: Bind vulnerabilities

USN-3346-3: Bind vulnerabilities

Ubuntu Security Notice USN-3346-3

8th November, 2017

bind9 vulnerabilities

A security issue affects these releases of Ubuntu and its
derivatives:

  • Ubuntu 12.04 LTS

Summary

Bind could be made to serve incorrect information or expose sensitive
information over the network.

Software description

  • bind9
    – Internet Domain Name Server

Details

USN-3346-1 and USN-3346-2 fixed two vulnerabilities in Bind and a regression,
respectively. This update provides the corresponding update for Ubuntu 12.04 ESM.

Original advisory details:

Clément Berthaux discovered that Bind did not correctly check TSIG
authentication for zone update requests. An attacker could use this
to improperly perform zone updates. (CVE-2017-3143)

Clément Berthaux discovered that Bind did not correctly check TSIG
authentication for zone transfer requests. An attacker could use this
to improperly transfer entire zones. (CVE-2017-3142)

In addition, this update adds the new root zone key signing key (KSK).

Update instructions

The problem can be corrected by updating your system to the following
package version:

Ubuntu 12.04 LTS:
bind9

1:9.8.1.dfsg.P1-4ubuntu0.23

To update your system, please follow these instructions:
https://wiki.ubuntu.com/Security/Upgrades.

After a standard system update you need to restart Bind to make
all the necessary changes.

References

CVE-2017-3142,

CVE-2017-3143

Source: USN-3346-3: Bind vulnerabilities

About KENNETH 14237 Articles
지락문화예술공작단

Be the first to comment

Leave a Reply

Your email address will not be published.


*


이 사이트는 스팸을 줄이는 아키스밋을 사용합니다. 댓글이 어떻게 처리되는지 알아보십시오.