Date: 04 January 2012
References: ESB-2009.0017 ESB-2010.0053.2 ASB-2011.0102
Click here for printable version
Click here for PGP verifiable version
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2012.0021
Multiple vulnerabilities in AIX BIND
4 January 2012
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: BIND
Publisher: IBM
Operating System: AIX
Impact/Access: Denial of Service -- Remote/Unauthenticated
Resolution: Patch/Upgrade
CVE Names: CVE-2011-4313 CVE-2010-0382 CVE-2010-0097
CVE-2009-0025
Reference: ASB-2011.0102
ESB-2010.0053.2
ESB-2009.0017
Original Bulletin:
http://aix.software.ibm.com/aix/efixes/security/bind9_advisory3.asc
- --------------------------BEGIN INCLUDED TEXT--------------------
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
IBM SECURITY ADVISORY
First Issued: Wed Dec 28 16:20:43 CST 2011
The most recent version of this document is available here:
http://aix.software.ibm.com/aix/efixes/security/bind9_advisory3.asc
VULNERABILITY SUMMARY
VULNERABILITY: Multiple vulnerabilities in AIX BIND
PLATFORMS: AIX 5.3, 6.1, and 7.1 releases
SOLUTION: Apply the fix or workaround as described below.
THREAT: A remote attacker can cause a denial of service
CVE Numbers: CVE-2011-4313
CVE-2010-0382
CVE-2010-0097
CVE-2009-0025
Reboot required? NO
Workarounds? NO
DETAILED INFORMATION
I. DESCRIPTION
An as-yet unidentified network event caused BIND 9 resolvers to
cache an invalid record, subsequent queries for which could crash
the resolvers with an assertion failure.
Please see the following for more information:
http://www.isc.org/software/bind/advisories/cve-2011-4313
Furthermore, AIX BIND 9.4.1 is affected by the following three
security vulnerabilities:
CVE-2010-0382 - ISC BIND Out-Of-Bailwick Data Handling Error
CVE-2010-0097 - ISC BIND Improper DNSSEC NSEC and NSEC3 Record
CVE-2009-0025 - BIND OpenSSL DSA_do_verify and EVP_VerifyFinal
II. PLATFORM VULNERABILITY ASSESSMENT
Note: To use the following commands on VIOS you must first
execute:
oem_setup_env
To determine if your system is vulnerable, execute the following
command:
lslpp -L bos.net.tcp.client bos.net.tcp.server
The following fileset levels are vulnerable:
AIX Fileset Lower Level Upper Level
------------------------------------------------
bos.net.tcp.client 5.3.12.0 5.3.12.5
bos.net.tcp.server 5.3.12.0 5.3.12.3
bos.net.tcp.client 6.1.5.0 6.1.5.7
bos.net.tcp.server 6.1.5.0 6.1.5.6
bos.net.tcp.client 6.1.6.0 6.1.6.16
bos.net.tcp.server 6.1.6.0 6.1.6.16
bos.net.tcp.client 6.1.7.0 6.1.7.1
bos.net.tcp.server 6.1.7.0 6.1.7.0
bos.net.tcp.client 7.1.0.0 7.1.0.17
bos.net.tcp.server 7.1.0.0 7.1.0.16
bos.net.tcp.client 7.1.1.0 7.1.1.1
bos.net.tcp.server 7.1.1.0 7.1.1.0
III. SOLUTION
A. FIXES
Fixes are now available. The fixes can be downloaded from:
http://aix.software.ibm.com/aix/efixes/security/bind9_ifix3.tar
The links above are to a tar file containing this signed
advisory, fix packages, and PGP signatures for each package.
AIX Level Fix
------------------------------------------------------
5.3.12.5 IV09491m05.111226.epkg.Z
6.1.5.7 IV11742m07.111206.epkg.Z
6.1.6.16 IV11743m06.111216.epkg.Z
6.1.7.1 IV09978m01.111207.epkg.Z
7.1.0.17 IV11744m04.111207.epkg.Z
7.1.1.1 IV10049m01.111208.epkg.Z
NOTE: For 6.1 TL07 and 7.1 TL01, following ifixes may be required
to install prior to installing BIND ifix due to emgr script issue:
ftp://aix.software.ibm.com/aix/efixes/iv12335/IV12335s01.epkg.Z
ftp://aix.software.ibm.com/aix/efixes/iv12342/IV12342s01.epkg.Z
To extract the fixes from the tar file:
tar xvf bind9_ifix3.tar
cd bind9_ifix3
Verify you have retrieved the fixes intact:
The checksums below were generated using the "csum -h SHA1"
(sha1sum) commands and are as follows:
csum -h SHA1 (sha1sum) filename
------------------------------------------------------------------
25b3efc2050a355389e54ecfa1c75112f2f3a9c1 IV09491m05.111226.epkg.Z
915fefd318654e37cb30462c64e2d03badf20b2f IV09978m01.111207.epkg.Z
03401f6d52899602959f3f21b04b83bf1f9590e4 IV10049m01.111208.epkg.Z
28e81ddcf600dedcfd28b046b8e6799045513f0e IV11742m07.111206.epkg.Z
666c4c66bda95c3fb030928afea897cff0f51b43 IV11743m06.111216.epkg.Z
7327c22ff990879d62977634c2ae2babf713bff1 IV11744m04.111207.epkg.Z
To verify the sums, use the text of this advisory as input to
csum or sha1sum. For example:
csum -h SHA1 -i bind9_advisory3.asc
sha1sum -c bind9_advisory3.asc
These sums should match exactly. The PGP signatures in the tar
file and on this advisory can also be used to verify the
integrity of the fixes. If the sums or signatures cannot be
confirmed, contact IBM AIX Security and describe the
discrepancy at the following addresses:
security-alert@austin.ibm.com
B. FIX INSTALLATION
IMPORTANT: If possible, it is recommended that a mksysb backup
of the system be created. Verify it is both bootable and
readable before proceeding.
