Notified: November 12, 2000 Updated: May 16, 2001
Unknown
No statement is currently available from the vendor regarding this vulnerability.
The vendor has not provided us with any further information regarding this vulnerability.
The CERT/CC has no additional comments at this time.
Notified: November 12, 2000 Updated: May 16, 2001
Affected
COMPAQ COMPUTER CORPORATION CERT-2000-20 - BIND 8 The "zxfr bug" X-REF: SSRT1-38U, CERT-2000-20 Compaq Tru64 UNIX V5.1 - patch: SSRT1-66U_v5.1.tar.Z Compaq Tru64 UNIX V5.0 & V5.0a - V5.0 patch: SSRT1-68U_v5.0.tar.Z V5.0a patch: SSRT1-68U_v5.0a.tar.Z Compaq Tru64 UNIX V4.0D/F/G - Not Vulnerable TCP/IP Services for Compaq OpenVMS - Not Vulnerable CERT02000-20 - BIND 8 The "srv bug" X-REF: SSRT1-38U, CERT CA2000-20 Compaq Tru64 UNIX V5.1 - patch: SSRT1-66U_v5.1.tar.Z Compaq Tru64 UNIX V5.0 & V5.0a - V5.0 patch: SSRT1-68U_v5.0.tar.Z V5.0a patch: SSRT1-68U_v5.0a.tar.Z Compaq Tru64 UNIX V4.0D/F/G - Not Vulnerable TCP/IP Services for Compaq OpenVMS - Not Vulnerable Compaq will provide notice of the completion/availability of the patches through AES services (DIA, DSNlink FLASH), the ** Security mailing list, and be available from your normal Compaq Support channel. **You may subscribe to the Security mailing list at: http://www.support.compaq.com/patches/mailing-list.shtml Software Security Response Team COMPAQ COMPUTER CORPORATION
The vendor has not provided us with any further information regarding this vulnerability.
Compaq Tru64 Unix was reported not vulnerable when CA-2000-20 was initially launched.
Updated: May 11, 2001
Unknown
No statement is currently available from the vendor regarding this vulnerability.
The vendor has not provided us with any further information regarding this vulnerability.
The CERT/CC has no additional comments at this time.
Updated: May 16, 2001
Affected
No statement is currently available from the vendor regarding this vulnerability.
The vendor has not provided us with any further information regarding this vulnerability.
Debian has released vendor-specific information regarding this vulnerability at: http://www.debian.org/security/2000/20001112
Notified: November 12, 2000 Updated: May 11, 2001
Not Affected
All versions of FreeBSD after 4.0-RELEASE (namely 4.1-RELEASE, 4.1.1-RELEASE and the forthcoming 4.2-RELEASE) are not vulnerable to this bug since they include versions of BIND 8.2.3. FreeBSD 4.0-RELEASE and earlier are vulnerable to the reported problems since they include an older version of BIND, and an update to a non-vulnerable version is scheduled to be committed to FreeBSD 3.5.1-STABLE in the next few days.
The vendor has not provided us with any further information regarding this vulnerability.
The CERT/CC has no additional comments at this time.
Notified: November 12, 2000 Updated: May 11, 2001
Not Affected
Fujitsu's UXP/V is not vulnerable to these bugs because we support a different version of BIND.
The vendor has not provided us with any further information regarding this vulnerability.
The CERT/CC has no additional comments at this time.
Notified: November 12, 2000 Updated: January 25, 2002
Affected
No statement is currently available from the vendor regarding this vulnerability.
The vendor has not provided us with any further information regarding this vulnerability.
HP has released a Security Bulletin to address this issue; for further information, please visit http://itrc.hp.com and search for "HPSBUX0102-144". Please note that registration may be required to access this document.
Notified: November 12, 2000 Updated: May 11, 2001
Affected
IBM has reported to the CERT/CC that AIX is vulnerable to the bugs described in this document. IBM initially released an e-patch in APAR IY14512. IBM has posted an e-fix for the BIND denial-of-service vulnerabilities to ftp.software.ibm.com/aix/efixes/security. See the README file in this ftp directory for additional information. Also, IBM has posted an e-fix to this same site that contains libc.a library that incorporates a fix to the BIND vulnerabilities and the recent locale subsystem format string vulnerability discovered by Ivan Arce of CORE, and discussed on Bugtraq. The e-fix for BIND must be downloaded and installed before implementing this e-fix. See the same README file for details.
