freebsd security - Jul 2007 - Waiting for BIND security announcement

[freebsd-security@ CC'ed to avoid answering the same there again
shorly :) - if following up, please drop either freebsd-questions or
freebsd-securiy to avoid "spamming" both lists]

On 2007.07.24 18:15:43 -0500, Jeffrey Goldberg wrote:
> As I'm sure many people know there is a newly discovered BIND
vulnerability
> allowing cache injection (pharming).  See
> 
>   http://www.isc.org/index.pl?/sw/bind/bind-security.php
> 
> for details.
> 
> The version of bind on 6.2, 9.3.3, looks like it is vulnerable (along with 
> many other versions).  It's not particularly an issue for me since my
name
> servers aren't publicly queryable, but I am curios about how things
like
> security problems in
> src/contrib get handled in FreeBSD.
Yes, the FreeBSD Security Team and the FreeBSD BIND maintainer are
aware of the issue and are working on fixing it in FreeBSD as soon as
possible.

More details about the issue can be found at:
http://www.isc.org/sw/bind/bind-security.php .

Our general security handling policies can be found at:
http://security.FreeBSD.org/ .

-- 
Simon L. Nielsen
FreeBSD Deputy Security Officer
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 187 bytes
Desc: not available
Url :
http://lists.freebsd.org/pipermail/freebsd-security/attachments/20070725/69276a35/attachment.pgp

Simon L. Nielsen wrote:
> [freebsd-security@ CC'ed to avoid answering the same there again
> shorly :) - if following up, please drop either freebsd-questions or
> freebsd-securiy to avoid "spamming" both lists]
> 
> On 2007.07.24 18:15:43 -0500, Jeffrey Goldberg wrote:
> 
>> As I'm sure many people know there is a newly discovered BIND
vulnerability
>> allowing cache injection (pharming).  See
I think it's worth pointing out that cache injection and pharming are
not the same thing, although cache injection can be used as part of a
pharming attack.

I also think it's worth noting that this isn't an "all your queries
are belong to us" type of attack. The attack involves _predicting_
query id numbers which at _best_ will be successful only once in 16
tries. Then you have to actually time it right so that you can use
your guess.

Still, it is worth upgrading to avoid this issue.
>>   http://www.isc.org/index.pl?/sw/bind/bind-security.php
>>
>> for details.
>>
>> The version of bind on 6.2, 9.3.3,
RELENG_6 was updated shortly after the release of 9.3.4. I'll be
updating RELENG_[56] with the new 9.3.4-P1 version after I'm done
regression testing it, which should be some time tonight. Same for
updating HEAD with 9.4.1-P1.

The ports for bind9 and bind94 are already updated, so those with
urgent needs can use that route to upgrade immediately.


hope this helps,

Doug

-- 

    This .signature sanitized for your protection