-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

[slackware-security]  bind (SSA:2020-140-01)

New bind packages are available for Slackware 14.0, 14.1, 14.2, and -current to
fix security issues.


Here are the details from the Slackware 14.2 ChangeLog:
+--------------------------+
patches/packages/bind-9.11.19-i586-1_slack14.2.txz:  Upgraded.
  This update fixes security issues:
  A malicious actor who intentionally exploits the lack of effective
  limitation on the number of fetches performed when processing referrals
  can, through the use of specially crafted referrals, cause a recursing
  server to issue a very large number of fetches in an attempt to process
  the referral. This has at least two potential effects: The performance of
  the recursing server can potentially be degraded by the additional work
  required to perform these fetches, and the attacker can exploit this
  behavior to use the recursing server as a reflector in a reflection attack
  with a high amplification factor.
  Replaying a TSIG BADTIME response as a request could trigger an assertion
  failure.
  For more information, see:
    https://kb.isc.org/docs/cve-2020-8616
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8616
    https://kb.isc.org/docs/cve-2020-8617
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8617
  (* Security fix *)
+--------------------------+


Where to find the new packages:
+-----------------------------+

Thanks to the friendly folks at the OSU Open Source Lab
(http://osuosl.org) for donating FTP and rsync hosting
to the Slackware project!  :-)

Also see the "Get Slack" section on http://slackware.com for
additional mirror sites near you.

Updated package for Slackware 14.0:

Updated package for Slackware x86_64 14.0:

Updated package for Slackware 14.1:

Updated package for Slackware x86_64 14.1:

Updated package for Slackware 14.2:

Updated package for Slackware x86_64 14.2:

Updated package for Slackware -current:

Updated package for Slackware x86_64 -current:


MD5 signatures:
+-------------+

Slackware 14.0 package:
8a8be89119053b4cf308e94c39b0441f  bind-9.11.19-i486-1_slack14.0.txz

Slackware x86_64 14.0 package:
c1ff5217ff073769862204f708bfc969  bind-9.11.19-x86_64-1_slack14.0.txz

Slackware 14.1 package:
08b6ff961e66d98a4a3cab7dc6485c83  bind-9.11.19-i486-1_slack14.1.txz

Slackware x86_64 14.1 package:
28421755e2c614bbfba77ad5d19ed95a  bind-9.11.19-x86_64-1_slack14.1.txz

Slackware 14.2 package:
3def6c8b8115e1b5eb199281dd7bd6c7  bind-9.11.19-i586-1_slack14.2.txz

Slackware x86_64 14.2 package:
1533854201484c39c4d6d13a0b0ac246  bind-9.11.19-x86_64-1_slack14.2.txz

Slackware -current package:
1d0111759a7622d5341a3acb620d42a8  n/bind-9.16.3-i586-1.txz

Slackware x86_64 -current package:
f22d2d2b35b461bca96df936a65fc4dc  n/bind-9.16.3-x86_64-1.txz


Installation instructions:
+------------------------+

Upgrade the package as root:
# upgradepkg bind-9.11.19-i586-1_slack14.2.txz

Then, restart the name server:

# /etc/rc.d/rc.bind restart


+-----+

Slackware: 2020-140-01: bind Security Update

May 19, 2020
New bind packages are available for Slackware 14.0, 14.1, 14.2, and -current to fix security issues

Summary

Here are the details from the Slackware 14.2 ChangeLog: patches/packages/bind-9.11.19-i586-1_slack14.2.txz: Upgraded. This update fixes security issues: A malicious actor who intentionally exploits the lack of effective limitation on the number of fetches performed when processing referrals can, through the use of specially crafted referrals, cause a recursing server to issue a very large number of fetches in an attempt to process the referral. This has at least two potential effects: The performance of the recursing server can potentially be degraded by the additional work required to perform these fetches, and the attacker can exploit this behavior to use the recursing server as a reflector in a reflection attack with a high amplification factor. Replaying a TSIG BADTIME response as a request could trigger an assertion failure. For more information, see: https://kb.isc.org/docs/cve-2020-8616 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8616 https://kb.isc.org/docs/cve-2020-8617 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8617 (* Security fix *)

Where Find New Packages

Thanks to the friendly folks at the OSU Open Source Lab (http://osuosl.org) for donating FTP and rsync hosting to the Slackware project! :-)
Also see the "Get Slack" section on http://slackware.com for additional mirror sites near you.
Updated package for Slackware 14.0:
Updated package for Slackware x86_64 14.0:
Updated package for Slackware 14.1:
Updated package for Slackware x86_64 14.1:
Updated package for Slackware 14.2:
Updated package for Slackware x86_64 14.2:
Updated package for Slackware -current:
Updated package for Slackware x86_64 -current:

MD5 Signatures

Slackware 14.0 package: 8a8be89119053b4cf308e94c39b0441f bind-9.11.19-i486-1_slack14.0.txz
Slackware x86_64 14.0 package: c1ff5217ff073769862204f708bfc969 bind-9.11.19-x86_64-1_slack14.0.txz
Slackware 14.1 package: 08b6ff961e66d98a4a3cab7dc6485c83 bind-9.11.19-i486-1_slack14.1.txz
Slackware x86_64 14.1 package: 28421755e2c614bbfba77ad5d19ed95a bind-9.11.19-x86_64-1_slack14.1.txz
Slackware 14.2 package: 3def6c8b8115e1b5eb199281dd7bd6c7 bind-9.11.19-i586-1_slack14.2.txz
Slackware x86_64 14.2 package: 1533854201484c39c4d6d13a0b0ac246 bind-9.11.19-x86_64-1_slack14.2.txz
Slackware -current package: 1d0111759a7622d5341a3acb620d42a8 n/bind-9.16.3-i586-1.txz
Slackware x86_64 -current package: f22d2d2b35b461bca96df936a65fc4dc n/bind-9.16.3-x86_64-1.txz

Severity
[slackware-security] bind (SSA:2020-140-01)
New bind packages are available for Slackware 14.0, 14.1, 14.2, and -current to fix security issues.

Installation Instructions

Installation instructions: Upgrade the package as root: # upgradepkg bind-9.11.19-i586-1_slack14.2.txz Then, restart the name server: # /etc/rc.d/rc.bind restart