-----BEGIN PGP SIGNED MESSAGE-----

===========================================================================
              AUSCERT External Security Bulletin Redistribution
                             
                      ESB-2000.377 -- RHSA-2000:107-04
              Updated bind packages fixing DoS attack available
                              28 November 2000

===========================================================================

	AusCERT Security Bulletin Summary
	---------------------------------

Product:                bind
Vendor:                 Red Hat
Operating System:       Red Hat Linux
                        Linux
                        Unix
Impact:                 Denial of Service
Access Required:        Remote

Ref:                    ESB-2000.340
                        ESB-2000.343

- --------------------------BEGIN INCLUDED TEXT--------------------

- ---------------------------------------------------------------------
                   Red Hat, Inc. Security Advisory

Synopsis:          Updated bind packages fixing DoS attack available
Advisory ID:       RHSA-2000:107-04
Issue date:        2000-11-11
Updated on:        2000-11-27
Product:           Red Hat Linux
Keywords:          bind DoS denial of service attack exploit security
Cross references:  N/A
- ---------------------------------------------------------------------

1. Topic:

A remote DoS (denial of service) attack is possible with bind versions
prior to 8.2.2_P7.

2000-11-12: Added bind-devel, bind-utils packages to package list.
2000-11-27: Added packages for Red Hat Linux 7 for Alpha

2. Relevant releases/architectures:

Red Hat Linux 5.2 - i386, alpha, sparc
Red Hat Linux 6.0 - i386, alpha, sparc
Red Hat Linux 6.1 - i386, alpha, sparc
Red Hat Linux 6.2 - i386, alpha, sparc
Red Hat Linux 7.0 - i386, alpha

3. Problem description:

A bug in bind 8.2.2_P5 allows for a denial of service attack.

If named is open to zone transfers and recursive resolving, it will crash
after a ZXFR for the authoritative zone and a query of a remote hostname.

4. Solution:

For each RPM for your particular architecture, run:

rpm -Fvh [filename]

where filename is the name of the RPM.

Disabling zone transfers to non-trusted hosts by adding
allow-transfer { trusted-hosts; };
to /etc/named.conf prevents the exploit from working on older releases,
however, this does not fix the problem.

5. Bug IDs fixed (http://bugzilla.redhat.com/bugzilla for more info):

20546 - bind 8.2.2-P5 remote DoS


6. RPMs required:

Red Hat Linux 5.2:

alpha:
ftp://updates.redhat.com/5.2/alpha/bind-8.2.2_P7-0.5.2.alpha.rpm
ftp://updates.redhat.com/5.2/alpha/bind-devel-8.2.2_P7-0.5.2.alpha.rpm
ftp://updates.redhat.com/5.2/alpha/bind-utils-8.2.2_P7-0.5.2.alpha.rpm

sparc:
ftp://updates.redhat.com/5.2/sparc/bind-8.2.2_P7-0.5.2.sparc.rpm
ftp://updates.redhat.com/5.2/sparc/bind-devel-8.2.2_P7-0.5.2.sparc.rpm
ftp://updates.redhat.com/5.2/sparc/bind-utils-8.2.2_P7-0.5.2.sparc.rpm

i386:
ftp://updates.redhat.com/5.2/i386/bind-8.2.2_P7-0.5.2.i386.rpm
ftp://updates.redhat.com/5.2/i386/bind-devel-8.2.2_P7-0.5.2.i386.rpm
ftp://updates.redhat.com/5.2/i386/bind-utils-8.2.2_P7-0.5.2.i386.rpm

sources:
ftp://updates.redhat.com/5.2/SRPMS/bind-8.2.2_P7-0.5.2.src.rpm

Red Hat Linux 6.0:

sparc:
ftp://updates.redhat.com/6.0/sparc/bind-8.2.2_P7-0.6.2.sparc.rpm
ftp://updates.redhat.com/6.0/sparc/bind-devel-8.2.2_P7-0.6.2.sparc.rpm
ftp://updates.redhat.com/6.0/sparc/bind-utils-8.2.2_P7-0.6.2.sparc.rpm

i386:
ftp://updates.redhat.com/6.0/i386/bind-8.2.2_P7-0.6.2.i386.rpm
ftp://updates.redhat.com/6.0/i386/bind-devel-8.2.2_P7-0.6.2.i386.rpm
ftp://updates.redhat.com/6.0/i386/bind-utils-8.2.2_P7-0.6.2.i386.rpm

