Test Kennung:	1.3.6.1.4.1.25623.1.0.51526
Kategorie:	Conectiva Local Security Checks
Titel:	Conectiva Security Advisory CLA-2002:507
Zusammenfassung:	NOSUMMARY
Beschreibung:	Description: The remote host is missing updates announced in advisory CLA-2002:507. There is a buffer overflow vulnerability[1,4] in several DNS resolver libraries that affect all applications linked to these libraries. In Conectiva Linux the vulnerability affects the libbind library included in the BIND[2] distribution and a resolver library included with glibc. A remote attacker who is able to send malicious DNS responses to vulnerable machines could exploit this vulnerability and potentially execute arbitrary code with the privileges of the application making use of the vulnerable resolver library. Regarding the BIND 9.x packages distributed with Conectiva Linux 7.0 and 8, the libbind library is not included nor generated, which means that these packages are not vulnerable to this problem. The 8.2 BIND packages shipped with Conectiva Linux 6.0, on the other hand, use the libbind library in their utilities and are being upgraded to the 8.2.6 version which was released by ISC[3] to address this problem. Please note that the named daemon is believed to be *not* vulnerable to this problem, even in versions prior to 8.2.6. Glibc has this vulnerability in the getnetby* script_family( of functions when the system is configured to use dns to resolve network names. In the default installation, however, this is disabled in the /etc/nsswitch.conf configuration file: Example of a vulnerable system: networks: files dns System without this vulnerability exposed (default nsswitch configuration): networks: files Solution: The apt tool can be used to perform RPM package upgrades by running 'apt-get update' followed by 'apt-get upgrade' http://www.securityspace.com/smysecure/catid.html?in=CLA-2002:507 http://distro.conectiva.com.br/atualizacoes/index.php?id=a&anuncio=002002 Risk factor : High
Copyright	Copyright (c) 2005 E-Soft Inc. http://www.securityspace.com

Dies ist nur einer von 145615 Anfälligkeitstests in unserem Testpaket. Finden Sie mehr über unsere vollständigen Sicherheitsüberprüfungen heraus. Um einen gratis Test für diese Anfälligkeit auf Ihrem System durchlaufen zu lassen, registrieren Sie sich bitte unten.