bind CVE-2009-0025: incorrect DSA verification checks

Contributed by ray on 2009-01-17 from the CYA-again dept.

Damien Miller (djm@) wrote to security-announce@:

Some exploitable logic errors have been found in the bind nameserver's use of OpenSSL DSA verification functions. These errors may permit an attacker to bypass validation of DSA DNSSEC signatures.
This vulnerability has been designated CVE-2009-0025. More information is available from the ISC at:
https://www.isc.org/node/373
Source code patches are available for OpenBSD 4.3 and 4.4. -current has had an identical fix applied.
Patch for OpenBSD 4.3:
ftp://ftp.openbsd.org/pub/OpenBSD/patches/4.3/common/008_bind.patch

Patch for OpenBSD 4.4:
ftp://ftp.openbsd.org/pub/OpenBSD/patches/4.4/common/008_bind.patch

These patches are also available in the OPENBSD_4_3 and OPENBSD_4_4 stable CVS branches.

Start patching again!

(Comments are closed)

Comments

By Anonymous Coward (87.178.154.235) on 2009-01-17 08:35

Hurray! How I love that simple-and-easy patching procedure!
By Steve Shockley (68.83.96.160) on 2009-01-17 17:51

As I understand it, this vulnerability only affects you if you're using DNSSEC.
Comments
1. By tedu (udet) on 2009-01-17 20:16
  
  > As I understand it, this vulnerability only affects you if you're using DNSSEC.
  
  Yes, not sure why the first paragraph was snipped.
  
  "Some exploitable logic errors have been found in the bind nameserver's
  use of OpenSSL DSA verification functions. These errors may permit an
  attacker to bypass validation of DSA DNSSEC signatures."
  Comments
  1. By Ray Lai (ray) on 2009-01-18 05:22 http://cyth.net/~ray/
    
    Sorry, fixed.

Latest Articles

Wed, Jan 08
- 10:07 rpki-client 9.4 released (0)
Mon, Dec 30
- 03:57 Game of Trees 0.107 released (0)
Thu, Dec 19
- 16:38 rpki-client stricter aging policy for Trust Anchor certificates commited to -current (0)
- 08:04 FRAME sockets added to OpenBSD (0)
Wed, Dec 18
- 19:57 OpenBGPD 8.7 released (0)
Sat, Nov 30
- 18:42 Initial list of 21 EuroBSDcon 2024 videos released (0)
- 18:39 Rafael Sadowski on dpb(1) (1)
Fri, Nov 29
- 09:31 -current now has more flexible performance policy (0)
Mon, Nov 25
- 07:13 unwind: wildcard in blacklist (0)

Credits

Copyright © 2004-2008 Daniel Hartmeier. All rights reserved. Articles and comments are copyright their respective authors, submission implies license to publish on this web site. Contents of the archive prior to April 2nd 2004 as well as images and HTML templates were copied from the fabulous original deadly.org with Jose's and Jim's kind permission. This journal runs as CGI with httpd(8) on OpenBSD, the source code is BSD licensed. undeadly \Un*dead"ly\, a. Not subject to death; immortal. [Obs.]