alpha:
ftp://updates.redhat.com/6.0/alpha/bind-8.2.2_P7-0.6.2.alpha.rpm
ftp://updates.redhat.com/6.0/alpha/bind-devel-8.2.2_P7-0.6.2.alpha.rpm
ftp://updates.redhat.com/6.0/alpha/bind-utils-8.2.2_P7-0.6.2.alpha.rpm

sources:
ftp://updates.redhat.com/6.0/SRPMS/bind-8.2.2_P7-0.6.2.src.rpm

Red Hat Linux 6.1:

alpha:
ftp://updates.redhat.com/6.1/alpha/bind-8.2.2_P7-0.6.2.alpha.rpm
ftp://updates.redhat.com/6.1/alpha/bind-devel-8.2.2_P7-0.6.2.alpha.rpm
ftp://updates.redhat.com/6.1/alpha/bind-utils-8.2.2_P7-0.6.2.alpha.rpm

sparc:
ftp://updates.redhat.com/6.1/sparc/bind-8.2.2_P7-0.6.2.sparc.rpm
ftp://updates.redhat.com/6.1/sparc/bind-devel-8.2.2_P7-0.6.2.sparc.rpm
ftp://updates.redhat.com/6.1/sparc/bind-utils-8.2.2_P7-0.6.2.sparc.rpm

i386:
ftp://updates.redhat.com/6.1/i386/bind-8.2.2_P7-0.6.2.i386.rpm
ftp://updates.redhat.com/6.1/i386/bind-devel-8.2.2_P7-0.6.2.i386.rpm
ftp://updates.redhat.com/6.1/i386/bind-utils-8.2.2_P7-0.6.2.i386.rpm

sources:
ftp://updates.redhat.com/6.1/SRPMS/bind-8.2.2_P7-0.6.2.src.rpm

Red Hat Linux 6.2:

alpha:
ftp://updates.redhat.com/6.2/alpha/bind-8.2.2_P7-0.6.2.alpha.rpm
ftp://updates.redhat.com/6.2/alpha/bind-devel-8.2.2_P7-0.6.2.alpha.rpm
ftp://updates.redhat.com/6.2/alpha/bind-utils-8.2.2_P7-0.6.2.alpha.rpm

sparc:
ftp://updates.redhat.com/6.2/sparc/bind-8.2.2_P7-0.6.2.sparc.rpm
ftp://updates.redhat.com/6.2/sparc/bind-devel-8.2.2_P7-0.6.2.sparc.rpm
ftp://updates.redhat.com/6.2/sparc/bind-utils-8.2.2_P7-0.6.2.sparc.rpm

i386:
ftp://updates.redhat.com/6.2/i386/bind-8.2.2_P7-0.6.2.i386.rpm
ftp://updates.redhat.com/6.2/i386/bind-devel-8.2.2_P7-0.6.2.i386.rpm
ftp://updates.redhat.com/6.2/i386/bind-utils-8.2.2_P7-0.6.2.i386.rpm

sources:
ftp://updates.redhat.com/6.2/SRPMS/bind-8.2.2_P7-0.6.2.src.rpm

Red Hat Linux 7.0:

alpha:
ftp://updates.redhat.com/7.0/alpha/bind-8.2.2_P7-2.alpha.rpm
ftp://updates.redhat.com/7.0/alpha/bind-devel-8.2.2_P7-2.alpha.rpm
ftp://updates.redhat.com/7.0/alpha/bind-utils-8.2.2_P7-2.alpha.rpm

i386:
ftp://updates.redhat.com/7.0/i386/bind-8.2.2_P7-1.i386.rpm
ftp://updates.redhat.com/7.0/i386/bind-devel-8.2.2_P7-1.i386.rpm
ftp://updates.redhat.com/7.0/i386/bind-utils-8.2.2_P7-1.i386.rpm

sources:
ftp://updates.redhat.com/7.0/SRPMS/bind-8.2.2_P7-1.src.rpm
ftp://updates.redhat.com/7.0/SRPMS/bind-8.2.2_P7-2.src.rpm

