SB2015070811 - SUSE Linux update for bind

Security Bulletin ID SB2015070811

Severity

Medium

Patch available

YES

Number of vulnerabilities 2

Exploitation vector Remote access

Highest impact Denial of service

Breakdown by Severity

Low
Medium
High
Critical

Description

This security bulletin contains information about 2 secuirty vulnerabilities.

1) Resource management error (CVE-ID: CVE-2015-1349)

The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.

named in ISC BIND 9.7.0 through 9.9.6 before 9.9.6-P2 and 9.10.x before 9.10.1-P2, when DNSSEC validation and the managed-keys feature are enabled, allows remote attackers to cause a denial of service (assertion failure and daemon exit, or daemon crash) by triggering an incorrect trust-anchor management scenario in which no key is ready for use.

2) Input validation error (CVE-ID: CVE-2015-4620)

The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.

name.c in named in ISC BIND 9.7.x through 9.9.x before 9.9.7-P1 and 9.10.x before 9.10.2-P2, when configured as a recursive resolver with DNSSEC validation, allows remote attackers to cause a denial of service (REQUIRE assertion failure and daemon exit) by constructing crafted zone data and then making a query for a name in that zone.

Remediation

Install update from vendor's website.

References

https://lists.opensuse.org/opensuse-security-announce/2015-07/msg00013.html