Subject: ISC BIND / NAMED CVE-2007-2926 (Another ISC BIND Pullup)
To: None <tech-security@netbsd.org>
From: Brian A. Seklecki <lavalamp@spiritual-machines.org>
List: tech-security
Date: 08/09/2007 13:12:27
All:
Another global version bug has been out since July 24th:
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-2926
http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2926
The ISC recommended solution is to upgrade 9.3.4-P1 -- We (And FreeBSD
RELENG_6_2) are at 9.3.2 + Local Patches.
ISC's official recommendation is 9.3.4-P1?2?. All versions prior to BIND
9.3.3 are EOL by ISC. FreeBSD pulled the patch in manually:
http://security.freebsd.org/advisories/FreeBSD-SA-07:07.bind.asc
We need to do the same, just like we did back in March:
ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2007-003.txt.asc
I'm testing it now.
l8*
-lava (Brian A. Seklecki - Pittsburgh, PA, USA)
http://www.spiritual-machines.org/
"Guilty? Yeah. But he knows it. I mean, you're guilty.
You just don't know it. So who's really in jail?"
~Maynard James Keenan