Reported January 29, 2001, by
CERT.
VERSIONS AFFECTED
DESCRIPTION
Multiple
vulnerabilities have been discovered in Internet Software Consortium (ISC)
BIND versions 4 and 8. In the first vulnerability, in BIND 8, a
remote buffer overflow can let an attacker execute arbitrary code without
having control over a DNS server. The second vulnerability, in BIND 4, is
also a buffer overflow that requires the attacker to have control over a
DNS server to execute arbitrary code. In the third vulnerability, also in
BIND 4, an attacker can use a format string issue to launch arbitrary
commands.
VENDOR RESPONSE
ISC
is aware of these issues and has released patches. BIND 4.9.8 and
8.2.3 address the vulnerabilities.
CREDIT
Discovered by Covert
Labs. |