Subject: Re: ISC BIND / NAMED CVE-2007-2926 (Another ISC BIND Pullup)
To: None <tech-security@netbsd.org>
From: Brian A. Seklecki <lavalamp@spiritual-machines.org>
List: tech-security
Date: 08/09/2007 13:40:14
The FreeBSD patch applies and builds cleanly with an adjusted relatitive
patch name :%s/contrib\/bind9\//dist\/bind\//g
~BAS
On Thu, 9 Aug 2007, Brian A. Seklecki wrote:
>
> All:
>
> Another global version bug has been out since July 24th:
>
> http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-2926
> http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2926
>
> The ISC recommended solution is to upgrade 9.3.4-P1 -- We (And FreeBSD
> RELENG_6_2) are at 9.3.2 + Local Patches.
>
> ISC's official recommendation is 9.3.4-P1?2?. All versions prior to BIND
> 9.3.3 are EOL by ISC. FreeBSD pulled the patch in manually:
>
> http://security.freebsd.org/advisories/FreeBSD-SA-07:07.bind.asc
>
> We need to do the same, just like we did back in March:
>
> ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2007-003.txt.asc
>
> I'm testing it now.
>
> l8*
> -lava (Brian A. Seklecki - Pittsburgh, PA, USA)
> http://www.spiritual-machines.org/
>
> "Guilty? Yeah. But he knows it. I mean, you're guilty.
> You just don't know it. So who's really in jail?"
> ~Maynard James Keenan
>
>
l8*
-lava (Brian A. Seklecki - Pittsburgh, PA, USA)
http://www.spiritual-machines.org/
"Guilty? Yeah. But he knows it. I mean, you're guilty.
You just don't know it. So who's really in jail?"
~Maynard James Keenan