Fix management documentation can be found at:
http://www14.software.ibm.com/webapp/set2/sas/f/aix.efixmgmt/home.html
To preview fix installation:
emgr -e fix_name -p # where fix_name is the name of the
# fix being previewed.
To install fix package:
emgr -e fix_name -X # where fix_name is the name of the
# fix being installed.
C. APARS
IBM has assigned the following APARs to this problem:
AIX Level APAR number Service pack date
--------------------------------------------------------
5.3.12 IV09491 tbd
6.1.5 IV11742 tbd
6.1.6 IV11743 tbd
6.1.7 IV09978 02/17/12 sp3
7.1.0 IV11744 tbd
7.1.1 IV10049 tbd
Subscribe to the APARs here:
http://www.ibm.com/support/docview.wss?uid=isg1IV09491
http://www.ibm.com/support/docview.wss?uid=isg1IV11742
http://www.ibm.com/support/docview.wss?uid=isg1IV11743
http://www.ibm.com/support/docview.wss?uid=isg1IV09978
http://www.ibm.com/support/docview.wss?uid=isg1IV11744
http://www.ibm.com/support/docview.wss?uid=isg1IV10049
By subscribing, you will receive periodic email alerting you
to the status of the APAR, and a link to download the service
pack when it becomes available.
IV. WORKAROUND
There are no workarounds available other than disabling the named service.
V. CONTACT INFORMATION
If you would like to receive AIX Security Advisories via email,
please visit:
http://www.ibm.com/systems/support
and click on the "My notifications" link.
To view previously issued advisories, please visit:
http://www14.software.ibm.com/webapp/set2/subscriptions/pqvcmjd
Comments regarding the content of this announcement can be
directed to:
security-alert@austin.ibm.com
To obtain the PGP public key that can be used to communicate
securely with the AIX Security Team you can either:
A. Send an email with "get key" in the subject line to:
security-alert@austin.ibm.com
B. Download the key from our web page:
http://www.ibm.com/systems/resources/systems_p_os_aix_security_pgpkey.txt
C. Download the key from a PGP Public Key Server. The key ID is:
0x28BFAA12
Please contact your local IBM AIX support center for any
assistance.
eServer is a trademark of International Business Machines
Corporation. IBM, AIX and pSeries are registered trademarks of
International Business Machines Corporation. All other trademarks
are property of their respective holders.
VI. REFERENCES:
Complete CVSS Guide: http://www.first.org/cvss/cvss-guide.html
On-line Calculator V2: http://nvd.nist.gov/cvss.cfm?calculator&adv&version=2
X-Force Vulnerability Database: n/a
CVE-2011-4313: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4313
CVE-2010-0382: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0382
CVE-2010-0097: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0097
CVE-2009-0025: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0025
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.7 (AIX)
iD8DBQFO+2Cy4fmd+Ci/qhIRAmSFAJwJ4knHG1upERg2Ia1Ku74DvZlBGgCbBmPo
RW3JZFPi5uQ/5UOiUi4sT2E=
=BtcF
- -----END PGP SIGNATURE-----
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
http://www.auscert.org.au/render.html?cid=1980
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBTwPPiO4yVqjM2NGpAQLj0w/+PeWVfAE1zl5y0PMMtyJ7yxkfQdA/Vf7n
zR66b69Pthys8dFg0RM7+rMkvg6N/xL0ujVVu7DfwqUhpoQjLHDBk6xK2TceCBb/
oRm5z5sp0y8lGpSLKxikM84cuXDKg7KWX1l86b54UVIjWaJseNJYQ29V14RFL76L
gfWBeg0Wh2Xl9OGMlqz4vul5y0bbVpUN+9kZA0fvcnzmqR1fWSdyIv1k5QO0Uyt4
UcVnOBm0UssloeR7TKgW+8o4ORcKQGPSHrfcgbEk8ER5pXGe+5WttOL8iuN0u7VO
H8e5HQbnE9pHFrXH/mAKCggnPXkTC+ZuUG7kDo5WPDxSDM9Tx1Lpra1rNvuOFJ8U
bF8k9MadljKPXWkNbR6iSzq2YN1wF66gj6l6pjSoRliKpxRc8tJ3PZ7pLQjpYqCN
tO3KfTbHyOeteQS4wvtq8rU6AQi2EuqwpT/DNcy3zf/cJ2x6AFcr98HLL66H32mT
C0JYLAGr5GSsLWZeo8g+Wq/ZdvpxXK+8apV3GTAklpCdiQGHram35tGisRO1E/Vm
WWcwnp2Wi4lNQvLY7JTKffv68aFEFNRuXLVaF+pPwyqqoXP2o3RqaTXADxEe7hoh
EQDtfC63ikpS2Jz+lwZfYsAgGju3dseGnwIXTjB7eSU2saARh1wGO35L9omcYjfx
Ubggfxg85+o=
=kQeg
-----END PGP SIGNATURE-----
|