|
|
|
View Notes By
|
|
|
|
Other Documents
|
|
|
|
|
ISC Information for VU#196945
| Date Notified: | 2001-01-05 |
| Date Updated: | |
| Statement Date: | |
| Status Summary: | Vulnerable |
Vendor StatementName: "tsig bug"
Versions: 8.2, 8.2-P1, 8.2.1, 8.2.2, 8.2.2-P1, 8.2.2-P2, 8.2.2-P3,
8.2.2-P4, 8.2.2-P5, 8.2.2-P6, 8.2.2-P7 and all 8.2.3 betas.
Severity: CRITICAL
Exploitable: Remotely
Type: Access possible
Description:
It is possible to overflow a buffer handling TSIG signed
queries, thereby obtaining access to the system.
Workarounds:
None.
Active Exploits:
Exploits for this bug exist.
Solution:
Upgrade to BIND 8.2.3-REL or preferably BIND 9.1.
Credits:
Discovery and initial documentation of this vulnerability
was conducted by Anthony Osborne and John McDonald of the
COVERT Labs at PGP Security.
Vendor InformationThe vendor has not provided us with any further information regarding this vulnerability.
AddendumThe ISC has posted this information on their web site at:
The source code for ISC BIND can be downloaded from:
If you have feedback, comments, or additional information about this vulnerability, please send us
email.
|
 |
