Ubuntu 12.04 LTS USN-1462-1 Critical: Bind Denial of Service

ubuntu

June 5, 2012

Bind could be made to crash if it received specially crafted network traffic.

Summary

Bind could be made to crash if it received specially crafted network

traffic.

Software Description:

- bind9: Internet Domain Name Server

Details:

Dan Luther discovered that Bind incorrectly handled zero length rdata

fields. A remote attacker could use this flaw to cause Bind to crash or

behave erratically, resulting in a denial of service. (CVE-2012-1667)

It was discovered that Bind incorrectly handled revoked domain names. A

remote attacker could use this flaw to cause malicious domain names to be

continuously resolvable even after they have been revoked. (CVE-2012-1033)

Topics Covered

security advisory denial of service bind Ubuntu crash issue

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 12.04 LTS:
  libdns81                        1:9.8.1.dfsg.P1-4ubuntu0.1

Ubuntu 11.10:
  libdns69                        1:9.7.3.dfsg-1ubuntu4.2

Ubuntu 11.04:
  libdns69                        1:9.7.3.dfsg-1ubuntu2.4

Ubuntu 10.04 LTS:
  libdns64                        1:9.7.0.dfsg.P1-1ubuntu0.5

Ubuntu 8.04 LTS:
  libdns36                        1:9.4.2.dfsg.P2-2ubuntu0.10

In general, a standard system update will make all the necessary changes.