7. Verification:

MD5 sum                           Package Name
- --------------------------------------------------------------------------
a8384e027a701ac18c222e8cf692d1bb  5.2/SRPMS/bind-8.2.2_P7-0.5.2.src.rpm
1a9d82ed254a4316000b0951870b7a1a  5.2/alpha/bind-8.2.2_P7-0.5.2.alpha.rpm
7fd21b8d27d13dd83297abd1b607030f  5.2/alpha/bind-devel-8.2.2_P7-0.5.2.alpha.rpm
fc75f73bc341839b01b9191c2735babd  5.2/alpha/bind-utils-8.2.2_P7-0.5.2.alpha.rpm
6fdd9dc50a075d82b457f6a1079cdef6  5.2/i386/bind-8.2.2_P7-0.5.2.i386.rpm
1084f39bc01bf97588c19a1f61fa8685  5.2/i386/bind-devel-8.2.2_P7-0.5.2.i386.rpm
016fbd1f68b9fdfcab4ada341c4f4623  5.2/i386/bind-utils-8.2.2_P7-0.5.2.i386.rpm
92801fa17e15665fab7ea18b9623ecd7  5.2/sparc/bind-8.2.2_P7-0.5.2.sparc.rpm
792eb5a0fc0ca87eac53dbfc103974e5  5.2/sparc/bind-devel-8.2.2_P7-0.5.2.sparc.rpm
bff05c21bca820793f5bab316b8415c6  5.2/sparc/bind-utils-8.2.2_P7-0.5.2.sparc.rpm
c663e471d722b6d59d147233c96466f9  6.0/SRPMS/bind-8.2.2_P7-0.6.2.src.rpm
95c9a4aa98c5278195df5853ea0f8371  6.0/alpha/bind-8.2.2_P7-0.6.2.alpha.rpm
59cdef039c4f88b565dcf4270be63403  6.0/alpha/bind-devel-8.2.2_P7-0.6.2.alpha.rpm
b4615fd210c1c6dd11679d53e8b5a8a8  6.0/alpha/bind-utils-8.2.2_P7-0.6.2.alpha.rpm
a6dc64455c83374894d1ac149d27f9ba  6.0/i386/bind-8.2.2_P7-0.6.2.i386.rpm
a0a66cba7a41dc0749bef145b8c76ffd  6.0/i386/bind-devel-8.2.2_P7-0.6.2.i386.rpm
fae686fc3216eb767895a93601d69853  6.0/i386/bind-utils-8.2.2_P7-0.6.2.i386.rpm
29baa5949e4f67089e434148a4d1bf8c  6.0/sparc/bind-8.2.2_P7-0.6.2.sparc.rpm
6f24075c04e8f00f8f802df8767cc0b8  6.0/sparc/bind-devel-8.2.2_P7-0.6.2.sparc.rpm
05590e20ba01a0f465a9df8234a7aace  6.0/sparc/bind-utils-8.2.2_P7-0.6.2.sparc.rpm
c663e471d722b6d59d147233c96466f9  6.1/SRPMS/bind-8.2.2_P7-0.6.2.src.rpm
95c9a4aa98c5278195df5853ea0f8371  6.1/alpha/bind-8.2.2_P7-0.6.2.alpha.rpm
59cdef039c4f88b565dcf4270be63403  6.1/alpha/bind-devel-8.2.2_P7-0.6.2.alpha.rpm
b4615fd210c1c6dd11679d53e8b5a8a8  6.1/alpha/bind-utils-8.2.2_P7-0.6.2.alpha.rpm
a6dc64455c83374894d1ac149d27f9ba  6.1/i386/bind-8.2.2_P7-0.6.2.i386.rpm
a0a66cba7a41dc0749bef145b8c76ffd  6.1/i386/bind-devel-8.2.2_P7-0.6.2.i386.rpm
fae686fc3216eb767895a93601d69853  6.1/i386/bind-utils-8.2.2_P7-0.6.2.i386.rpm
29baa5949e4f67089e434148a4d1bf8c  6.1/sparc/bind-8.2.2_P7-0.6.2.sparc.rpm
6f24075c04e8f00f8f802df8767cc0b8  6.1/sparc/bind-devel-8.2.2_P7-0.6.2.sparc.rpm
05590e20ba01a0f465a9df8234a7aace  6.1/sparc/bind-utils-8.2.2_P7-0.6.2.sparc.rpm
c663e471d722b6d59d147233c96466f9  6.2/SRPMS/bind-8.2.2_P7-0.6.2.src.rpm
95c9a4aa98c5278195df5853ea0f8371  6.2/alpha/bind-8.2.2_P7-0.6.2.alpha.rpm
59cdef039c4f88b565dcf4270be63403  6.2/alpha/bind-devel-8.2.2_P7-0.6.2.alpha.rpm
b4615fd210c1c6dd11679d53e8b5a8a8  6.2/alpha/bind-utils-8.2.2_P7-0.6.2.alpha.rpm
a6dc64455c83374894d1ac149d27f9ba  6.2/i386/bind-8.2.2_P7-0.6.2.i386.rpm
a0a66cba7a41dc0749bef145b8c76ffd  6.2/i386/bind-devel-8.2.2_P7-0.6.2.i386.rpm
fae686fc3216eb767895a93601d69853  6.2/i386/bind-utils-8.2.2_P7-0.6.2.i386.rpm
29baa5949e4f67089e434148a4d1bf8c  6.2/sparc/bind-8.2.2_P7-0.6.2.sparc.rpm
6f24075c04e8f00f8f802df8767cc0b8  6.2/sparc/bind-devel-8.2.2_P7-0.6.2.sparc.rpm
05590e20ba01a0f465a9df8234a7aace  6.2/sparc/bind-utils-8.2.2_P7-0.6.2.sparc.rpm
9db3ab376d44984cf200a486c15fb267  7.0/SRPMS/bind-8.2.2_P7-1.src.rpm
89a2dd1030505115619d8c4a40e7add5  7.0/SRPMS/bind-8.2.2_P7-2.src.rpm
db718ef4f38c5fd572ca5c0e3dc9d079  7.0/alpha/bind-8.2.2_P7-2.alpha.rpm
da5747f5b31e563ec0d2a26a15fcf20d  7.0/alpha/bind-devel-8.2.2_P7-2.alpha.rpm
b41501bb5a54db1876c045b9157bb7fd  7.0/alpha/bind-utils-8.2.2_P7-2.alpha.rpm
3ca7a0db5c91992478737bf7564ad148  7.0/i386/bind-8.2.2_P7-1.i386.rpm
2846b6dcd911cc6e3cc0c4ba3c3c3af2  7.0/i386/bind-devel-8.2.2_P7-1.i386.rpm
74e8f7ff624f8df88592265cbfba124b  7.0/i386/bind-utils-8.2.2_P7-1.i386.rpm

