Test ID:	1.3.6.1.4.1.25623.1.0.54128
Category:	SuSE Local Security Checks
Title:	SuSE Security Advisory SUSE-SA:2002:044 (bind8)
Summary:	SuSE Security Advisory SUSE-SA:2002:044 (bind8)
Description:	The remote host is missing updates announced in advisory SUSE-SA:2002:044. The security research company ISS (Internet Security Services) has discovered several vulnerabilities in the BIND8 name server, including a remotely exploitable buffer overflow. The advisories by ISS and ISC mention the following problems in detail: 1. There is a buffer overflow in the way named handles SIG records. This buffer overflow can be exploited to obtain access to the victim host under the account the named process is running with. In order to exploit this problem, the attacker must control an existing DNS domain, and must be allowed to perform a recursive query. The impact of this vulnerability is serious. 2. There are several Denial Of Service problems in BIND8 that allow remote attackers to terminate the name server process. At least one of these vulnerabilities seems to be exploitable. Solution: Update your system with the packages as indicated in the referenced security advisory. http://www.securityspace.com/smysecure/catid.html?in=SUSE-SA:2002:044 Risk factor : High
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2002-1219 ISS Security Advisory: 20021112 Multiple Remote Vulnerabilities in BIND4 and BIND8 http://bvlive01.iss.net/issEn/delivery/xforce/alertdetail.jsp?oid=21469 Bugtraq: 20021112 [Fwd: Notice of serious vulnerabilities in ISC BIND 4 & 8] (Google Search) http://marc.theaimsgroup.com/?l=bugtraq&m=103713117612842&w=2 http://www.cert.org/advisories/CA-2002-31.html CERT/CC vulnerability note: VU#852283 http://www.kb.cert.org/vuls/id/852283 http://lists.apple.com/archives/Security-announce/2002/Nov/msg00000.html FreeBSD Security Advisory: FreeBSD-SA-02:43 En Garde Linux Advisory: ESA-20021114-029 SuSE Security Announcement: SuSE-SA:2002:044 (Google Search) http://www.linux-mandrake.com/en/security/2002/MDKSA-2002-077.php Debian Security Information: DSA-196 (Google Search) http://www.debian.org/security/2002/dsa-196 Conectiva Linux advisory: CLA-2002:546 http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000546 Caldera Security Advisory: CSSA-2003-SCO.2 Computer Incident Advisory Center Bulletin: N-013 http://www.ciac.org/ciac/bulletins/n-013.shtml Bugtraq: 20021115 [OpenPKG-SA-2002.011] OpenPKG Security Advisory (bind, bind8) (Google Search) http://online.securityfocus.com/archive/1/300019 COMPAQ Service Security Patch: SSRT2408 http://online.securityfocus.com/advisories/4999 SGI Security Advisory: 20021201-01-P ftp://patches.sgi.com/support/free/security/advisories/20021201-01-P Bugtraq: 20021118 TSLSA-2002-0076 - bind (Google Search) http://marc.theaimsgroup.com/?l=bugtraq&m=103763574715133&w=2 BugTraq ID: 6160 http://www.securityfocus.com/bid/6160 http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:2539 XForce ISS Database: bind-sig-rr-bo(10304) http://xforce.iss.net/xforce/xfdb/10304 Common Vulnerability Exposure (CVE) ID: CVE-2002-1220 CERT/CC vulnerability note: VU#229595 http://www.kb.cert.org/vuls/id/229595 BugTraq ID: 6161 http://www.securityfocus.com/bid/6161 http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:449 XForce ISS Database: bind-opt-rr-dos(10332) http://xforce.iss.net/xforce/xfdb/10332 Common Vulnerability Exposure (CVE) ID: CVE-2002-1221 CERT/CC vulnerability note: VU#581682 http://www.kb.cert.org/vuls/id/581682 BugTraq ID: 6159 http://www.securityfocus.com/bid/6159 http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:2094 XForce ISS Database: bind-null-dereference-dos(10333) http://xforce.iss.net/xforce/xfdb/10333
Copyright	Copyright (c) 2005 E-Soft Inc. http://www.securityspace.com

This is only one of 32582 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.

New User Registration Email: UserID: Passwd: Please email me your monthly newsletters, informing the latest services, improvements & surveys. Please email me a vulnerability test announcement whenever a new test is added.     Privacy

Registered User Login   UserID:     Passwd:     Forgot userid or passwd? Email/Userid: