Technical Description

A vulnerability has been identified in Mandriva, which could be exploited by attackers to bypass security restrictions. This issue is caused by an error in BIND. For additional information, see : VUPEN/ADV-2009-0043

Affected Products

Mandriva Linux 2008.0
Mandriva Linux 2008.1
Mandriva Linux 2009.0
Mandriva Corporate 3.0
Mandriva Corporate 4.0
Mandriva Multi Network Firewall 2.0

Solution

Upgrade the affected packages :

Mandriva Linux 2008.0:
1995bb55159c0b12b434c57b7c32a305 2008.0/i586/bind-9.4.2-1.3mdv2008.0.i586.rpm
7942542098d37b1be3b3cc45ed824a3a 2008.0/i586/bind-devel-9.4.2-1.3mdv2008.0.i586.rpm
88a21619673fe9b541579f287bee4ca4 2008.0/i586/bind-utils-9.4.2-1.3mdv2008.0.i586.rpm
4a8ba040ab7d3fb9c710bcfeb7601ff9 2008.0/SRPMS/bind-9.4.2-1.3mdv2008.0.src.rpm

Mandriva Linux 2008.0/X86_64:
45a0c84471cbf3c31da2f51b07e5dcdd 2008.0/x86_64/bind-9.4.2-1.3mdv2008.0.x86_64.rpm
83e3b9c4af4789fc9156887373e190ad 2008.0/x86_64/bind-devel-9.4.2-1.3mdv2008.0.x86_64.rpm
a1d910a92913bb809e976963335d3ec9 2008.0/x86_64/bind-utils-9.4.2-1.3mdv2008.0.x86_64.rpm
4a8ba040ab7d3fb9c710bcfeb7601ff9 2008.0/SRPMS/bind-9.4.2-1.3mdv2008.0.src.rpm

Mandriva Linux 2008.1:
b1d620b91aeeeda30eddde159f458aa9 2008.1/i586/bind-9.5.0-3.3mdv2008.1.i586.rpm
6266f0be18de71d9d9674f4773fbc720 2008.1/i586/bind-devel-9.5.0-3.3mdv2008.1.i586.rpm
a08062c8bd8ce1395525d7775eaefc71 2008.1/i586/bind-doc-9.5.0-3.3mdv2008.1.i586.rpm
c0aa3cf70be87286222ddcec64933ddd 2008.1/i586/bind-utils-9.5.0-3.3mdv2008.1.i586.rpm
209ce678e0643ba458c59b279326ca57 2008.1/SRPMS/bind-9.5.0-3.3mdv2008.1.src.rpm

Mandriva Linux 2008.1/X86_64:
46af49a5a461d6da93441fcfc46f9324 2008.1/x86_64/bind-9.5.0-3.3mdv2008.1.x86_64.rpm
ca7a532053219a09a57f6ec7203d1ced 2008.1/x86_64/bind-devel-9.5.0-3.3mdv2008.1.x86_64.rpm
7cea9c996e69430c51de22e3e0bff929 2008.1/x86_64/bind-doc-9.5.0-3.3mdv2008.1.x86_64.rpm
fe5816ec0c790a0bef2ddb1df281af12 2008.1/x86_64/bind-utils-9.5.0-3.3mdv2008.1.x86_64.rpm
209ce678e0643ba458c59b279326ca57 2008.1/SRPMS/bind-9.5.0-3.3mdv2008.1.src.rpm

Mandriva Linux 2009.0:
5da06c9a5d6f211c4dec3ba08e96b436 2009.0/i586/bind-9.5.0-6.3mdv2009.0.i586.rpm
5d44ff32935f2323491a96ac4a01a254 2009.0/i586/bind-devel-9.5.0-6.3mdv2009.0.i586.rpm
9640415878cb94e4d7cb6325ecf3c196 2009.0/i586/bind-doc-9.5.0-6.3mdv2009.0.i586.rpm
69c0964ae640f731b82607059aa86873 2009.0/i586/bind-utils-9.5.0-6.3mdv2009.0.i586.rpm
21042dd8411237227c4cc18eade02d07 2009.0/SRPMS/bind-9.5.0-6.3mdv2009.0.src.rpm

