Caldera Affected

Notified:  November 12, 2000 Updated: May 16, 2001

Status

Affected

Vendor Statement

The Advisory [is] available [at]: http://www.calderasystems.com/support/security/advisories/CSSA-2000-040.0.txt Updated packages will be available from OpenLinux Desktop 2.3 ftp://ftp.calderasystems.com/pub/updates/OpenLinux/2.3/current 9d8429f25c5fb3bebe2d66b1f9321e61 RPMS/bind-8.2.2p7-1.i386.rpm 0e958eb01f40826f000d779dbe6b8cb3 RPMS/bind-doc-8.2.2p7-1.i386.rpm 866ff74c77e9c04a6abcddcc11dbe17b RPMS/bind-utils-8.2.2p7-1.i386.rpm 6a545924805effbef01de74e34ba005e SRPMS/bind-8.2.2p7-1.src.rpm OpenLinux eServer 2.3 ftp://ftp.calderasystems.com/pub/updates/eServer/2.3/current 379c4328604b4491a8f3d0de44e42347 RPMS/bind-8.2.2p7-1.i386.rpm b428b824c8b67f2d8d4bf53738a3e7e0 RPMS/bind-doc-8.2.2p7-1.i386.rpm 28311d630281976a870d38abe91f07fb RPMS/bind-utils-8.2.2p7-1.i386.rpm 6a545924805effbef01de74e34ba005e SRPMS/bind-8.2.2p7-1.src.rpm OpenLinux eDesktop 2.4 ftp://ftp.calderasystems.com/pub/updates/eDesktop/2.4/current c37b6673cc9539e592013ac114846940 RPMS/bind-8.2.2p7-1.i386.rpm bbe0d7e317fde0d47cba1384f6d4b635 RPMS/bind-doc-8.2.2p7-1.i386.rpm 5c28dd5641a4550c03e9859d945a806e RPMS/bind-utils-8.2.2p7-1.i386.rpm 6a545924805effbef01de74e34ba005e SRPMS/bind-8.2.2p7-1.src.rpm

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

Compaq Computer Corporation Affected

Notified:  November 12, 2000 Updated: May 16, 2001

Status

Affected

Vendor Statement

COMPAQ COMPUTER CORPORATION CERT-2000-20 - BIND 8 The "zxfr bug" X-REF: SSRT1-38U, CERT-2000-20 Compaq Tru64 UNIX V5.1 - patch: SSRT1-66U_v5.1.tar.Z Compaq Tru64 UNIX V5.0 & V5.0a - V5.0 patch: SSRT1-68U_v5.0.tar.Z V5.0a patch: SSRT1-68U_v5.0a.tar.Z Compaq Tru64 UNIX V4.0D/F/G - Not Vulnerable TCP/IP Services for Compaq OpenVMS - Not Vulnerable CERT02000-20 - BIND 8 The "srv bug" X-REF: SSRT1-38U, CERT CA2000-20 Compaq Tru64 UNIX V5.1 - patch: SSRT1-66U_v5.1.tar.Z Compaq Tru64 UNIX V5.0 & V5.0a - V5.0 patch: SSRT1-68U_v5.0.tar.Z V5.0a patch: SSRT1-68U_v5.0a.tar.Z Compaq Tru64 UNIX V4.0D/F/G - Not Vulnerable TCP/IP Services for Compaq OpenVMS - Not Vulnerable Compaq will provide notice of the completion/availability of the patches through AES services (DIA, DSNlink FLASH), the ** Security mailing list, and be available from your normal Compaq Support channel. **You may subscribe to the Security mailing list at: http://www.support.compaq.com/patches/mailing-list.shtml Software Security Response Team COMPAQ COMPUTER CORPORATION

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

Compaq Tru64 Unix was reported as being not vulnerable when CA-2000-20 was initially launched.

Conectiva Affected

Updated:  May 16, 2001

Status

Affected

Vendor Statement

Please see Conectiva Linux Security Announcement CLSA-2000:338 at: http://distro.conectiva.com/atualizacoes/?id=a&anuncio=000338

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

Please note that the updated BIND packages referred to in CLSA-2000:338 contain a packaging error which renders named inoperable. Conectiva has published CLSA-2000:339 as an update to CLSA-2000:338. For further information, please visit: http://distro.conectiva.com/atualizacoes/?id=a&anuncio=000339

Debian Affected

Updated:  May 16, 2001

Status

Affected

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

Debian has released vendor-specific information regarding this vulnerability at: http://www.debian.org/security/2000/20001112

