The OpenNET Project
 
Search (keywords):  SOFT ARTICLES TIPS & TRICKS SECURITY
LINKS NEWS MAN DOCUMENTATION


Security Update: [CSSA-2002-SCO.37] UnixWare 7.1.1 : buffer overflow in DNS resolver


<< Previous INDEX Search src Set bookmark Go to bookmark Next >>
Date: Fri, 23 Aug 2002 16:37:13 -0700
From: [email protected]
To: [email protected], [email protected],
Subject: Security Update: [CSSA-2002-SCO.37] UnixWare 7.1.1 : buffer overflow in DNS resolver

--V0207lvV8h4k8FAm
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline

To: [email protected] [email protected] [email protected] [email protected]

______________________________________________________________________________

		Caldera International, Inc.  Security Advisory

Subject:		UnixWare 7.1.1 : buffer overflow in DNS resolver
Advisory number: 	CSSA-2002-SCO.37
Issue date: 		2002 August 23
Cross reference:
______________________________________________________________________________


1. Problem Description

	From CERT CA-2002-19: A buffer overflow vulnerability exists
	in multiple implementations of DNS resolver libraries.
	Operating systems and applications that utilize vulnerable
	DNS resolver libraries may be affected. A remote attacker
	who is able to send malicious DNS responses could potentially
	exploit this vulnerability to execute arbitrary code or
	cause a denial of service on a vulnerable system.


2. Vulnerable Supported Versions

	System				Binaries
	----------------------------------------------------------------------
	UnixWare 7.1.1			/usr/lib/nslookup.help
					/usr/sbin/addr
					/usr/sbin/dig
					/usr/sbin/dnskeygen
					/usr/sbin/dnsquery
					/usr/sbin/host
					/usr/sbin/in.named
					/usr/sbin/irpd
					/usr/sbin/mkservdb
					/usr/sbin/named-bootconf
					/usr/sbin/named-xfer
					/usr/sbin/ndc
					/usr/sbin/nslookup
					/usr/sbin/nsupdate


3. Solution

	The proper solution is to install the latest packages.


4. UnixWare 7.1.1

	4.1 Location of Fixed Binaries

	ftp://ftp.caldera.com/pub/updates/UnixWare/CSSA-2002-SCO.37


	4.2 Verification

	MD5 (erg501624.pkg.Z) = cb425affbc7740e3338dfd55409ba0f0

	md5 is available for download from
		ftp://ftp.caldera.com/pub/security/tools


	4.3 Installing Fixed Binaries

		Upgrade the affected binaries with the following commands:

	Download erg501624.pkg.Z to the /var/spool/pkg directory

	# uncompress /var/spool/pkg/erg501624.pkg.Z
	# pkgadd -d /var/spool/pkg/erg501624.pkg


5. References

	Specific references for this advisory:
		http://www.isc.org/products/BIND/bind-security.html
		http://www.pine.nl/advisories/pine-cert-20020601.asc
		http://www.kb.cert.org/vuls/id/803539
		http://www.cert.org/advisories/CA-2002-19.html
		http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0651

	Caldera security resources:
		http://www.caldera.com/support/security/index.html

	This security fix closes Caldera incidents sr866551, fz521493,
	erg501624.


6. Disclaimer

	Caldera International, Inc. is not responsible for the
	misuse of any of the information we provide on this website
	and/or through our security advisories. Our advisories are
	a service to our customers intended to promote secure
	installation and use of Caldera products.


7. Acknowledgements

	Caldera thanks Joost Pol of PINE-CERT and the FreeBSD Project
	for their analysis of these vulnerabilities.

______________________________________________________________________________

--V0207lvV8h4k8FAm
Content-Type: application/pgp-signature
Content-Disposition: inline

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.6 (SCO_SV)
Comment: For info see http://www.gnupg.org

iEYEARECAAYFAj1mxygACgkQaqoBO7ipriGigQCfUuwKubxLWNsBGlbLHt4OB9Y0
Df8AnjpwDiT0+iHUf9p8eUrp8ZxPFKH4
=fyGl
-----END PGP SIGNATURE-----

--V0207lvV8h4k8FAm--

<< Previous INDEX Search src Set bookmark Go to bookmark Next >>



Партнёры:
PostgresPro
Inferno Solutions
Hosting by Hoster.ru
Хостинг:

Закладки на сайте
Проследить за страницей
Created 1996-2024 by Maxim Chirkov
Добавить, Поддержать, Вебмастеру