[slackware-security] bind (SSA:2015-209-01)

[slackware-security]  bind (SSA:2015-209-01)

New bind packages are available for Slackware 13.0, 13.1, 13.37, 14.0, 14.1,
and -current to fix a security issue.


Here are the details from the Slackware 14.1 ChangeLog:
+--------------------------+
patches/packages/bind-9.9.7_P2-i486-1_slack14.1.txz:  Upgraded.
  This update fixes a security issue where an error in the handling of TKEY
  queries can be exploited by an attacker for use as a denial-of-service
  vector, as a constructed packet can use the defect to trigger a REQUIRE
  assertion failure, causing BIND to exit.
  Impact:
  Both recursive and authoritative servers are vulnerable to this defect.
  Additionally, exposure is not prevented by either ACLs or configuration
  options limiting or denying service because the exploitable code occurs
  early in the packet handling, before checks enforcing those boundaries.
  Operators should take steps to upgrade to a patched version as soon as
  possible.
  For more information, see:
    http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5477
    https://kb.isc.org/article/AA-01272
  (* Security fix *)
+--------------------------+


Where to find the new packages:
+-----------------------------
+

Thanks to the friendly folks at the OSU Open Source Lab
(http://osuosl.org) for donating FTP and rsync hosting
to the Slackware project!  :-)

Also see the "Get Slack" section on http://slackware.com for
additional mirror sites near you.

Updated package for Slackware 13.0:
ftp://ftp.slackware.com/pub/slackware/slackware-13.0/patches/packages/bind-9.9.7_P2-i486-1_slack13.0.txz

Updated package for Slackware x86_64 13.0:
ftp://ftp.slackware.com/pub/slackware/slackware64-13.0/patches/packages/bind-9.9.7_P2-x86_64-1_slack13.0.txz

Updated package for Slackware 13.1:
ftp://ftp.slackware.com/pub/slackware/slackware-13.1/patches/packages/bind-9.9.7_P2-i486-1_slack13.1.txz

Updated package for Slackware x86_64 13.1:
ftp://ftp.slackware.com/pub/slackware/slackware64-13.1/patches/packages/bind-9.9.7_P2-x86_64-1_slack13.1.txz

Updated package for Slackware 13.37:
ftp://ftp.slackware.com/pub/slackware/slackware-13.37/patches/packages/bind-9.9.7_P2-i486-1_slack13.37.txz

Updated package for Slackware x86_64 13.37:
ftp://ftp.slackware.com/pub/slackware/slackware64-13.37/patches/packages/bind-9.9.7_P2-x86_64-1_slack13.37.txz

Updated package for Slackware 14.0:
ftp://ftp.slackware.com/pub/slackware/slackware-14.0/patches/packages/bind-9.9.7_P2-i486-1_slack14.0.txz

Updated package for Slackware x86_64 14.0:
ftp://ftp.slackware.com/pub/slackware/slackware64-14.0/patches/packages/bind-9.9.7_P2-x86_64-1_slack14.0.txz

Updated package for Slackware 14.1:
ftp://ftp.slackware.com/pub/slackware/slackware-14.1/patches/packages/bind-9.9.7_P2-i486-1_slack14.1.txz

Updated package for Slackware x86_64 14.1:
ftp://ftp.slackware.com/pub/slackware/slackware64-14.1/patches/packages/bind-9.9.7_P2-x86_64-1_slack14.1.txz

Updated package for Slackware -current:
ftp://ftp.slackware.com/pub/slackware/slackware-current/slackware/n/bind-9.10.2_P3-i586-1.txz

Updated package for Slackware x86_64 -current:
ftp://ftp.slackware.com/pub/slackware/slackware64-current/slackware64/n/bind-9.10.2_P3-x86_64-1.txz


MD5 signatures:
+-------------+

Slackware 13.0 package:
6a7f7bbc83fd3d189d1e43f672deb33d  bind-9.9.7_P2-i486-1_slack13.0.txz

Slackware x86_64 13.0 package:
3b8306bfbec7ff968762ab5c38e7d419  bind-9.9.7_P2-x86_64-1_slack13.0.txz

Slackware 13.1 package:
cfb8dfe797158a769697c261f2e5114c  bind-9.9.7_P2-i486-1_slack13.1.txz

Slackware x86_64 13.1 package:
417b3bb461e5fd5aae6b671fd584a1ae  bind-9.9.7_P2-x86_64-1_slack13.1.txz

Slackware 13.37 package:
df46b76823c598beb2d0f47f2b6a9813  bind-9.9.7_P2-i486-1_slack13.37.txz

Slackware x86_64 13.37 package:
b17f5230240b9a0738e2066897b09a40  bind-9.9.7_P2-x86_64-1_slack13.37.txz

Slackware 14.0 package:
c9f9074c811f470009e6dda97dc5ff68  bind-9.9.7_P2-i486-1_slack14.0.txz

Slackware x86_64 14.0 package:
578d63e26fee2783502f0828dc3d491c  bind-9.9.7_P2-x86_64-1_slack14.0.txz

Slackware 14.1 package:
9e27701833bd20df42e25418ffa8fdca  bind-9.9.7_P2-i486-1_slack14.1.txz

Slackware x86_64 14.1 package:
4b9c8c11a38c28ca2f12e8f97e3763c6  bind-9.9.7_P2-x86_64-1_slack14.1.txz

Slackware -current package:
c47d83f7a7b31902e802df3b72d1e902  n/bind-9.10.2_P3-i586-1.txz

Slackware x86_64 -current package:
c95fcfd95ed0261a2dedee90432f34c7  n/bind-9.10.2_P3-x86_64-1.txz


Installation instructions:
+------------------------+

Upgrade the package as root:
# upgradepkg bind-9.9.7_P2-i486-1_slack14.1.txz

Then, restart the name server:
# /etc/rc.d/rc.bind restart


+-----+

Slackware Linux Security Team
http://slackware.com/gpg-key
security@slackware.com

+------------------------------------------------------------------------+
| To leave the slackware-security mailing list:                          |
+------------------------------------------------------------------------+
| Send an email to majordomo@slackware.com with this text in the body of |
| the email message:                                                     |
|                                                                        |
|   unsubscribe slackware-security                                       |
|                                                                        |
| You will get a confirmation message back containing instructions to    |
| complete the process.  Please do not reply to this email address.      |
+------------------------------------------------------------------------+