FreeBSD Not Affected

Notified:  November 12, 2000 Updated: May 11, 2001

Status

Not Affected

Vendor Statement

All versions of FreeBSD after 4.0-RELEASE (namely 4.1-RELEASE, 4.1.1-RELEASE and the forthcoming 4.2-RELEASE) are not vulnerable to this bug since they include versions of BIND 8.2.3. FreeBSD 4.0-RELEASE and earlier are vulnerable to the reported problems since they include an older version of BIND, and an update to a non-vulnerable version is scheduled to be committed to FreeBSD 3.5.1-STABLE in the next few days.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

FreeBSD has released the following advisory regarding this issue: ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-01:10.bind.asc

Fujitsu Not Affected

Notified:  November 12, 2000 Updated: May 11, 2001

Status

Not Affected

Vendor Statement

Fujitsu's UXP/V is not vulnerable to these bugs because we support a different version of BIND.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

Hewlett Packard Affected

Notified:  November 12, 2000 Updated: May 11, 2001

Status

Affected

Vendor Statement

HP is vulnerable to the SRV issue and patches are available, see HP Security Bulletin #144.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

To locate this HP Security Bulletin online, please visit http://itrc.hp.com and search for "HPSBUX0102-144". Please note that registration may be required to access this document.

IBM Affected

Notified:  November 12, 2000 Updated: May 11, 2001

Status

Affected

Vendor Statement

IBM has reported to the CERT/CC that AIX is vulnerable to the bugs described in this document. IBM initially released an e-patch in APAR IY14512. IBM has posted an e-fix for the BIND denial-of-service vulnerabilities to ftp.software.ibm.com/aix/efixes/security. See the README file in this ftp directory for additional information. Also, IBM has posted an e-fix to this same site that contains libc.a library that incorporates a fix to the BIND vulnerabilities and the recent locale subsystem format string vulnerability discovered by Ivan Arce of CORE, and discussed on Bugtraq. The e-fix for BIND must be downloaded and installed before implementing this e-fix. See the same README file for details.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

Immunix Unknown

Updated:  May 16, 2001

Status

Unknown

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

ISC Affected

Updated:  November 13, 2000

Status

Affected

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

MandrakeSoft Affected

Updated:  November 13, 2000

Status

Affected

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

Please see MDKSA-2000:067: bind at: http://www.linux-mandrake.com/en/security/MDKSA-2000-067.php3

Microsoft Not Affected

Notified:  November 12, 2000 Updated: November 14, 2000

Status

Not Affected

Vendor Statement

We have had a chance to investigate these issues and we are not-vulnerable. This includes both Windows 2000 and Windows NT 4.0.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

NetBSD Affected

Notified:  November 12, 2000 Updated: November 13, 2000

Status

Affected

Vendor Statement

NetBSD is believed to be vulnerable to these problems; in response, NetBSD-current has been upgraded to 8.2.2-P7 and 8.2.2-P7 will be present in the forthcoming NetBSD 1.5 release.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

RedHat Affected

Notified:  November 12, 2000 Updated: November 13, 2000

Status

Affected

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

Please see RHSA-2000:107-01: Updated bind packages fixing DoS attack available at: http://www.redhat.com/support/errata/RHSA-2000-107-01.html [ not available as of 11/13/2000, 1200 UTC-0500 ]

Slackware Affected

Updated:  November 13, 2000

Status

Affected

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

Updated Slackware distributions for bind may be found at: ftp://ftp.slackware.com/pub/slackware/slackware-current/slakware/n1/bind.tgz

SuSE Affected

Notified:  November 16, 2000 Updated: May 11, 2001

Status

Affected

Vendor Statement

SuSE Linux has published a Security Announcement (below) regarding this vulnerability. For the latest version of this advisory, please visit: http://www.suse.com/de/support/security/2000_045_bind8_txt.txt

