Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×

Alerts This Week
Warning Icon 1 461
Alerts This Week
Warning Icon 1 461

Ubuntu 12.04 ESM USN-3346-3 Critical: Bind Zone Transfer Threat

ubuntu
Calendar Grey November 8, 2017
Scroller Ubuntu
Exploitable flaws in Ubuntu systems can result in data breaches or misrouted information. It is recommended to apply updates.
Bind could be made to serve incorrect information or expose sensitive information over the network.

Summary

Bind could be made to serve incorrect information or expose sensitive

information over the network.

Software Description:

- bind9: Internet Domain Name Server

Details:

USN-3346-1 and USN-3346-2 fixed two vulnerabilities in Bind and a

regression, respectively. This update provides the corresponding update

for Ubuntu 12.04 ESM.

Original advisory details:

 Clément Berthaux discovered that Bind did not correctly check TSIG

 authentication for zone update requests. An attacker could use this

 to improperly perform zone updates. (CVE-2017-3143)

 Clément Berthaux discovered that Bind did not correctly check TSIG

 authentication for zone transfer requests. An attacker could use this

 to improperly transfer entire zones. (CVE-2017-3142)

 In addition, this update adds the new root zone key signing key (KSK).

Topics%20covered

Topics Covered

security advisory critical issue ubuntu data exposure bind9 zone transfer

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 12.04 ESM:
  bind9                           1:9.8.1.dfsg.P1-4ubuntu0.23

After a standard system update you need to restart Bind to make
all the necessary changes.

References

 

  https://ubuntu.com/security/notices/USN-3346-1

  CVE-2017-3142, CVE-2017-3143

Severity
critical
Lowest
Low
Medium
High
Critical

November 08, 2017

Topics%20covered

Topics Covered

security advisory critical issue ubuntu data exposure bind9 zone transfer

Package Information

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.