Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Tue, 28 Jul 2009 12:08:25 -0600
From: Vincent Danen <>
Subject: debian bug report on bind9 DoS

There's a bind 9 DoS reported in Debian's BTS [1] that provides a
reproducer and some interesting info on a bind9 crash.  I don't think
it's a huge problem with a well-secured bind9 configuration, but could
be quite problematic for bind config's that allow updates without an
RNDC key (typical of some dynamic DNS implementations), or on a system
that has lax enough permissions that the RNDC key is exposed.

We don't ship bind 8 so I cannot say whether or not it only affects bind
9 or earlier versions.  Some further information is in our bugzilla from
some quick testing I did [2].

This probably requires a CVE name.


Vincent Danen / Red Hat Security Response Team 

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.