| Summary: | bind new security issue CVE-2014-0591 | ||
|---|---|---|---|
| Product: | Mageia | Reporter: | David Walser <luigiwalser> |
| Component: | Security | Assignee: | QA Team <qa-bugs> |
| Status: | RESOLVED FIXED | QA Contact: | Sec team <security> |
| Severity: | critical | ||
| Priority: | Normal | CC: | ennael1, sysadmin-bugs, tmb |
| Version: | 3 | Keywords: | validated_update |
| Target Milestone: | --- | ||
| Hardware: | i586 | ||
| OS: | Linux | ||
| URL: | http://lwn.net/Vulnerabilities/580403/ | ||
| Whiteboard: | advisory mga3-32-ok, mga3-32-ok | ||
| Source RPM: | bind-9.9.3.P2-1.mga3.src.rpm | CVE: | |
| Status comment: | |||
|
Description
David Walser
2014-01-13 22:26:43 CET
Ubuntu has issued an advisory for this on January 13: http://www.ubuntu.com/usn/usn-2081-1/ URL:
(none) =>
http://lwn.net/Vulnerabilities/580403/ Tested it here both on i586 and x86_64 Update of the package went smoothly. named was restarted properly. I used the default server in resolv.conf and tested host look up. No problem there, no regresseion Whiteboard:
(none) =>
mga3-32-ok, mga3-32-ok Update validated. Thanks. Advisory: Updated bind packages fix security vulnerability: Because of a defect in handling queries for NSEC3-signed zones, BIND can crash with an "INSIST" failure in name.c when processing queries possessing certain properties. By exploiting this defect an attacker deliberately constructing a query with the right properties could achieve denial of service against an authoritative nameserver serving NSEC3-signed zones (CVE-2014-0591). References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0591 https://kb.isc.org/article/AA-01078 https://kb.isc.org/article/AA-01080 SRPM: bind-9.9.4.P2-1.mga3.src.rpm Could sysadmin please push from core/updates_testing to core/updates. Thank you! Keywords:
(none) =>
validated_update Update pushed: http://advisories.mageia.org/MGASA-2014-0013.html Status:
NEW =>
RESOLVED |