[pdns-recursor] [CVE-2008-1637] cache poisoning vulnerability

[disabled.user]

Binary package hint: pdns-recursor

References:
DSA-1544-1 (http://www.debian.org/security/2008/dsa-1544)

Quoting:
"Amit Klein discovered that pdns-recursor, a caching DNS resolver, uses a
weak random number generator to create DNS transaction IDs and UDP
source port numbers. As a result, cache poisoning attacks were
simplified."

[William Grant (wgrant)]

The patch is gigantic, and can be found in 3.1.4-1etch1.

[Scott Kitterman (kitterman)]

I'd say better to fix it than not for Hardy before release, so ack from motu-release for Hardy.

[Launchpad Janitor (janitor)]

This bug was fixed in the package pdns-recursor - 3.1.4-6ubuntu1

---------------
pdns-recursor (3.1.4-6ubuntu1) hardy; urgency=low

  * SECURITY UPDATE: cache poisoning via weak random number generator
    (LP: #214980)
    - Merge changes from 3.1.4-1+etch1:
      + debian/patches/predictable-dns-query.dpatch: Use a stronger RNG. Patch
        from Debian.
      + debian/copyright: Add license of new RNG.
    - References:
      + CVE-2008-1637

 -- William Grant <email address hidden> Sun, 20 Apr 2008 11:10:59 +1000

[Hew (hew)]

Ubuntu Edgy Eft is no longer supported, so a SRU will not be issued for this release. Marking Edgy as Won't Fix.

[Hew (hew)]

Ubuntu Feisty Fawn is no longer supported, so a SRU will not be issued for this release. Marking Feisty as Won't Fix.

[Sergio Zanchetta (primes2h)]

The 18 month support period for Gutsy Gibbon 7.10 has reached its end of life -
http://www.ubuntu.com/news/ubuntu-7.10-eol . As a result, we are closing the
Gutsy task.