These packages are GPG signed by Red Hat, Inc. for security.  Our key
is available at:
    http://www.redhat.com/corp/contact.html

You can verify each package with the following command:
    rpm --checksig  <filename>

If you only wish to verify that each package has not been corrupted or
tampered with, examine only the md5sum with the following command:
    rpm --checksig --nogpg <filename>

8. References:

http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=20546


Copyright(c) 2000 Red Hat, Inc.

- --------------------------END INCLUDED TEXT--------------------

This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content.  The decision to use any or all of this information is
the responsibility of each user or organisation, and should be done so in
accordance with site policies and procedures.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the original authors to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

	http://www.auscert.org.au/Information/advisories.html

If you believe that your system has been compromised, contact AusCERT or
your representative in FIRST (Forum of Incident Response and Security
Teams).

Internet Email: auscert@auscert.org.au
Facsimile:	(07) 3365 7031
Telephone:	(07) 3365 4417 (International: +61 7 3365 4417)
		AusCERT personnel answer during Queensland business hours
		which are GMT+10:00 (AEST).
		On call after hours for emergencies.


-----BEGIN PGP SIGNATURE-----
Version: 2.6.3i
Charset: noconv
Comment: ftp://ftp.auscert.org.au/pub/auscert/AUSCERT_PGP.key

iQCVAwUBOlSNYCh9+71yA2DNAQG56wP+N8yX/IvNvYWeL6MHh1bHmJTJoG8xQVte
UjK5NHJZTSyYJTZMKzq0vBQltOGb+bvmIRYoH7Q3F6qPa90C3WP611YxPWDSD1lV
KhZdjhSDr/baVzPI3OuWBWgOrEe2w3KzeKOZfN7El8NTp2YtIAG7xPlMOKz/KgRG
yYvUot0mqZM=
=hj+o
-----END PGP SIGNATURE-----