|
Vulnerability Assessment & Network Security Forums |
|||||||||
If through a vulnerability assessment, a network security issue is detected for the vulnerability below, applying the appropriate security patches in a timely matter is very important. If you have detected that your system has already been compromised, following CERT's Network Security recovery document will assist with recommended steps for system recovery. Home >> Browse Vulnerability Assessment Database >> Debian Local Security Checks >> [DSA196] DSA-196-1 bind Vulnerability Assessment Details
|
[DSA196] DSA-196-1 bind |
||
DSA-196-1 bind Detailed Explanation for this Vulnerability Assessment [Bind version 9, the bind9 package, is not affected by these problems.] ISS X-Force has discovered several serious vulnerabilities in the Berkeley Internet Name Domain Server (BIND). BIND is the most common implementation of the DNS (Domain Name Service) protocol, which is used on the vast majority of DNS servers on the Internet. DNS is a vital Internet protocol that maintains a database of easy-to-remember domain names (host names) and their corresponding numerical IP addresses. Circumstantial evidence suggests that the Internet Software Consortium (ISC), maintainers of BIND, was made aware of these issues in mid-October. Distributors of Open Source operating systems, including Debian, were notified of these vulnerabilities via CERT about 12 hours before the release of the advisories on November 12th. This notification did not include any details that permited us to identify the vulnerable code, much less prepare timely fixes. Unfortunately ISS and the ISC released their security advisories with only descriptions of the vulnerabilities, without any patches. Even though there were no signs that these exploits are known to the black-hat community, and there were no reports of active attacks, such attacks could have been developed in the meantime - with no fixes available. We can all express our regret at the inability of the ironically named Internet Software Consortium to work with the Internet community in handling this problem. Hopefully this will not become a model for dealing with security issues in the future. The Common Vulnerabilities and Exposures (CVE) project identified the following vulnerabilities: These problems have been fixed in version 8.3.3-2.0woody1 for the current stable distribution (woody), in version 8.2.3-0.potato.3 for the previous stable distribution (potato) and in version 8.3.3-3 for the unstable distribution (sid). The fixed packages for unstable will enter the archive today. We recommend that you upgrade your bind package immediately, update to bind9, or switch to another DNS server implementation. Solution : http://www.debian.org/security/2002/dsa-196 Network Security Threat Level: High Networks Security ID: 6159, 6160, 6161 Vulnerability Assessment Copyright: This script is (C) 2005 Michel Arboi |
||
Cables, Connectors |
Juniper EX4600-40F-AFI 24 SFP+/SFP Ports 4 QSFP+ Ports Dual AC Switch
$1300.00
Juniper SRX1500-SYS-JB-AC SRX1500 Services Gateway-Dual Power JPSU-400W-AC
$1784.00
Juniper Networks EX3300-48P 48-Port PoE+ 4x SFP+ Network Switch w/ Power Cord
$43.95
JUNIPER EX3400-48P 48x 1GB PoE+ RJ-45 4x 10GB SFP+ 2x 40GB QSFP+, DUAL AC POWER
$210.00
Juniper Networks EX2200-C-12P-2G 12 Port Gigabit PoE 2 T/SFP 1G Network Switch
$129.00
Juniper EX3300-48P, 48 Port PoE+ Gigabit Network Switch w/ Power cord
$54.99
Juniper EX3400-48P 48-Ports PoE+ 4x SFP+ and 2x QSFP+ Managed Switch Tested
$205.00
EX2300-24P Juniper 24-port 10/100/1000BASE-T PoE+ 4 x 1/10GbE SFP/SFP+ UNCLAIMED
$450.00
JUNIPER EX4550-32F-AFO 32-PORT ETHERNET SWITCH 2x POWER SUPPLY - TESTED
$299.99
Juniper Networks EX3300 EX3300-48P 48-Port Gigabit PoE+ Switch
$41.50
|
||
No Discussions have been posted on this vulnerability. |