Mandriva Linux 2009.0/X86_64:
6aa7b310659ebc0f2d285aac499966f4 2009.0/x86_64/bind-9.5.0-6.3mdv2009.0.x86_64.rpm
0f4843c929135d38494c155eb5517958 2009.0/x86_64/bind-devel-9.5.0-6.3mdv2009.0.x86_64.rpm
e3398d5b0e877cf6b6a2413e5f9546f4 2009.0/x86_64/bind-doc-9.5.0-6.3mdv2009.0.x86_64.rpm
24a0d8fafe7c210bc85434983cc2eeb1 2009.0/x86_64/bind-utils-9.5.0-6.3mdv2009.0.x86_64.rpm
21042dd8411237227c4cc18eade02d07 2009.0/SRPMS/bind-9.5.0-6.3mdv2009.0.src.rpm

Corporate 3.0:
3c9378a0167e263e83d9105ac7d0566e corporate/3.0/i586/bind-9.2.3-6.7.C30mdk.i586.rpm
fc5c1335f1a85e450d3dd20ed81e621f corporate/3.0/i586/bind-devel-9.2.3-6.7.C30mdk.i586.rpm
8e1a0a718eb51de4e70b9287266b0c75 corporate/3.0/i586/bind-utils-9.2.3-6.7.C30mdk.i586.rpm
c7e931c9818e0731ed32c12e7e9011b4 corporate/3.0/SRPMS/bind-9.2.3-6.7.C30mdk.src.rpm

Corporate 3.0/X86_64:
cd4653ae14e91c5844d87321ea237c7c corporate/3.0/x86_64/bind-9.2.3-6.7.C30mdk.x86_64.rpm
708b8bbdb1fa1d2150c8cb5208bf8d24 corporate/3.0/x86_64/bind-devel-9.2.3-6.7.C30mdk.x86_64.rpm
7a3cc2cbe29c9c8397bdcdcd63b543fc corporate/3.0/x86_64/bind-utils-9.2.3-6.7.C30mdk.x86_64.rpm
c7e931c9818e0731ed32c12e7e9011b4 corporate/3.0/SRPMS/bind-9.2.3-6.7.C30mdk.src.rpm

Corporate 4.0:
91ee1fc0fa2836df33aad4c3ee72ab8d corporate/4.0/i586/bind-9.3.5-0.6.20060mlcs4.i586.rpm
9687a3135e2f364defc1805be357afe5 corporate/4.0/i586/bind-devel-9.3.5-0.6.20060mlcs4.i586.rpm
1796c645d6562c03e75653a8a2de65ab corporate/4.0/i586/bind-utils-9.3.5-0.6.20060mlcs4.i586.rpm
ec3f68ba6cb3085f82d6fe824e80229f corporate/4.0/SRPMS/bind-9.3.5-0.6.20060mlcs4.src.rpm

Corporate 4.0/X86_64:
744a195594365d711938d0e40305f780 corporate/4.0/x86_64/bind-9.3.5-0.6.20060mlcs4.x86_64.rpm
4432e2d80856fa42f7fbb19f1f45e65d corporate/4.0/x86_64/bind-devel-9.3.5-0.6.20060mlcs4.x86_64.rpm
7979fca8fc5e3ed01ac1bd7f36ab32f5 corporate/4.0/x86_64/bind-utils-9.3.5-0.6.20060mlcs4.x86_64.rpm
ec3f68ba6cb3085f82d6fe824e80229f corporate/4.0/SRPMS/bind-9.3.5-0.6.20060mlcs4.src.rpm

Multi Network Firewall 2.0:
96ca05a11155c146b2c7a4a38b0758a8 mnf/2.0/i586/bind-9.2.3-6.7.C30mdk.i586.rpm
483d397793d0fa3c4f10c9115f637fff mnf/2.0/i586/bind-devel-9.2.3-6.7.C30mdk.i586.rpm
174fa247aea0b3a5b5f2ebaeeeda62a0 mnf/2.0/i586/bind-utils-9.2.3-6.7.C30mdk.i586.rpm
169abf8a396dbb7ce2b1ccd1f1d68952 mnf/2.0/SRPMS/bind-9.2.3-6.7.C30mdk.src.rpm

References

http://www.vupen.com/english/advisories/2009/0079
http://lists.mandriva.com/security-announce/2009-01/msg00013.php
http://lists.mandriva.com/security-announce/2009-02/msg00014.php

ChangeLog

2009-01-12 : Initial release
2009-02-17 : Updated Solution

Vulnerability Management

Subscribe to VUPEN VNS and receive real-time e-mail and SMS alerts when new advisories or patches relevant to your systems and network configurations are available.

Feedback

If you have additional information or corrections for this security advisory please submit them via our contact form.