-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

===========================================================================
AA-2008.0157                  AUSCERT Advisory

                             [Netware][Linux]
             Novell Netware DNS Cache Poisoning Vulnerability
                               16 July 2008
- ---------------------------------------------------------------------------

        AusCERT Advisory Summary
        ------------------------

Product:              Novell Netware
                      Novell Linux
                      Open Enterprise Server 2
Operating System:     Netware
                      Linux variants
Impact:               Provide Misleading Information
Access:               Remote/Unauthenticated
CVE Names:            CVE-2008-1447
Member content until: Wednesday, August 13 2008

Ref:                  AL-2008.0080

OVERVIEW

        Novell Netware is susceptible to the DNS cache poisoning vulnerability
        as discussed in AL-2008.0080.


IMPACT

        Novell has identified that NetWare (all versions) are susceptible to 
        the DNS cache poisoning security flaw.

        The BIND packages in Novell's Linux products are affected by this 
        issue.

        Open Enterprise Server 2 includes novell-bind which provides an 
        eDirectory-integrated DNS server is also susceptible.


MITIGATION

        Novell has released packages which correct the vulnerability for 
        SLES10 SP2, SLES10 SP1, SLES9 as well as for openSUSE 11.0, 10.3 
        and 10.2. Patches for Netware and Open Enterprise Server 2 are 
        currently being developed.

        Current recommend workarounds include restricting access to those
        systems that require recursion enabled. Disable recursion on systems
        that do not require it to be enabled.


REFERENCES

        [1] Status of CVE-2008-1447 - Multiple DNS implementation vulnerable 
            to cache poisoning
            http://www.novell.com/support/viewContent.do?externalId=7000912&sliceId=1

AusCERT has made every effort to ensure that the information contained
in this document is accurate.  However, the decision to use the information
described is the responsibility of each user or organisation. The decision to
follow or act on information or advice contained in this security bulletin is
the responsibility of each user or organisation, and should be considered in
accordance with your organisation's site policies and procedures. AusCERT
takes no responsibility for consequences which may arise from following or
acting on information or advice contained in this security bulletin.

If you believe that your computer system has been compromised or attacked in 
any way, we encourage you to let us know by completing the secure National IT 
Incident Reporting Form at:

        http://www.auscert.org.au/render.html?it=3192

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================

-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQCVAwUBSH1M6yh9+71yA2DNAQJ6+gQAiau+ht40mzYGB027zKhK+NCJsiRAi59S
0QRuZKFZB7BOFdHrIyXwiKSbESThjzH8a99vMms5pLBGI2cgV5y3Obpkmzo9SWlh
VUEnXP33mHGrcqgVwsBR/zRfSKSjklON0fZWp3ggTm2ledjJ4/Wtcb/Pal5GXvRj
cY/XNyiujpw=
=ypM+
-----END PGP SIGNATURE-----