CSSA-2002-SCO.16- Multiple Vulnerabilities in BIND
by Nikola Strahija on April 15th, 2002 This patch corrects several problems in earlier versions of BIND Version 8 which can result in security vulnerabilities of varying levels of severity. These vulnerabilities are described in CERT Advisory CA-2001-02. It is strongly recommended that users of BIND Version 8 upgrade to BIND Version 8.2.3-REL.
2. Vulnerable Supported Versions
System Files
----------------------------------------------------------------------
UnixWare 7.1.1 /usr/lib/nslookup.help
/usr/sbin/addr
/usr/sbin/dig
/usr/sbin/dnskeygen
/usr/sbin/dnsquery
/usr/sbin/host
/usr/sbin/in.named
/usr/sbin/irpd
/usr/sbin/mkservdb
/usr/sbin/named-bootconf
/usr/sbin/named-xfer
/usr/sbin/ndc
/usr/sbin/nslookup
/usr/sbin/nsupdate
3. Solution
The proper solution is to install the latest packages.
4. UnixWare 7.1.1
4.1 Location of Fixed Binaries
ftp://stage.caldera.com/pub/security/unixware/CSSA-2002-SCO.16
4.2 Verification
MD5 (ptf7705a.pkg.Z) = a1aaccb7a523c241c9380c7ea97d3398
md5 is available for download from
ftp://stage.caldera.com/pub/security/tools/
4.3 Installing Fixed Binaries
Upgrade the affected binaries with the following commands:
Download ptf7705a.pkg.Z to the /var/spool/pkg directory
# uncompress /var/spool/pkg/ptf7705a.pkg.Z
# pkgadd -d /var/spool/pkg/ptf7705a.pkg
5. References
Specific references for this advisory:
http://www.cert.org/advisories/CA-2001-02.html
Caldera UNIX security resources:
http://stage.caldera.com/support/security/
Caldera OpenLinux security resources:
http://www.caldera.com/support/security/index.html
This security fix closes Caldera incidents sr379321, fz515683,
erg711601.
6. Disclaimer
Caldera International, Inc. is not responsible for the misuse
of any of the information we provide on this website and/or
through our security advisories. Our advisories are a service
to our customers intended to promote secure installation and
use of Caldera products.
______________________________________________________________________________
