[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <1498819293.18870.28.camel@debian.org>
Date: Fri, 30 Jun 2017 12:41:33 +0200
From: Yves-Alexis Perez <corsac@...ian.org>
To: oss-security@...ts.openwall.com
Cc: ISC Security Officer <security-officer@....org>
Subject: Re: ISC announces two BIND vulnerabilities
On Fri, 2017-06-30 at 01:09 -0800, ISC Security Officer wrote:
> On Thursday (29 June) Internet Systems Consortium disclosed two security
> vulnerabilities in BIND. Details on the individual vulnerabilities
> can be found in our knowledge base:
>
> CVE-2017-3142: https://kb.isc.org/article/AA-01504/74/CVE-2017-3142
> CVE-2017-3143: https://kb.isc.org/article/AA-01503/74/CVE-2017-3143
>
> New software releases have been issued containing these security fixes;
> they are available from our download page at http://www.isc.org/downloads
>
As per list policy, and since I'm following these for Debian, here's some more
details inline for the list.
The vulnerabilities are very similar to the knot one (no CVE yet) found by the
same researchers (Synaktiv):
CVE-2017-3142: An error in TSIG authentication can permit unauthorized zone
transfers
An attacker who is able to send and receive messages to an authoritative DNS
server and who has knowledge of a valid TSIG key name may be able to
circumvent TSIG authentication of AXFR requests via a carefully constructed
request packet. A server that relies solely on TSIG keys for protection with
no other ACL protection could be manipulated into:
* providing an AXFR of a zone to an unauthorized recipient
* accepting bogus NOTIFY packets
CVE-2017-3043: An error in TSIG authentication can permit unauthorized dynamic
updates
An attacker who is able to send and receive messages to an authoritative DNS
server and who has knowledge of a valid TSIG key name for the zone and service
being targeted may be able to manipulate BIND into accepting an unauthorized
dynamic update.
Regards,
--
Yves-Alexis
Download attachment "signature.asc" of type "application/pgp-signature" (489 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
