Opened 3 years ago

Closed 3 years ago

#11704 closed enhancement (fixed)

bind9 bind 9.12.3-P4 (CVE-2018-5744 CVE-2018-5745 CVE-2019-6465)

Reported by: Bruce Dubbs Owned by: Bruce Dubbs
Priority: high Milestone: 8.4
Component: BOOK Version: SVN
Severity: normal Keywords:
Cc:

Description

New patch version.

Change History (5)

comment:1 by Douglas R. Reno, 3 years ago

Priority: normalhigh
Summary: bind9 bind 9.12.3-P4bind9 bind 9.12.3-P4 (CVE-2018-5744 CVE-2018-5745 CVE-2019-6465)
Today ISC disclosed three vulnerabilities affecting multiple versions of
BIND.  Full details on versions affected and more information about the
vulnerabilities are available via these articles in the ISC Knowledge Base:

CVE-2018-5744:
   A specially crafted packet can cause named to leak memory
   https://kb.isc.org/docs/cve-2018-5744

CVE-2018-5745:
   An assertion failure can occur if a trust anchor rolls over to
   an unsupported key algorithm when a server is using managed-keys
   https://kb.isc.org/docs/cve-2018-5745

CVE-2019-6465:
   Controls for zone transfers may not be properly applied to
   Dynamically Loadable Zones (DLZs) if the zones are writable.
   https://kb.isc.org/docs/cve-2019-6465

New software versions are available from the ISC downloads page:
https://www.isc.org/downloads

With the public disclosure of these vulnerabilities, parties which
had been given advance notice concerning them are released from
non-disclosure and packagers and redistributors are encouraged to
publish updated packages containing fixes.

If you have additional questions, please direct them to
security-officer@isc.org

Thank you,

Michael McNally
ISC Security Officer

comment:2 by Bruce Dubbs, 3 years ago

Milestone: 8.58.4

Promote to 8,4,

comment:3 by Bruce Dubbs, 3 years ago

Owner: changed from blfs-book to Bruce Dubbs
Status: newassigned

comment:4 by Bruce Dubbs, 3 years ago

--- 9.12.3-P4 released ---

--- 9.12.3-P3 released (withdrawn) ---

  1. [security] Zone transfer controls for writable DLZ zones were

not effective as the allowzonexfr method was not being called for such zones. (CVE-2019-6465) [GL #790]

--- 9.12.3-P2 released (withdrawn) ---

  1. [security] Named could crash if it is managing a key with

managed-keys and the authoritative zone is rolling the key to an unsupported algorithm. (CVE-2018-5745) [GL #780]

  1. [security] Named leaked memory if there were multiple Key Tag

EDNS options present. (CVE-2018-5744) [GL #772]

comment:5 by Bruce Dubbs, 3 years ago

Resolution: fixed
Status: assignedclosed

Fixed at revision 21250.

Note: See TracTickets for help on using tickets.