openSUSE Security Update: Security update for bind ______________________________________________________________________________
Announcement ID: openSUSE-SU-2017:1809-1 Rating: important References: #1046554 #1046555 Cross-References: CVE-2017-3142 CVE-2017-3143 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________
An update that fixes two vulnerabilities is now available.
This update for bind fixes the following issues:
- An attacker with the ability to send and receive messages to an authoritative DNS server was able to circumvent TSIG authentication of AXFR requests. A server that relied solely on TSIG keys for protection could be manipulated into (1) providing an AXFR of a zone to an unauthorized recipient and (2) accepting bogus Notify packets. [bsc#1046554, CVE-2017-3142]
- An attacker who with the ability to send and receive messages to an authoritative DNS server and who had knowledge of a valid TSIG key name for the zone and service being targeted was able to manipulate BIND into accepting an unauthorized dynamic update. [bsc#1046555, CVE-2017-3143]
This update was imported from the SUSE:SLE-12-SP1:Update update project.
To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product:
- openSUSE Leap 42.2:
zypper in -t patch openSUSE-2017-783=1
To bring your system up-to-date, use "zypper patch".
- openSUSE Leap 42.2 (i586 x86_64):
bind-9.9.9P1-48.6.1 bind-chrootenv-9.9.9P1-48.6.1 bind-debuginfo-9.9.9P1-48.6.1 bind-debugsource-9.9.9P1-48.6.1 bind-devel-9.9.9P1-48.6.1 bind-libs-9.9.9P1-48.6.1 bind-libs-debuginfo-9.9.9P1-48.6.1 bind-lwresd-9.9.9P1-48.6.1 bind-lwresd-debuginfo-9.9.9P1-48.6.1 bind-utils-9.9.9P1-48.6.1 bind-utils-debuginfo-9.9.9P1-48.6.1
- openSUSE Leap 42.2 (x86_64):
- openSUSE Leap 42.2 (noarch):