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

SuSE Security Announcement: bind8 (SuSE-SA:2000:45) -----BEGIN PGP SIGNED MESSAGE----- SuSE Security Announcement Package: bind8 Announcement-ID: SuSE-SA:2000:45 Date: Thursday, November 16th, 2000 16:00 MEST Affected SuSE versions: 6.0, 6.1, 6.2, 6.3, 6.4 Vulnerability Type: remote denial of service Severity (1-10): 7 SuSE default package: no Other affected systems: all systems using bind, version 8.2.2 before patchlevel 7 Content of this advisory: 1) security vulnerability resolved: bind8 problem description, discussion, solution and upgrade information 2) pending vulnerabilities, solutions, workarounds 3) standard appendix (further information) 1) problem description, brief discussion, solution, upgrade information BIND, the Berkeley Internet Name Daemon, versions before 8.2.2p7, has been found vulnerable to two denial of service attacks: named may crash after a compressed zone transfer request (ZXFR) and if an SRV record (defined in RFC2782) is sent to the server. Administrators testing the ZXFR bug should be aware that it can take several seconds after the triggering the bug until the nameserver daemon crashes. SuSE versions 6.0 through 6.4 are affected by these two problems. The bind8 package in SuSE-7.0 is not affected because a different version of bind8 (8.2.3) was used in this distribution. By the release time of the SuSE-7.0 distribution our engineers have determined that the problems we had with stalling zone transfers under some obscure conditions were not present with the 8.2.3 release of the package. Administrators are strongly recommended to upgrade their bind8 package using the provided packages from the sources below. There is a temporary fix for the ZXFR problem (disable zone transfers) but none for the SRV record problem. For the latest information about security vulnerabilities in the bind name server consider the Internet Software Consortium bind security webpage at http://www.isc.org/products/BIND/bind-security.html . To check if your system has the vulnerable package installed, use the command `rpm -q ´. If applicable, please choose the update package(s) for your distribution from the URLs listed below and download the necessary rpm files. Then, install the package using the command `rpm -Uhv file.rpm´. rpm packages have an internal md5 checksum that protects against file corruption. You can verify this checksum using the command (independently from the md5 signatures below) `rpm --checksig --nogpg file.rpm', The md5 sums under each package are to prove the package authenticity, independently from the md5 checksums in the rpm package format. i386 Intel Platform: SuSE-6.4 ftp://ftp.suse.com/pub/suse/i386/update/6.4/n1/bind8-8.2.2-139.i386.rpm c6f2242efe722aaa4320010e00ddc080 source rpm: ftp://ftp.suse.com/pub/suse/i386/update/6.4/zq1/bind8-8.2.2-139.src.rpm ecd26bdf60d7950585649bc638a1d812 SuSE-6.3 ftp://ftp.suse.com/pub/suse/i386/update/6.3/n1/bind8-8.2.2-139.i386.rpm d3f51528ad2120cd3dc6517c2bc26c0a source rpm: ftp://ftp.suse.com/pub/suse/i386/update/6.3/zq1/bind8-8.2.2-139.src.rpm 6f1b8c1227d4876389a28d416a952713 SuSE-6.2 ftp://ftp.suse.com/pub/suse/i386/update/6.2/n1/bind8-8.2.2-139.i386.rpm 4d8a9f4c6e041326929bbdae97c10105 source rpm: ftp://ftp.suse.com/pub/suse/i386/update/6.2/zq1/bind8-8.2.2-139.src.rpm 83807820676d98687797ffff6f5b425c SuSE-6.1 ftp://ftp.suse.com/pub/suse/i386/update/6.1/n1/bind8-8.2.2-139.i386.rpm 1694cf40b5fa41361749297c9cddbca4 source rpm: ftp://ftp.suse.com/pub/suse/i386/update/6.1/zq1/bind8-8.2.2-139.src.rpm 8c5f727554e12a5aedb96de3db663518 SuSE-6.0 Please use the package from the 6.1 distribution. AXP Alpha Platform: SuSE-6.4 ftp://ftp.suse.com/pub/suse/axp/update/6.4/n1/bind8-8.2.2-139.alpha.rpm 51f61faaad78160fb3dcc68a8588c209 source rpm: ftp://ftp.suse.com/pub/suse/axp/update/6.4/zq1/bind8-8.2.2-139.src.rpm