-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
** NO RESTRICTIONS FOR DISTRIBUTION **
==================================================
SOURCE: Compaq Computer Corporation
Software Security Response Team
CASE ID: SSRT1-38U, SSRT1-66U,SSRT1-68U, SSRT1-69U
TITLE: Multiple Potential Security Issues in BIND
(X-REF: CERT CA-2000-20 & CERT CA-2001-02 )
Date: 26-FEB-2001
"Compaq is broadly distributing this Security Advisory in order
to bring to the attention of users of Compaq products the
important security information contained in this Advisory.
Compaq recommends that all users determine the applicability of
this information to their individual situations and take
appropriate action.
Compaq does not warrant that this information is necessarily
accurate or complete for all user situations and, consequently,
Compaq will not be responsible for any damages resulting from
user's use or disregard of the information provided in this
Advisory."
IMPACT:
Versions Affected: Compaq's Tru64 UNIX V4.0d, V4.0f, V4.0g,
V5.0, V5.0a, V5.1
Versions Not Affected: TCP/IP Services for Compaq OpenVMS
A number of potential security vulnerabilities have recently been
discovered for BIND released with Tru64 UNIX, where under certain
circumstances, system integrity may be compromised.
This advisory provides solution information for 6 (six) issues
spanning multiple versions of BIND 8.* and BIND 4.*
SEVERITY: HIGH
PROBLEM STATEMENT:
Several security problems were recently found in the BIND
software used by Compaq Tru64 UNIX. Specific details have been
published by a number of groups to the internet. Technical details
of these vulnerabilities are publicized by the ISC at:
http://www.isc.org/products/BIND/bind-security.html
The advisory information is not duplicated here. The purpose of
this advisory is to provide notice of remedial solutions for the
problems as it impacts Compaq Tru64 UNIX.
SOLUTION:
Compaq Tru64 UNIX engineering has provided a solutions for the
potential problems, details are included below.
NOTE: The solutions will be included in future releases of
Tru64 UNIX aggregate patch kits. Until that has happened
the kits identified should be reinstalled accordingly after an
upgrade to any affected version listed.
The patches identified are available from the Compaq FTP site
http://ftp1.support.compaq.com/public/dunix/ then choose the
version directory needed and search for the patch by name.
......................................................................
CERT VU#325431 INFOLEAK - servers may disclose
environment variables
X-REF: SSRT1-66U,SSRT1-68U,SSRT1-69U
......................................................................
Compaq Tru64 UNIX V5.1 -
patch: SSRT1-66U_v5_1.tar
Compaq Tru64 UNIX V5.0 & V5.0a -
V5.0 patch: SSRT1-68U_v5_0.tar
V5.0a patch: SSRT1-68U_v5_0a.tar
Compaq Tru64 UNIX V4.0D/F/G -
V4.0d patch: SSRT1-69U_v4_0d.tar
V4.0f patch: SSRT1-69U_v4_0f.tar
V4.0g patch: SSRT1-69U_v4_0g.tar
TCP/IP Services for Compaq OpenVMS - Not Vulnerable
......................................................................
CERT VU#572183 - BIND 4 Buffer overflow in
nslookupComplain()
X-REF: SSRT1-69U
CERT VU#868916 - BIND 4 Input validation
error in nslookupComplain()
X-REF: SSRT1-69U
......................................................................
Compaq Tru64 UNIX V5.0, V5.0a, V5.1 - Not Vulnerable
Compaq Tru64 UNIX V4.0D/F/G -
V4.0d patch: SSRT1-69U_v4_0d.tar
V4.0f patch: SSRT1-69U_v4_0f.tar
V4.0g patch: SSRT1-69U_v4_0g.tar
TCP/IP Services for Compaq OpenVMS - Not Vulnerable
......................................................................
CERT VU#196945- BIND 8 contains buffer
overflow in transaction signature handling code
X-REF: SSRT1-66U, SSRT1-68U
......................................................................
Compaq Tru64 UNIX V5.1 -
patch: SSRT1-66U_v5_1.tar
Compaq Tru64 UNIX V5.0 & V5.0a -
V5.0 patch: SSRT1-68U_v5_0.tar
V5.0a patch: SSRT1-68U_v5_0a.tar
Compaq Tru64 UNIX V4.0D/F/G - Not Vulnerable
TCP/IP Services for Compaq OpenVMS - Not Vulnerable
......................................................................
CERT CA-2000-20 - BIND 8 The "zxfr bug"
X-REF: SSRT1-38U
......................................................................
Compaq Tru64 UNIX V5.1 -
patch: SSRT1-66U_v5_1.tar
Compaq Tru64 UNIX V5.0 & V5.0a -
V5.0 patch: SSRT1-68U_v5_0.tar
V5.0a patch: SSRT1-68U_v5_0a.tar
Compaq Tru64 UNIX V4.0D/F/G - Not Vulnerable
TCP/IP Services for Compaq OpenVMS - Not Vulnerable
......................................................................
CERT CA-2000-20 - BIND 8 The "srv bug"
X-REF: SSRT1-38U
......................................................................
Compaq Tru64 UNIX V5.1 -
patch: SSRT1-66U_v5.1_tar
Compaq Tru64 UNIX V5.0 & V5.0a -
V5.0 patch: SSRT1-68U_v5_0.tar
V5.0a patch: SSRT1-68U_v5_0a.tar
Compaq Tru64 UNIX V4.0D/F/G - Not Vulnerable
TCP/IP Services for Compaq OpenVMS - Not Vulnerable
NOTE: For Compaq Tru64 UNIX V4.0e please contact your normal
Compaq Services channel.
To subscribe to automatically receive future NEW Security
Advisories from the Software Security Response Team at
Compaq via electronic mail,
Use your browser to get to the
http://www.support.compaq.com/patches/mailing-list.shtml
and sign up. Select "Security and Individual Notices" for
immediate dispatch notifications.
If you need further information, please contact your normal Compaq
Services support channel.
Compaq appreciates your cooperation and patience. We regret any
inconvenience applying this information may cause.
As always, Compaq urges you to periodically review your system
management and security procedures. Compaq will continue to
review and enhance the security features of its products and work
with customers to maintain and improve the security and integrity
of their systems.
(c) Copyright 2001 Compaq Computer Corporation. All rights reserved
-----BEGIN PGP SIGNATURE-----
Version: PGPfreeware 6.5.8 for non-commercial use
iQA/AwUBOpvCUqgxZJFjvD74EQI4CQCdFAVJWK1Ye6k4NZpToGhMxPCFH2QAnRVz
V/wStBTQ02MAG+JtzA8N7W5G
=AqRC
-----END PGP SIGNATURE-----
|
