ISC Information for VU#196945
ISC BIND 8 contains buffer overflow in transaction signature (TSIG) handling code
- Vendor Information Help Date Notified: 05 Jan 2001
- Statement Date:
- Date Updated: 04 Apr 2001
Name: "tsig bug"
Versions: 8.2, 8.2-P1, 8.2.1, 8.2.2, 8.2.2-P1, 8.2.2-P2, 8.2.2-P3,
8.2.2-P4, 8.2.2-P5, 8.2.2-P6, 8.2.2-P7 and all 8.2.3 betas.
Type: Access possible
It is possible to overflow a buffer handling TSIG signed
queries, thereby obtaining access to the system.
Exploits for this bug exist.
Upgrade to BIND 8.2.3-REL or preferably BIND 9.1.
Discovery and initial documentation of this vulnerability
was conducted by Anthony Osborne and John McDonald of the
COVERT Labs at PGP Security.
The vendor has not provided us with any further information regarding this vulnerability.
The ISC has posted this information on their web site at:
The source code for ISC BIND can be downloaded from: