Test ID:	1.3.6.1.4.1.25623.1.0.51526
Category:	Conectiva Local Security Checks
Title:	Conectiva Security Advisory CLA-2002:507
Summary:	NOSUMMARY
Description:	Description: The remote host is missing updates announced in advisory CLA-2002:507. There is a buffer overflow vulnerability[1,4] in several DNS resolver libraries that affect all applications linked to these libraries. In Conectiva Linux the vulnerability affects the libbind library included in the BIND[2] distribution and a resolver library included with glibc. A remote attacker who is able to send malicious DNS responses to vulnerable machines could exploit this vulnerability and potentially execute arbitrary code with the privileges of the application making use of the vulnerable resolver library. Regarding the BIND 9.x packages distributed with Conectiva Linux 7.0 and 8, the libbind library is not included nor generated, which means that these packages are not vulnerable to this problem. The 8.2 BIND packages shipped with Conectiva Linux 6.0, on the other hand, use the libbind library in their utilities and are being upgraded to the 8.2.6 version which was released by ISC[3] to address this problem. Please note that the named daemon is believed to be *not* vulnerable to this problem, even in versions prior to 8.2.6. Glibc has this vulnerability in the getnetby* script_family( of functions when the system is configured to use dns to resolve network names. In the default installation, however, this is disabled in the /etc/nsswitch.conf configuration file: Example of a vulnerable system: networks: files dns System without this vulnerability exposed (default nsswitch configuration): networks: files Solution: The apt tool can be used to perform RPM package upgrades by running 'apt-get update' followed by 'apt-get upgrade' http://www.securityspace.com/smysecure/catid.html?in=CLA-2002:507 http://distro.conectiva.com.br/atualizacoes/index.php?id=a&anuncio=002002 Risk factor : High
Copyright	Copyright (c) 2005 E-Soft Inc. http://www.securityspace.com

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.