oss-sec mailing list archives
Re: ISC announces two BIND vulnerabilities
From: Yves-Alexis Perez <corsac () debian org>
Date: Fri, 30 Jun 2017 12:41:33 +0200
On Fri, 2017-06-30 at 01:09 -0800, ISC Security Officer wrote:
On Thursday (29 June) Internet Systems Consortium disclosed two security vulnerabilities in BIND. Details on the individual vulnerabilities can be found in our knowledge base: CVE-2017-3142: https://kb.isc.org/article/AA-01504/74/CVE-2017-3142 CVE-2017-3143: https://kb.isc.org/article/AA-01503/74/CVE-2017-3143 New software releases have been issued containing these security fixes; they are available from our download page at http://www.isc.org/downloads
As per list policy, and since I'm following these for Debian, here's some more details inline for the list. The vulnerabilities are very similar to the knot one (no CVE yet) found by the same researchers (Synaktiv): CVE-2017-3142: An error in TSIG authentication can permit unauthorized zone transfers An attacker who is able to send and receive messages to an authoritative DNS server and who has knowledge of a valid TSIG key name may be able to circumvent TSIG authentication of AXFR requests via a carefully constructed request packet. A server that relies solely on TSIG keys for protection with no other ACL protection could be manipulated into: * providing an AXFR of a zone to an unauthorized recipient * accepting bogus NOTIFY packets CVE-2017-3043: An error in TSIG authentication can permit unauthorized dynamic updates An attacker who is able to send and receive messages to an authoritative DNS server and who has knowledge of a valid TSIG key name for the zone and service being targeted may be able to manipulate BIND into accepting an unauthorized dynamic update. Regards, -- Yves-Alexis
Attachment:
signature.asc
Description: This is a digitally signed message part
Current thread:
- ISC announces two BIND vulnerabilities ISC Security Officer (Jun 30)
- Re: ISC announces two BIND vulnerabilities Yves-Alexis Perez (Jun 30)
- Re: ISC announces two BIND vulnerabilities Solar Designer (Jun 30)
- Re: ISC announces two BIND vulnerabilities Yves-Alexis Perez (Jun 30)
- Re: ISC announces two BIND vulnerabilities Yves-Alexis Perez (Jun 30)