[dns-esp] Fwd: [1st-b] New vulnerabilities in BIND announced: CVE-2015-5722 and CVE-2015-5986
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
FYI... vulnerabilidades en BIND.
- -------- Forwarded Message --------
Subject: [1st-b] New vulnerabilities in BIND announced: CVE-2015-5722 and CVE-2015-5986 Date: Wed, 2 Sep 2015 22:20:17 +0200 From: ISC Security Officer security-officer@isc.org Reply-To: ISC Security Officer security-officer@isc.org To: isc-csirt-security@lists.isc.org
Please be advised that ISC publicly announced two critical vulnerabilities in BIND:
CVE-2015-5722 is a denial-of-service vector which can be exploited remotely against a BIND server that is performing validation on DNSSEC-signed records. All versions of BIND since 9.0.0 are vulnerable. https://kb.isc.org/article/AA-01287
CVE-2015-5986 is a denial-of-service vector which can be used against a BIND server that is performing recursion and (under limited conditions) an authoritative-only nameserver. Versions of BIND since 9.9.7 and 9.10.2 are vulnerable. https://kb.isc.org/article/AA-01291
New releases of BIND, including security fixes for these vulnerabilities, are available:
ftp://ftp.isc.org/isc/bind9/9.10.3rc1/RELEASE-NOTES.bind-9.10.3rc1.html ftp://ftp.isc.org/isc/bind9/9.9.8rc1/RELEASE-NOTES.bind-9.9.8rc1.html ftp://ftp.isc.org/isc/bind9/9.10.2-P4/RELEASE-NOTES.bind-9.10.2-P4.html ftp://ftp.isc.org/isc/bind9/9.9.7-P3/RELEASE-NOTES.bind-9.9.7-P3.html
Marcin Siodelski (as ISC Security Officer)
De paso hoy también hubo de PowerDNS https://doc.powerdns.com/md/security/powerdns-advisory-2015-02/ Saludos On Sep 2, 2015 5:27 PM, "Carlos M. Martinez" carlos@lacnic.net wrote:
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
FYI... vulnerabilidades en BIND.
- -------- Forwarded Message --------
Subject: [1st-b] New vulnerabilities in BIND announced: CVE-2015-5722 and CVE-2015-5986 Date: Wed, 2 Sep 2015 22:20:17 +0200 From: ISC Security Officer security-officer@isc.org security-officer@isc.org Reply-To: ISC Security Officer security-officer@isc.org security-officer@isc.org To: isc-csirt-security@lists.isc.org
Please be advised that ISC publicly announced two critical vulnerabilities in BIND:
CVE-2015-5722 is a denial-of-service vector which can be exploited remotely against a BIND server that is performing validation on DNSSEC-signed records. All versions of BIND since 9.0.0 are vulnerable. https://kb.isc.org/article/AA-01287
CVE-2015-5986 is a denial-of-service vector which can be used against a BIND server that is performing recursion and (under limited conditions) an authoritative-only nameserver. Versions of BIND since 9.9.7 and 9.10.2 are vulnerable. https://kb.isc.org/article/AA-01291
New releases of BIND, including security fixes for these vulnerabilities, are available:
ftp://ftp.isc.org/isc/bind9/9.10.3rc1/RELEASE-NOTES.bind-9.10.3rc1.html ftp://ftp.isc.org/isc/bind9/9.9.8rc1/RELEASE-NOTES.bind-9.9.8rc1.html ftp://ftp.isc.org/isc/bind9/9.10.2-P4/RELEASE-NOTES.bind-9.10.2-P4.html ftp://ftp.isc.org/isc/bind9/9.9.7-P3/RELEASE-NOTES.bind-9.9.7-P3.html
Marcin Siodelski (as ISC Security Officer)
-----BEGIN PGP SIGNATURE----- Version: GnuPG/MacGPG2 v2
iEYEARECAAYFAlXnW8IACgkQLGiPbNUVB6Ki6wCeLzEfD5V4j1B6Sh4gGXO1TodG JZQAn1cWCzJBXeEL03z0BdNhFrCUHSqM =gnBk -----END PGP SIGNATURE-----
dns-esp mailing list dns-esp@listas.nic.cl https://listas.nic.cl/mailman/listinfo/dns-esp
-
Carlos M. Martinez -
Nico