Date: Fri, 12 Apr 2002 16:46:08 -0700
From: security@caldera.com
To: bugtraq@securityfocus.com, announce@lists.caldera.com,
Subject: Security Update: [CSSA-2002-SCO.16] UnixWare 7.1.1 : Multiple Vulnerabilities in BIND
--/04w6evG8XlLl3ft
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
To: bugtraq@securityfocus.com announce@lists.caldera.com scoannmod@xenitec.on.ca
______________________________________________________________________________
Caldera International, Inc. Security Advisory
Subject: UnixWare 7.1.1 : Multiple Vulnerabilities in BIND
Advisory number: CSSA-2002-SCO.16
Issue date: 2002 April 12
Cross reference:
______________________________________________________________________________
1. Problem Description
This patch corrects several problems in earlier versions of
BIND Version 8 which can result in security vulnerabilities of
varying levels of severity. These vulnerabilities are
described in CERT Advisory CA-2001-02. It is strongly
recommended that users of BIND Version 8 upgrade to BIND
Version 8.2.3-REL.
2. Vulnerable Supported Versions
System Files
----------------------------------------------------------------------
UnixWare 7.1.1 /usr/lib/nslookup.help
/usr/sbin/addr
/usr/sbin/dig
/usr/sbin/dnskeygen
/usr/sbin/dnsquery
/usr/sbin/host
/usr/sbin/in.named
/usr/sbin/irpd
/usr/sbin/mkservdb
/usr/sbin/named-bootconf
/usr/sbin/named-xfer
/usr/sbin/ndc
/usr/sbin/nslookup
/usr/sbin/nsupdate
3. Solution
The proper solution is to install the latest packages.
4. UnixWare 7.1.1
4.1 Location of Fixed Binaries
ftp://stage.caldera.com/pub/security/unixware/CSSA-2002-SCO.16
4.2 Verification
MD5 (ptf7705a.pkg.Z) = a1aaccb7a523c241c9380c7ea97d3398
md5 is available for download from
ftp://stage.caldera.com/pub/security/tools/
4.3 Installing Fixed Binaries
Upgrade the affected binaries with the following commands:
Download ptf7705a.pkg.Z to the /var/spool/pkg directory
# uncompress /var/spool/pkg/ptf7705a.pkg.Z
# pkgadd -d /var/spool/pkg/ptf7705a.pkg
5. References
Specific references for this advisory:
http://www.cert.org/advisories/CA-2001-02.html
Caldera UNIX security resources:
http://stage.caldera.com/support/security/
Caldera OpenLinux security resources:
http://www.caldera.com/support/security/index.html
This security fix closes Caldera incidents sr379321, fz515683,
erg711601.
6. Disclaimer
Caldera International, Inc. is not responsible for the misuse
of any of the information we provide on this website and/or
through our security advisories. Our advisories are a service
to our customers intended to promote secure installation and
use of Caldera products.
______________________________________________________________________________
--/04w6evG8XlLl3ft
Content-Type: application/pgp-signature
Content-Disposition: inline
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.6 (SCO_SV)
Comment: For info see http://www.gnupg.org
iEUEARECAAYFAjy3ccAACgkQaqoBO7ipriE+OACY9yGPftT+qBk4+gHbz2UrrybL
UQCfbdOhsUD6k8NeFYGhiE1RroztheU=
=GhAn
-----END PGP SIGNATURE-----
--/04w6evG8XlLl3ft--