The vendor has not provided us with any further information regarding this vulnerability.
The CERT/CC has no additional comments at this time.
Updated: May 11, 2001
Unknown
No statement is currently available from the vendor regarding this vulnerability.
The vendor has not provided us with any further information regarding this vulnerability.
The CERT/CC has no additional comments at this time.
Updated: May 11, 2001
Affected
No statement is currently available from the vendor regarding this vulnerability.
The vendor has not provided us with any further information regarding this vulnerability.
The CERT/CC has no additional comments at this time.
Updated: May 11, 2001
Unknown
No statement is currently available from the vendor regarding this vulnerability.
The vendor has not provided us with any further information regarding this vulnerability.
The CERT/CC has no additional comments at this time.
Updated: May 11, 2001
Unknown
No statement is currently available from the vendor regarding this vulnerability.
The vendor has not provided us with any further information regarding this vulnerability.
The CERT/CC has no additional comments at this time.
Updated: May 11, 2001
Unknown
No statement is currently available from the vendor regarding this vulnerability.
The vendor has not provided us with any further information regarding this vulnerability.
The CERT/CC has no additional comments at this time.
Updated: May 11, 2001
Unknown
No statement is currently available from the vendor regarding this vulnerability.
The vendor has not provided us with any further information regarding this vulnerability.
The CERT/CC has no additional comments at this time.
Updated: May 11, 2001
Unknown
No statement is currently available from the vendor regarding this vulnerability.
The vendor has not provided us with any further information regarding this vulnerability.
The CERT/CC has no additional comments at this time.
Notified: November 16, 2000 Updated: May 11, 2001
Affected
SuSE Linux has published a Security Announcement (below) regarding this vulnerability. For the latest version of this advisory, please visit: http://www.suse.com/de/support/security/2000_045_bind8_txt.txt
The vendor has not provided us with any further information regarding this vulnerability.
SuSE Security Announcement: bind8 (SuSE-SA:2000:45)
-----BEGIN PGP SIGNED MESSAGE----- SuSE Security Announcement Package: bind8
Announcement-ID: SuSE-SA:2000:45
Date: Thursday, November 16th, 2000 16:00 MEST
Affected SuSE versions: 6.0, 6.1, 6.2, 6.3, 6.4
Vulnerability Type: remote denial of service
Severity (1-10): 7
SuSE default package: no
Other affected systems: all systems using bind, version 8.2.2 before
patchlevel 7 Content of this advisory: 1) security vulnerability resolved: bind8
problem description, discussion, solution and upgrade information
2) pending vulnerabilities, solutions, workarounds
3) standard appendix (further information) 1) problem description, brief discussion, solution, upgrade information BIND, the Berkeley Internet Name Daemon, versions before 8.2.2p7, has
been found vulnerable to two denial of service attacks: named may crash
after a compressed zone transfer request (ZXFR) and if an SRV record
(defined in RFC2782) is sent to the server. Administrators testing
the ZXFR bug should be aware that it can take several seconds after
the triggering the bug until the nameserver daemon crashes. SuSE versions 6.0 through 6.4 are affected by these two problems. The bind8 package in SuSE-7.0 is not affected because a different
version of bind8 (8.2.3) was used in this distribution. By the release
time of the SuSE-7.0 distribution our engineers have determined that
the problems we had with stalling zone transfers under some obscure
conditions were not present with the 8.2.3 release of the package. Administrators are strongly recommended to upgrade their bind8 package
using the provided packages from the sources below. There is a
temporary fix for the ZXFR problem (disable zone transfers) but none
for the SRV record problem. For the latest information about security vulnerabilities in the bind
name server consider the Internet Software Consortium bind security
webpage at http://www.isc.org/products/BIND/bind-security.html . To check if your system has the vulnerable package installed, use the
command `rpm -q
Notified: November 16, 2000 Updated: May 11, 2001
Affected
No statement is currently available from the vendor regarding this vulnerability.
The vendor has not provided us with any further information regarding this vulnerability.
The CERT/CC has no additional comments at this time.