SB2017063042 - Fedora 25 update for bind, bind-dyndb-ldap, dnsperf

Description

This security bulletin contains information about 3 secuirty vulnerabilities.

1) Security restrictions bypass (CVE-ID: CVE-2017-3143)

The vulnerability allows a remote attacker to bypass security restrictions on the target system.

The weakness exists due to an error in TSIG authentication of AXFR requests. A remote attacker who is able to send and receive messages to an authoritative DNS server and who has knowledge of a valid TSIG key name can send specially crafted request packet, manipulate the malicious zone content and accept unauthorized dynamic updates.

2) Security restrictions bypass (CVE-ID: CVE-2017-3142)

The vulnerability allows a remote attacker to bypass security restrictions on the target system.

The weakness exists due to an error in TSIG authentication of AXFR and NOTIFY requests. A remote attacker who is able to send and receive messages to an authoritative DNS server and who has knowledge of a valid TSIG key name can send specially crafted request packet, bypass authentication and perform unauthorized zone transfers.

3) Improper input validation (CVE-ID: CVE-2017-3140)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to an error when processing Response Policy Zones (RPZ) rules, when NSDNAME or NSIP policy rules are used. A remote attacker can trigger the affected server to enter an endless loop and repeatedly query a set of authoritative nameservers.

Successful exploitation of the vulnerability may allow an attacker to perform a denial of service attack.

Remediation

Install update from vendor's website.

References

• https://bodhi.fedoraproject.org/updates/FEDORA-2017-d04f7ddd73