[slackware-security]  bind (SSA:2007-207-01)

New bind packages are available for Slackware 8.1, 9.0, 9.1, 10.0, 10.1, 10.2,
11.0, and 12.0 to fix security issues.

The first issue which allows remote attackers to make recursive queries only
affects Slackware 12.0.  More details about this issue may be found in the
Common Vulnerabilities and Exposures (CVE) database:

  http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2925

The second issue is the discovery that BIND9's query IDs are cryptographically
weak.  This issue affects the versions of BIND9 in all supported Slackware
versions.  More details about this issue may be found in the Common
Vulnerabilities and Exposures (CVE) database:

  http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2926


Here are the details from the Slackware 12.0 ChangeLog:
+--------------------------+
patches/packages/bind-9.4.1_P1-i486-1_slack12.0.tgz:
  Upgraded to bind-9.4.1_P1 to fix security issues.
  The default access control lists allow remote attackers to make recursive
  queries in BIND9 versions 9.4.0 through 9.4.1.
  The query IDs in BIND9 prior to BIND 9.4.1-P1 are cryptographically weak.
  For more information on these issues, see:
    http://www.isc.org/index.pl?/sw/bind/bind-security.php
    http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2925
    http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2926
  (* Security fix *)
+--------------------------+


Where to find the new packages:
+-----------------------------+

HINT:  Getting slow download speeds from ftp.slackware.com?
Give slackware.osuosl.org a try.  This is another primary FTP site
for Slackware that can be considerably faster than downloading
from ftp.slackware.com.

Thanks to the friendly folks at the OSU Open Source Lab
(http://osuosl.org) for donating additional FTP and rsync hosting
to the Slackware project!  :-)

Also see the "Get Slack" section on http://slackware.com for
additional mirror sites near you.

Updated package for Slackware 8.1:
ftp://ftp.slackware.com/pub/slackware/slackware-8.1/patches/packages/bind-9.2.8_P1-i386-1_slack8.1.tgz

Updated package for Slackware 9.0:
ftp://ftp.slackware.com/pub/slackware/slackware-9.0/patches/packages/bind-9.2.8_P1-i386-1_slack9.0.tgz

Updated package for Slackware 9.1:
ftp://ftp.slackware.com/pub/slackware/slackware-9.1/patches/packages/bind-9.2.8_P1-i486-1_slack9.1.tgz

Updated package for Slackware 10.0:
ftp://ftp.slackware.com/pub/slackware/slackware-10.0/patches/packages/bind-9.2.8_P1-i486-1_slack10.0.tgz

Updated package for Slackware 10.1:
ftp://ftp.slackware.com/pub/slackware/slackware-10.1/patches/packages/bind-9.3.4_P1-i486-1_slack10.1.tgz

Updated package for Slackware 10.2:
ftp://ftp.slackware.com/pub/slackware/slackware-10.2/patches/packages/bind-9.3.4_P1-i486-1_slack10.2.tgz

Updated package for Slackware 11.0:
ftp://ftp.slackware.com/pub/slackware/slackware-11.0/patches/packages/bind-9.3.4_P1-i486-1_slack11.0.tgz

Updated package for Slackware 12.0:
ftp://ftp.slackware.com/pub/slackware/slackware-12.0/patches/packages/bind-9.4.1_P1-i486-1_slack12.0.tgz


MD5 signatures:
+-------------+

Slackware 8.1 package:
4c4416bf01018b5930f8eb4250bb6bb4  bind-9.2.8_P1-i386-1_slack8.1.tgz

Slackware 9.0 package:
60690cd64a251807a8582b0e904772bd  bind-9.2.8_P1-i386-1_slack9.0.tgz

Slackware 9.1 package:
6769219553630a1ee75cf7b7021c9168  bind-9.2.8_P1-i486-1_slack9.1.tgz

Slackware 10.0 package:
7f8d1ad2360a9f0ccb38a9c8d83ad8d8  bind-9.2.8_P1-i486-1_slack10.0.tgz

Slackware 10.1 package:
39a4665d83754377d5be50a739100ad1  bind-9.3.4_P1-i486-1_slack10.1.tgz

Slackware 10.2 package:
f6c0d70a75b3a88c2972e359db895f72  bind-9.3.4_P1-i486-1_slack10.2.tgz

Slackware 11.0 package:
e830092ede1eedbcd54e85c370d8b621  bind-9.3.4_P1-i486-1_slack11.0.tgz

Slackware 12.0 package:
8bea2625ec5d0b04afaf12297474684e  bind-9.4.1_P1-i486-1_slack12.0.tgz


Installation instructions:
+------------------------+

Upgrade the package as root:
# upgradepkg bind-9.4.1_P1-i486-1_slack12.0.tgz 

Then, restart the nameserver:
# /etc/rc.d/rc.bind restart


+-----+

Slackware Linux Security Team
http://slackware.com/gpg-key
security@slackware.com