Ubuntu has issued an advisory on June 5: http://www.ubuntu.com/usn/usn-1462-1/ Based on the info available from the CVEs, 2012-1667 was fixed recently in Cauldron as it was updated to 9.9.1-P1. Mageia 1 and Mageia 2 are affected. Debian has also issued an advisory for that CVE alone on June 5: http://www.debian.org/security/2012/dsa-2486 As for 2012-1033, it is clear that Mageia 1 is affected. It is not clear which other versions may be affected.
CC: (none) => guillomovitch
According to this Mageia 2 is not vulnerable to 2012-1033: http://www.isc.org/software/bind/advisories/cve-2012-1033 More information about 2012-1667 is here: http://www.isc.org/software/bind/advisories/cve-2012-1667
Mandriva has issued an advisory for this today (June 10): http://www.mandriva.com/en/support/security/advisories/?dis=2010.1&name=MDVSA-2012:089
According to my understanding: mageia 2: bind 9.9.0 is vulnerable to CVE-2012-1667 mageia 1: bind 9.8.1P1 is vulnerable to CVE-2012-1667 and 2012-1033 Unfortunatly, I couldn't find any patches allowing to fix the issue, without upgrading to newer versions (9.9.1P1 and 9.8.3P1, respectively).
Mandriva's update just updated each to the newest release from the stable branch each was on, so I was already thinking we should do the same.
I just submitted bind-9.9.1.P1-1.mga2 and bind-9.8.3.P1-1.mga1 in updates_testing. Suggested advisory for mageia 1: Dan Luther discovered that Bind incorrectly handled zero length rdata fields. A remote attacker could use this flaw to cause Bind to crash or behave erratically, resulting in a denial of service. (CVE-2012-1667) It was discovered that Bind incorrectly handled revoked domain names. A remote attacker could use this flaw to cause malicious domain names to be continuously resolvable even after they have been revoked. (CVE-2012-1033) The updated package have been upgraded to bind 9.8.3-P1, which fixes both issues. Suggested advisory for mageia 2: Dan Luther discovered that Bind incorrectly handled zero length rdata fields. A remote attacker could use this flaw to cause Bind to crash or behave erratically, resulting in a denial of service. (CVE-2012-1667) The updated package have been upgraded to bind 9.9.1-P1, which fixes the issue.
Assignee: bugsquad => qa-bugs
Thanks Guillaume. References for the advisory: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1033 http://www.isc.org/software/bind/advisories/cve-2012-1033 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1667 http://www.isc.org/software/bind/advisories/cve-2012-1667 ftp://ftp.isc.org/isc/bind9/9.8.3-P1/RELEASE-NOTES-BIND-9.8.3-P1.txt ftp://ftp.isc.org/isc/bind9/9.9.1-P1/RELEASE-NOTES-BIND-9.9.1-P1.txt http://www.ubuntu.com/usn/usn-1462-1/
Testing complete on Mageia 1 i586 for the srpm bind-9.8.3P1-1.mga1.src.rpm Just testing that the name server is working, using the commands host, dig and nslookup. I'll test Mageia 2 i586 shortly.
CC: (none) => davidwhodgins
Testing complete on Mageia 2 i586 for the srpm bind-9.9.1.P1-1.mga2.src.rpm Note to other qa testers. Don't forget to add a line to the start of /etc/resolv.conf with nameserver 127.0.0.1
Whiteboard: (none) => mga1-32-OK, mga2-32-OK
Testing complete x86_64 Mageia 2 I notice this also migrates the named service to systemd.. Migrating sysvinit service 'named' to systemd native unit 'named.service' via systemd install rules. Service starts, stops and restarts ok.
Hardware: i586 => AllVersion: 1 => 2Whiteboard: mga1-32-OK, mga2-32-OK => MGA1TOO, mga1-32-OK, mga2-32-OK, mga2-64-OK
Testing complete x86_64 Mageia 1 Validating SRPMs: bind-9.8.3P1-1.mga1.src.rpm bind-9.9.1.P1-1.mga2.src.rpm Could sysadmin please push from core/updates_testing to core/updates. Thanks! Mga1 Advisory. --------------------- Dan Luther discovered that Bind incorrectly handled zero length rdata fields. A remote attacker could use this flaw to cause Bind to crash or behave erratically, resulting in a denial of service. (CVE-2012-1667) It was discovered that Bind incorrectly handled revoked domain names. A remote attacker could use this flaw to cause malicious domain names to be continuously resolvable even after they have been revoked. (CVE-2012-1033) The updated package have been upgraded to bind 9.8.3-P1, which fixes both issues. http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1033 http://www.isc.org/software/bind/advisories/cve-2012-1033 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1667 http://www.isc.org/software/bind/advisories/cve-2012-1667 ftp://ftp.isc.org/isc/bind9/9.8.3-P1/RELEASE-NOTES-BIND-9.8.3-P1.txt ----------------------- Mga2 Advisory ----------------------- Dan Luther discovered that Bind incorrectly handled zero length rdata fields. A remote attacker could use this flaw to cause Bind to crash or behave erratically, resulting in a denial of service. (CVE-2012-1667) The updated package have been upgraded to bind 9.9.1-P1, which fixes the issue. http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1667 http://www.isc.org/software/bind/advisories/cve-2012-1667 ftp://ftp.isc.org/isc/bind9/9.9.1-P1/RELEASE-NOTES-BIND-9.9.1-P1.txt -----------------------
Keywords: (none) => validated_updateCC: (none) => sysadmin-bugsWhiteboard: MGA1TOO, mga1-32-OK, mga2-32-OK, mga2-64-OK => MGA1TOO, mga1-32-OK, mga2-32-OK, mga2-64-OK, mga1-64-OK
None of those updates should change anything to sysinit/systemd handling. If some change slipped in, then we are in troubles...
Un-validating until you have checked then Guillaume.
Keywords: validated_update => (none)
No, nothing slipped in. No changes were made to the services configuration. The package ships with both a SysV init script and systemd service file. That output message came from the "%_post_service named" scriplet. It probably prints the same thing when upgrading from mga1, or at least it should. It probably shouldn't print that message for subsequent package upgrades, but if it does, it would be a minor issue, and the issue would be in the rpm-helper package, not this one. This one should be OK for release.
Thanks for checking David, Validating again Sysadmin: Please see comment 10
Keywords: (none) => validated_update
Update pushed: https://wiki.mageia.org/en/Support/Advisories/MGASA-2012-0119
Status: NEW => RESOLVEDCC: (none) => tmbResolution: (none) => FIXED