[28453] in bugtraq
Security Update: [CSSA-2003-SCO.2] UnixWare 7.1.1 : multiple vulnerabilities in BIND (CERT CA-2002-31)
daemon@ATHENA.MIT.EDU (security@caldera.com)
Thu Jan 16 13:39:12 2003
To: bugtraq@securityfocus.com, announce@lists.caldera.com,
scoannmod@xenitec.on.ca, full-disclosure@lists.netsys.com
From: security@caldera.com
Reply-To: please_reply_to_security@caldera.com
Date: Wed, 15 Jan 2003 11:43:26 -0800
Message-ID: <20030115114326.K8886@sco.com>
Mime-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha1;
protocol="application/pgp-signature"; boundary="oyUTqETQ0mS9luUI"
Content-Disposition: inline
--oyUTqETQ0mS9luUI
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
To: bugtraq@securityfocus.com announce@lists.caldera.com scoannmod@xenitec.on.ca full-disclosure@lists.netsys.com
______________________________________________________________________________
SCO Security Advisory
Subject: UnixWare 7.1.1 : multiple vulnerabilities in BIND (CERT CA-2002-31)
Advisory number: CSSA-2003-SCO.2
Issue date: 2003 January 15
Cross reference:
______________________________________________________________________________
1. Problem Description
From CERT CA-2002-31:
Multiple vulnerabilities have been found in BIND (Berkeley
Internet Name Domain).
One of these vulnerabilities may allow remote attackers to
execute arbitrary code with the privileges of the user
running named, typically root.
Other vulnerabilities may allow remote attackers to disrupt
the normal operation of your name server, possibly causing a
crash.
A vulnerability in the DNS resolver library may allow remote
attackers to execute arbitrary code with the privileges of
applications that issue network name or address requests.
2. Vulnerable Supported Versions
System Binaries
----------------------------------------------------------------------
UnixWare 7.1.1 /usr/lib/nslookup.help
/usr/sbin/addr
/usr/sbin/dig
/usr/sbin/dnskeygen
/usr/sbin/dnsquery
/usr/sbin/host
/usr/sbin/in.named
/usr/sbin/irpd
/usr/sbin/mkservdb
/usr/sbin/named-bootconf
/usr/sbin/named-xfer
/usr/sbin/ndc
/usr/sbin/nslookup
/usr/sbin/nsupdate
3. Solution
The proper solution is to install the latest packages.
4. UnixWare 7.1.1
4.1 Location of Fixed Binaries
ftp://ftp.sco.com/pub/updates/UnixWare/CSSA-2003-SCO.2
4.2 Verification
MD5 (erg712161.pkg.Z) = 834f2766a46d684c40d7637f6b2be2f4
md5 is available for download from
ftp://ftp.sco.com/pub/security/tools
4.3 Installing Fixed Binaries
Upgrade the affected binaries with the following sequence:
Download erg712161.pkg.Z to the /var/spool/pkg directory
# uncompress /var/spool/pkg/erg712161.pkg.Z
# pkgadd -d /var/spool/pkg/erg712161.pkg
5. References
Specific references for this advisory:
http://www.cert.org/advisories/CA-2002-31.html
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-1219
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-1220
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-1221
SCO security resources:
http://www.sco.com/support/security/index.html
This security fix closes SCO incidents sr871600, fz526634,
erg712161.
6. Disclaimer
SCO is not responsible for the misuse of any of the information
we provide on this website and/or through our security
advisories. Our advisories are a service to our customers
intended to promote secure installation and use of SCO
products.
______________________________________________________________________________
--oyUTqETQ0mS9luUI
Content-Type: application/pgp-signature
Content-Disposition: inline
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.6 (SCO_SV)
Comment: For info see http://www.gnupg.org
iEYEARECAAYFAj4lud4ACgkQaqoBO7ipriFLWgCfTpIsIIAv0T5awXSyObUK8lNi
zzMAmgORXxljTMddz2QjtBmpmrA5LIeM
=wAf5
-----END PGP SIGNATURE-----
--oyUTqETQ0mS9luUI--
