BIND vulnerability

[Patrik Wallström]

Binary package hint: bind9

Haven't seen any indications of that you have seen this update from ISC...

http://www.isc.org/sw/bind/bind9.3.php#security

Please update BIND9 immediately.

[Ondřej Surý (ondrej)]

Version(s): 9.3.2 and prior versions
Description: A vulnerability was reported in BIND. A remote user can
cause denial of service conditions.

A remote user (DNS server) can send specially crafted RRset responses in
return to a recursive SIG query to cause the requesting named service to
crash [CVE-2006-4095].

A remote user can also send specially crafted queries to trigger an
INSIST failure and cause the requesting service(s) to crash [CVE-2006-4096].
Impact: A remote user can cause the target named service to crash.
Solution: The vendor has issued fixed versions (9.3.2-P1, 9.2.7, and
9.2.6-P1), available at: http://www.isc.org/sw/bind/

[Martin Pitt (pitti)]

Don't worry, such things are on my radar, update is in progress.

[Martin Pitt (pitti)]

Fixed in edgy, pending build and publish in stables.

[Martin Pitt (pitti)]

Fixed stables in USN-343-1.