Security Update: [CSSA-2002-SCO.16] UnixWare 7.1.1 : Multiple Vulnerabilities in BIND

[security () caldera com]

To: bugtraq () securityfocus com announce () lists caldera com scoannmod () xenitec on ca


______________________________________________________________________________

                Caldera International, Inc.  Security Advisory

Subject:                UnixWare 7.1.1 : Multiple Vulnerabilities in BIND
Advisory number:        CSSA-2002-SCO.16
Issue date:             2002 April 12
Cross reference:
______________________________________________________________________________


1. Problem Description

        This patch corrects several problems in earlier versions of
        BIND Version 8 which can result in security vulnerabilities of
        varying levels of severity.  These vulnerabilities are
        described in CERT Advisory CA-2001-02.  It is strongly
        recommended that users of BIND Version 8 upgrade to BIND
        Version 8.2.3-REL.


2. Vulnerable Supported Versions

        System                          Files
        ----------------------------------------------------------------------
        UnixWare 7.1.1                  /usr/lib/nslookup.help
                                        /usr/sbin/addr
                                        /usr/sbin/dig
                                        /usr/sbin/dnskeygen
                                        /usr/sbin/dnsquery
                                        /usr/sbin/host
                                        /usr/sbin/in.named
                                        /usr/sbin/irpd
                                        /usr/sbin/mkservdb
                                        /usr/sbin/named-bootconf
                                        /usr/sbin/named-xfer
                                        /usr/sbin/ndc
                                        /usr/sbin/nslookup
                                        /usr/sbin/nsupdate


3. Solution

        The proper solution is to install the latest packages.


4. UnixWare 7.1.1

        4.1 Location of Fixed Binaries

        ftp://stage.caldera.com/pub/security/unixware/CSSA-2002-SCO.16

        4.2 Verification

        MD5 (ptf7705a.pkg.Z) = a1aaccb7a523c241c9380c7ea97d3398

        md5 is available for download from
                ftp://stage.caldera.com/pub/security/tools/


        4.3 Installing Fixed Binaries

        Upgrade the affected binaries with the following commands:

        Download ptf7705a.pkg.Z to the /var/spool/pkg directory

        # uncompress /var/spool/pkg/ptf7705a.pkg.Z
        # pkgadd -d /var/spool/pkg/ptf7705a.pkg


5. References

        Specific references for this advisory:
                http://www.cert.org/advisories/CA-2001-02.html

        Caldera UNIX security resources:
                http://stage.caldera.com/support/security/

        Caldera OpenLinux security resources:
                http://www.caldera.com/support/security/index.html

        This security fix closes Caldera incidents sr379321, fz515683,
        erg711601.


6. Disclaimer

        Caldera International, Inc. is not responsible for the misuse
        of any of the information we provide on this website and/or
        through our security advisories. Our advisories are a service
        to our customers intended to promote secure installation and
        use of Caldera products.

______________________________________________________________________________

Attachment: _bin
Description: