Gave CVE-2009-0025 to ISC for their advisory.
Now public, removing embargo: https://www.isc.org/node/373
nternet Systems Consortium Security Advisory. BIND: EVP_VerifyFinal() and DSA_do_verify() return checks. 7 January 2009 Versions affected: BIND 9.0 (all versions) BIND 9.1 (all versions) BIND 9.2 (all versions) BIND 9.3.0, 9.3.1, 9.3.2, 9.3.3, 9.3.4, 9.3.5, 9.3.6 BIND 9.4.0, 9.4.1, 9.4.2, 9.4.3 BIND 9.5.0, 9.5.1 BIND 9.6.0 Severity: Low. Description: Return values from OpenSSL library functions EVP_VerifyFinal() and DSA_do_verify() were not checked properly. Impact: It is theoretically possible to spoof answers returned from zones using the DNSKEY algorithms DSA (3) and NSEC3DSA (6). Workaround: BIND 9.3, 9.4, 9.5 and 9.6: Disable the affected algorithms in named.conf. This will cause answers from zones signed only with DSA (3) and/or NSEC3DSA (6) to be treated as insecure. BIND 9.3, 9.4, 9.5: disable-algorithms . { DSA; }; BIND 9.6: disable-algorithms . { DSA; NSEC3DSA; }; Fix: Upgrade to 9.3.6-P1, 9.4.3-P1, 9.5.1-P1, 9.6.0-P1. There are no fixes planned for BIND 9.1 or BIND 9.2, as those releases do not implement the current DNSSEC protocol. Questions should be addressed to bind9-bugs. CVE: CVE-2009-0025 Also see CVE-2008-5077 for the corresponding OpenSSL issue Revision History: 2009-01-05 Initial pre-release text 2009-01-07 Public release with corrected CVE
bind-9.5.1-1.P1.fc10 has been submitted as an update for Fedora 10. http://admin.fedoraproject.org/updates/bind-9.5.1-1.P1.fc10
bind-9.5.1-1.P1.fc9 has been submitted as an update for Fedora 9. http://admin.fedoraproject.org/updates/bind-9.5.1-1.P1.fc9
bind-9.5.1-1.P1.fc9 has been pushed to the Fedora 9 stable repository. If problems still persist, please make note of it in this bug report.
bind-9.5.1-1.P1.fc10 has been pushed to the Fedora 10 stable repository. If problems still persist, please make note of it in this bug report.
https://www.redhat.com/security/data/cve/CVE-2009-0025.html