From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from pigeon.gentoo.org ([69.77.167.62] helo=lists.gentoo.org) by finch.gentoo.org with esmtp (Exim 4.60) (envelope-from ) id 1KWCLB-0003Oc-51 for garchives@archives.gentoo.org; Thu, 21 Aug 2008 15:44:49 +0000 Received: from pigeon.gentoo.org (localhost [127.0.0.1]) by pigeon.gentoo.org (Postfix) with SMTP id 35D33E0400; Thu, 21 Aug 2008 15:43:04 +0000 (UTC) Received: from smtp.gentoo.org (smtp.gentoo.org [140.211.166.183]) by pigeon.gentoo.org (Postfix) with ESMTP id A3E20E03CE for ; Thu, 21 Aug 2008 15:39:10 +0000 (UTC) Received: from localhost (localhost [127.0.0.1]) by smtp.gentoo.org (Postfix) with ESMTP id DE04665787 for ; Thu, 21 Aug 2008 15:39:09 +0000 (UTC) X-Virus-Scanned: amavisd-new at gentoo.org X-Spam-Score: -2.362 X-Spam-Level: X-Spam-Status: No, score=-2.362 required=5.5 tests=[AWL=0.237, BAYES_00=-2.599] Received: from smtp.gentoo.org ([127.0.0.1]) by localhost (smtp.gentoo.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id uxLByVkjSIt7 for ; Thu, 21 Aug 2008 15:39:03 +0000 (UTC) Received: from mail.goodpoint.de (tori.goodpoint.de [85.10.203.41]) (using TLSv1 with cipher DHE-RSA-CAMELLIA256-SHA (256/256 bits)) (No client certificate requested) by smtp.gentoo.org (Postfix) with ESMTP id D1ADA667D0 for ; Thu, 21 Aug 2008 15:39:02 +0000 (UTC) Received: from [127.0.0.1] (localhost [127.0.0.1]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) (Authenticated sender: rbu) by mail.goodpoint.de (Postfix) with ESMTP id 2C749109FD7; Thu, 21 Aug 2008 17:39:00 +0200 (CEST) From: Robert Buchholz To: gentoo-announce@lists.gentoo.org Subject: [gentoo-announce] UPDATE: [ GLSA 200804-22 ] PowerDNS Recursor: DNS Cache Poisoning Date: Thu, 21 Aug 2008 17:38:51 +0200 User-Agent: KMail/1.9.9 Cc: bugtraq@securityfocus.com, full-disclosure@lists.grok.org.uk, security-alerts@linuxsecurity.com Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-Id: Gentoo Linux mail X-BeenThere: gentoo-announce@lists.gentoo.org MIME-Version: 1.0 Content-Type: multipart/signed; boundary="nextPart4670234.B5yiR9yx1j"; protocol="application/pgp-signature"; micalg=pgp-sha1 Content-Transfer-Encoding: 7bit Message-Id: <200808211738.56945.rbu@gentoo.org> X-Archives-Salt: d606f541-eae3-4ca2-8730-795d11e86f73 X-Archives-Hash: 1f17b77503963c012e29031abfc9cc7d --nextPart4670234.B5yiR9yx1j Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Content-Disposition: inline =2D - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory [UPDATE] GLSA 200804-22:03 =2D - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - http://security.gentoo.org/ =2D - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: Normal Title: PowerDNS Recursor: DNS Cache Poisoning Date: April 18, 2008 Updated: August 21, 2008 Bugs: #215567, #231335 ID: 200804-22:03 =2D - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Update =3D=3D=3D=3D=3D=3D The previous version of the PowerDNS Recursor (3.1.5) did not properly address the issue, as UDP source port selection was=20 insufficiently randomized. We advise all users to upgrade to 3.1.6. The updated sections appear below. Affected packages =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 net-dns/pdns-recursor < 3.1.6 >=3D 3.1.6 Description =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D Amit Klein of Trusteer reported that insufficient randomness is used to calculate the TRXID values and the UDP source port numbers (CVE-2008-1637). Thomas Biege of SUSE pointed out that a prior fix to resolve this issue was incomplete, as it did not always enable the stronger random number generator for source port selection (CVE-2008-3217). Impact =3D=3D=3D=3D=3D=3D A remote attacker could send malicious answers to insert arbitrary DNS data into the cache. These attacks would in turn help an attacker to perform man-in-the-middle and site impersonation attacks. Resolution =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D All PowerDNS Recursor users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose ">=3Dnet-dns/pdns-recursor-3.1.6" References =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D [ 1 ] CVE-2008-1637 http://cve.mitre.org/cgi-bin/cvename.cgi?name=3DCVE-2008-1637 [ 2 ] CVE-2008-3217 http://cve.mitre.org/cgi-bin/cvename.cgi?name=3DCVE-2008-3217 Availability =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D This GLSA and any updates to it are available for viewing at the Gentoo Security Website: http://security.gentoo.org/glsa/glsa-200804-22.xml Concerns? =3D=3D=3D=3D=3D=3D=3D=3D=3D Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at http://bugs.gentoo.org. License =3D=3D=3D=3D=3D=3D=3D Copyright 2008 Gentoo Foundation, Inc; referenced text belongs to its owner(s). The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license. http://creativecommons.org/licenses/by-sa/2.5 --nextPart4670234.B5yiR9yx1j Content-Type: application/pgp-signature; name=signature.asc Content-Description: This is a digitally signed message part. -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.9 (GNU/Linux) iQIcBAABAgAGBQJIrYwQAAoJECaaHo/OfoM5bxEP/AlZejSYUGQ3nOXoxNmFJVZi CIOwkIDJE5BcEDLZ3xdmCPv4NgFeEPVsBcjinT2Wc1CPr799PoqSV7bXzG6LChle CTOvcTPprrvPKv2Ayg609/lPvI94mRSGb8DbCKnutnHA7usqgd0RPObsASJYyiuG Jyq5ZKjwGqD0GqV8mzoc6cDkhrtRnrsXx4ZVGjqp41fBiYQtFM/CR59ZVnY3RL2M l21xoOontq8GOsjtrfMWc2cVJK+wSM/cEaE9ujY4kYloMu5u3vGmRxy7I49U5aqA +FkzYlsPL5sWtBbCFU7i3EqUhmtz5YIjHtxtIpMVCpYd9ggyjDM1R+XbqY3XoEvM ZRO9kF9AcKB7tNHfp3lAbnKWcQFaK+/PDrR9oVTtBajl923+9u+Pn8ML7jiTVVPI DgslbWZYSvjK6W6uDrtrYlrE2UHK2I7DnMRgnvLUtH9anggRNPqX4Yincv13wTpW oy+B4DrsArf/8cFJr4cTnKysqxX2MnhD9UIrvfh4J1ZU43jhDCL+lSqbPqiEA02j oeeoPPvrfILanZt1sf4d8qS+VLOkEh9dHeuarW6qxk0zSIXRSfiO6kwaAvBk6F+s g4iJ3a3zFH+y3jk6NHTXtHjeB49bTo/VONO+LtfaMwZ/UP/Gsirqyyt18ZG23ZcL MFKz4Pt2YlFlTFrsdQO3 =wuzE -----END PGP SIGNATURE----- --nextPart4670234.B5yiR9yx1j--