Bug 478984 (CVE-2009-0025)
| Summary: | CVE-2009-0025 bind: DSA_do_verify() returns check issue | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Mark J. Cox <mjc> |
| Component: | vulnerability | Assignee: | Adam Tkac <atkac> |
| Status: | CLOSED ERRATA | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | low | ||
| Version: | unspecified | CC: | kreilly, osoukup, ovasik, security-response-team |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | Bug Fix | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2009-11-19 16:08:43 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 478985, 478986, 478987, 478988, 478989, 478990 | ||
| Bug Blocks: | |||
|
Comment 2
Mark J. Cox
2009-01-07 09:33:39 UTC
Now public, removing embargo: https://www.isc.org/node/373 nternet Systems Consortium Security Advisory.
BIND: EVP_VerifyFinal() and DSA_do_verify() return checks.
7 January 2009
Versions affected:
BIND 9.0 (all versions)
BIND 9.1 (all versions)
BIND 9.2 (all versions)
BIND 9.3.0, 9.3.1, 9.3.2, 9.3.3, 9.3.4, 9.3.5, 9.3.6
BIND 9.4.0, 9.4.1, 9.4.2, 9.4.3
BIND 9.5.0, 9.5.1
BIND 9.6.0
Severity: Low.
Description:
Return values from OpenSSL library functions EVP_VerifyFinal()
and DSA_do_verify() were not checked properly.
Impact:
It is theoretically possible to spoof answers returned from
zones using the DNSKEY algorithms DSA (3) and NSEC3DSA (6).
Workaround:
BIND 9.3, 9.4, 9.5 and 9.6:
Disable the affected algorithms in named.conf. This
will cause answers from zones signed only with DSA (3)
and/or NSEC3DSA (6) to be treated as insecure.
BIND 9.3, 9.4, 9.5:
disable-algorithms . { DSA; };
BIND 9.6:
disable-algorithms . { DSA; NSEC3DSA; };
Fix:
Upgrade to 9.3.6-P1, 9.4.3-P1, 9.5.1-P1, 9.6.0-P1.
There are no fixes planned for BIND 9.1 or BIND 9.2, as those
releases do not implement the current DNSSEC protocol.
Questions should be addressed to bind9-bugs.
CVE: CVE-2009-0025
Also see CVE-2008-5077 for the corresponding OpenSSL issue
Revision History:
2009-01-05 Initial pre-release text
2009-01-07 Public release with corrected CVE
bind-9.5.1-1.P1.fc10 has been submitted as an update for Fedora 10. http://admin.fedoraproject.org/updates/bind-9.5.1-1.P1.fc10 bind-9.5.1-1.P1.fc9 has been submitted as an update for Fedora 9. http://admin.fedoraproject.org/updates/bind-9.5.1-1.P1.fc9 bind-9.5.1-1.P1.fc9 has been pushed to the Fedora 9 stable repository. If problems still persist, please make note of it in this bug report. bind-9.5.1-1.P1.fc10 has been pushed to the Fedora 10 stable repository. If problems still persist, please make note of it in this bug report. |