Your message dated Tue, 19 May 2009 11:17:10 +0000
with message-id <[email protected]>
and subject line Bug#529420: fixed in nsd 2.3.7-3
has caused the Debian Bug report #529420,
regarding Critical off-by-one error in NSD2
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
529420: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=529420
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Package: nsd
Version: 2.3.7-1.1
Severity: grave
Tags: security
Dear NSD users and maintainers,
We have released version 3.2.2. of NSD. This is *critical* bugfix
release. One of the bugs is a one-byte buffer overflow that allows a
carefully crafted exploit to take down your name-server. It is highly
unlikely that the one-byte-off issue can lead to other (system) exploits.
The bug affects all version of NSD 2.0.0 to 3.2.1. Whether the bug can
be exploited to depends on various aspects of the OS and is therefore
distribution and compiler dependent.
For more information:
http://www.nlnetlabs.nl/publications/NSD_vulnerability_announcement.html
We strongly recommend you to update your systems to the latest version.
If you have reasons for not running the latest version of NSD, we
strongly advise you to at least apply the patch that resolves the
critical bug.
The source and patches are available at our website:
http://www.nlnetlabs.nl/downloads/nsd/nsd-3.2.2.tar.gz
http://www.nlnetlabs.nl/downloads/nsd/nsd-3.2.1-vuln.patch
http://www.nlnetlabs.nl/downloads/nsd/nsd-2.3.7-vuln.patch
SHA1 checksum (source): 23fc0be5d447ea852acd49f64743c96403a091fa
SHA1 checksum (patch 3.2.1): 20cb9fc73fae951a9cc25822c48b17ca1d956119
SHA1 checksum (patch 2.3.7): 94887d212621b458a86ad5b086eec9240477
Note that NSD 2.X is feature frozen and security patches may not be made
available in future events.
We acknowledge and thank Ilja von Sprundel of IOActive for finding and
reporting this bug.
Matthijs Mekking
NLnet Labs
RELNOTES:
BUG FIXES:
- - Off-by-one buffer overflow fix while processing the QUESTION section.
- - Return BADVERS when NSD does not implement the VERSION level of the
request, instead of 0x1<FORMERR>.
- - Bugfix #234.
- - Bugfix #235.
- - Reset 'error occurred' after notifying an error occurred at the $TTL
or $ORIGIN directive (Otherwise, the whole zone is skipped because the
error is reset after reading the SOA).
- - Minor bugfixes.
--- End Message ---
--- Begin Message ---
Source: nsd
Source-Version: 2.3.7-3
We believe that the bug you reported is fixed in the latest version of
nsd, which is due to be installed in the Debian FTP archive:
nsd_2.3.7-3.diff.gz
to pool/main/n/nsd/nsd_2.3.7-3.diff.gz
nsd_2.3.7-3.dsc
to pool/main/n/nsd/nsd_2.3.7-3.dsc
nsd_2.3.7-3_amd64.deb
to pool/main/n/nsd/nsd_2.3.7-3_amd64.deb
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Ondřej Surý <[email protected]> (supplier of updated nsd package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Format: 1.8
Date: Tue, 19 May 2009 11:37:44 +0200
Source: nsd
Binary: nsd
Architecture: source amd64
Version: 2.3.7-3
Distribution: unstable
Urgency: high
Maintainer: Ondřej Surý <[email protected]>
Changed-By: Ondřej Surý <[email protected]>
Description:
nsd - authoritative name domain server
Closes: 529420
Changes:
nsd (2.3.7-3) unstable; urgency=high
.
* Fix off-by-one error (Closes: #529420)
- debian/patches/nsd-2.3.7-vuln.patch
Checksums-Sha1:
cc83c520aee760d6ad1a5428fac332218e6799cd 1019 nsd_2.3.7-3.dsc
8de3f313162eff1a41f6a956920eb52099f79bcb 7914 nsd_2.3.7-3.diff.gz
82dab65c7c4a368725838414282dfe3ec60dad5d 179084 nsd_2.3.7-3_amd64.deb
Checksums-Sha256:
0f12d764ca7d8cbec1d04baab85d74a491c7d7603051129d01c778292f18daef 1019
nsd_2.3.7-3.dsc
69ea0b6a4c7222d606bea6875363769c9f44fee3e2e480945e9ce1597879ad82 7914
nsd_2.3.7-3.diff.gz
cf672e92f2886172a659efeb8fe9e8c1e39863bbd4f43e27cdfbb0baaaea514a 179084
nsd_2.3.7-3_amd64.deb
Files:
08b7ac91065562e0f6ecdd388f6cc4c2 1019 net optional nsd_2.3.7-3.dsc
83f260c055acd180e8bad7e7aca2552a 7914 net optional nsd_2.3.7-3.diff.gz
9bc10944546967b2bf73bd4300bdc9ce 179084 net optional nsd_2.3.7-3_amd64.deb
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
iEYEARECAAYFAkoSkcQACgkQ9OZqfMIN8nPr0ACcDcimLMRkQ5cRyH41uqW27bX7
MSkAni2kBrorJ+xqVSwIg7zAHEetYagL
=TW00
-----END PGP SIGNATURE-----
--- End Message ---
