| Description: | Description:
The remote host is missing updates announced in
advisory RHSA-2008:0300.
The Berkeley Internet Name Domain (BIND) is an implementation of the Domain
Name System (DNS) protocols. BIND includes a DNS server (named)
a resolver
library (routines for applications to use when interfacing with DNS)
and
tools for verifying that the DNS server is operating correctly.
It was discovered that the bind packages created the rndc.key file with
insecure file permissions. This allowed any local user to read the content
of this file. A local user could use this flaw to control some aspects of
the named daemon by using the rndc utility, for example, stopping the named
daemon. This problem did not affect systems with the bind-chroot package
installed. (CVE-2007-6283)
A buffer overflow flaw was discovered in the inet_network() function, as
implemented by libbind. An attacker could use this flaw to crash an
application calling this function, with an argument provided from an
untrusted source. (CVE-2008-0122)
All users of bind are advised to upgrade to these updated packages.
Solution:
Please note that this update is available via
Red Hat Network. To use Red Hat Network, launch the Red
Hat Update Agent with the following command: up2date
http://rhn.redhat.com/errata/RHSA-2008-0300.html
http://www.redhat.com/security/updates/classification/#moderate
Risk factor : Critical
CVSS Score:
10.0
|