f42c51962852f8ff14e2d6423de62aec SuSE-6.3 ftp://ftp.suse.com/pub/suse/axp/update/6.3/n1/bind8-8.2.2-139.alpha.rpm 4d16cecb0da4f8ed6bff9c92655b9036 source rpm: ftp://ftp.suse.com/pub/suse/axp/update/6.3/zq1/bind8-8.2.2-139.src.rpm d8c4d1d9f0a14249151aa9d9e25f1db8 SuSE-6.1 ftp://ftp.suse.com/pub/suse/axp/update/6.1/n1/bind8-8.2.2-139.alpha.rpm 6a4f5b18072cca93f9064fdc802e50fb source rpm: ftp://ftp.suse.com/pub/suse/axp/update/6.1/zq1/bind8-8.2.2-139.src.rpm a3eec237cc642739b5b6c6eea6d197c0 PPC Power PC Platform: SuSE-6.4 ftp://ftp.suse.com/pub/suse/ppc/update/6.4/n1/bind8-8.2.2-139.ppc.rpm 65e82b875e7f8ff7409062d502d56115 source rpm: ftp://ftp.suse.com/pub/suse/ppc/update/6.4/zq1/bind8-8.2.2-139.src.rpm fd2a6e2a29a80b997758d4245913ff51 2) Pending vulnerabilities in SuSE Distributions and Workarounds: A new security announcement follows this advisory. 3) standard appendix: SuSE runs two security mailing lists to which any interested party may subscribe: suse-security@suse.com - general/linux/SuSE security discussion. All SuSE security announcements are sent to this list. To subscribe, send an email to . suse-security-announce@suse.com - SuSE's announce-only mailing list. Only SuSE's security annoucements are sent to this list. To subscribe, send an email to . For general information or the frequently asked questions (faq) send mail to: or respectively. SuSE's security contact is . Regards, Roman Drahtmüller. | Roman Drahtmüller // "Caution: Cape does | SuSE GmbH - Security Phone: // not enable user to fly." | Nürnberg, Germany +49-911-740530 // (Batman Costume warning label) | The information in this advisory may be distributed or reproduced, provided that the advisory is not modified in any way. SuSE GmbH makes no warranties of any kind whatsoever with respect to the information contained in this security advisory. Type Bits/KeyID Date User ID pub 2048/3D25D3D9 1999/03/06 SuSE Security Team - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.3i mQENAzbhLQQAAAEIAKAkXHe0lWRBXLpn38hMHy03F0I4Sszmoc8aaKJrhfhyMlOA BqvklPLE2f9UrI4Xc860gH79ZREwAgPt0pi6+SleNFLNcNFAuuHMLQOOsaMFatbz JR9i4m/lf6q929YROu5zB48rBAlcfTm+IBbijaEdnqpwGib45wE/Cfy6FAttBHQh 1Kp+r/jPbf1mYAvljUfHKuvbg8t2EIQz/5yGp+n5trn9pElfQO2cRBq8LFpf1l+U P7EKjFmlOq+Gs/fF98/dP3DfniSd78LQPq5vp8RL8nr/o2i7jkAQ33m4f1wOBWd+ cZovrKXYlXiR+Bf7m2hpZo+/sAzhd7LmAD0l09kABRG0JVN1U0UgU2VjdXJpdHkg VGVhbSA8c2VjdXJpdHlAc3VzZS5kZT6JARUDBRA24S1H5Fiyh7HKPEUBAVcOB/9b yHYji1/+4Xc2GhvXK0FSJN0MGgeXgW47yxDL7gmR4mNgjlIOUHZj0PEpVjWepOJ7 tQS3L9oP6cpj1Fj/XxuLbkp5VCQ61hpt54coQAvYrnT9rtWEGN+xmwejT1WmYmDJ xG+EGBXKr+XP69oIUl1E2JO3rXeklulgjqRKos4cdXKgyjWZ7CP9V9daRXDtje63 Om8gwSdU/nCvhdRIWp/Vwbf7Ia8iZr9OJ5YuQl0DBG4qmGDDrvImgPAFkYFzwlqo choXFQ9y0YVCV41DnR+GYhwl2qBd81T8aXhihEGPIgaw3g8gd8B5o6mPVgl+nJqI BkEYGBusiag2pS6qwznZiQEVAwUQNuEtBHey5gA9JdPZAQFtOAf+KVh939b0J94u v/kpg4xs1LthlhquhbHcKNoVTNspugiC3qMPyvSX4XcBr2PC0cVkS4Z9PY9iCfT+ x9WM96g39dAF+le2CCx7XISk9XXJ4ApEy5g4AuK7NYgAJd39PPbERgWnxjxir9g0 Ix30dS30bW39D+3NPU5Ho9TD/B7UDFvYT5AWHl3MGwo3a1RhTs6sfgL7yQ3U+mvq MkTExZb5mfN1FeaYKMopoI4VpzNVeGxQWIz67VjJHVyUlF20ekOz4kWVgsxkc8G2 saqZd6yv2EwqYTi8BDAduweP33KrQc4KDDommQNDOXxaKOeCoESIdM4p7Esdjq1o L0oixF12Cg== =pIeS - -----END PGP PUBLIC KEY BLOCK----- -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: noconv iQEVAwUBOhP863ey5gA9JdPZAQGVSggAjgh+Kdg2Xc6xLGVRrI4DrNOJLKLf/Hvc /1+WxxMMGW8Pzhk46tk6lXnY8oHwM+/Y5bqrVCRZbO3kcxisfnDf/DoOK6G9aoSH pVazqG5TqGHxbya+rKR72x/u/yTgA3EuGvb3zNL2uudDSRY2lj6h9k0xXP3k+Hv2 hfyKCloWHvrKcJnphTsBu4oShr/j9yT8bAyDrW7MnS7u5th092b/3vXz/KJ6joZy HOsln5N8Ul1lHnFeVk+xhRkQbyV8SUUgXTASxM/iYVx2RnDyA0IXcnc3F+D3lSjD Iy+J6QOWmzhD46kGdov4RCqZihKiQ6LmwcZaaXVk+iMHxXAGtS4DWA== =AAo1 -----END PGP SIGNATURE-----

Trustix Affected

Notified:  November 16, 2000 Updated: May 16, 2001

Status

Affected

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

View all 17 vendors View less vendors