Synopsis

Important: bind security and bug fix update

Type/Severity

Security Advisory: Important

Topic

An update for bind is now available for Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating correctly.

Security Fix(es):

• A flaw was found in the way BIND handled TSIG authentication for dynamic updates. A remote attacker able to communicate with an authoritative BIND server could use this flaw to manipulate the contents of a zone, by forging a valid TSIG or SIG(0) signature for a dynamic update request. (CVE-2017-3143)
  
• A flaw was found in the way BIND handled TSIG authentication of AXFR requests. A remote attacker, able to communicate with an authoritative BIND server, could use this flaw to view the entire contents of a zone by sending a specially constructed request packet. (CVE-2017-3142)
  

Red Hat would like to thank Internet Systems Consortium for reporting these issues. Upstream acknowledges Clement Berthaux (Synacktiv) as the original reporter of these issues.

Bug Fix(es):

• ICANN is planning to perform a Root Zone DNSSEC Key Signing Key (KSK) rollover during October 2017. Maintaining an up-to-date KSK, by adding the new root zone KSK, is essential for ensuring that validating DNS resolvers continue to function following the rollover. (BZ#1458234)

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, the BIND daemon (named) will be restarted automatically.

Affected Products

• Red Hat Enterprise Linux Server 6 x86_64
• Red Hat Enterprise Linux Server 6 i386
• Red Hat Enterprise Linux Workstation 6 x86_64
• Red Hat Enterprise Linux Workstation 6 i386
• Red Hat Enterprise Linux Desktop 6 x86_64
• Red Hat Enterprise Linux Desktop 6 i386
• Red Hat Enterprise Linux for IBM z Systems 6 s390x
• Red Hat Enterprise Linux for Power, big endian 6 ppc64
• Red Hat Enterprise Linux for Scientific Computing 6 x86_64

Fixes

• BZ - 1466189 - CVE-2017-3142 bind: An error in TSIG authentication can permit unauthorized zone transfers
• BZ - 1466193 - CVE-2017-3143 bind: An error in TSIG authentication can permit unauthorized dynamic updates

CVEs

• CVE-2017-3142
• CVE-2017-3143

References

• https://access.redhat.com/security/updates/classification/#important
• https://kb.isc.org/article/AA-01503
• https://kb.isc.org/article/AA-01504

Red Hat Enterprise Linux Server 6

SRPM
bind-9.8.2-0.62.rc1.el6_9.4.src.rpm	SHA-256: 75c46a57eae91e43f5be6690f759754b5e213623153e9c3fd58b869bc2ca5ca6
x86_64
bind-9.8.2-0.62.rc1.el6_9.4.x86_64.rpm	SHA-256: b48219cd4ad5c9f4a30b4b8a0e886bfbb4e9ddd2abf6754e212c3b44a91cea23
bind-chroot-9.8.2-0.62.rc1.el6_9.4.x86_64.rpm	SHA-256: 0d7ae1be762d79e75539e029c5aadd1fd22b1d73abfb6f5b9ca554b7c9e1b019
bind-debuginfo-9.8.2-0.62.rc1.el6_9.4.i686.rpm	SHA-256: 2eda3196b09a0a80388e17bff3b7bc0f5dd69ccf34eb286c099b37bf12b085bb
bind-debuginfo-9.8.2-0.62.rc1.el6_9.4.i686.rpm	SHA-256: 2eda3196b09a0a80388e17bff3b7bc0f5dd69ccf34eb286c099b37bf12b085bb
bind-debuginfo-9.8.2-0.62.rc1.el6_9.4.x86_64.rpm	SHA-256: b38233730c6380bf0d3b4c992cc2cb75dc4d282c04bed755dd60edcd219f107d
bind-debuginfo-9.8.2-0.62.rc1.el6_9.4.x86_64.rpm	SHA-256: b38233730c6380bf0d3b4c992cc2cb75dc4d282c04bed755dd60edcd219f107d
bind-devel-9.8.2-0.62.rc1.el6_9.4.i686.rpm	SHA-256: 6f6f7d9265eaaf1c9ee7df9e4d65735d9fb6849e1370db862b1a17a53f10215d
bind-devel-9.8.2-0.62.rc1.el6_9.4.x86_64.rpm	SHA-256: 8f9e5f25a44dfc7b5dd5f37b93e79d47ded27ae3b9a5a2acb0ca42ad4d02fff9
bind-libs-9.8.2-0.62.rc1.el6_9.4.i686.rpm	SHA-256: af5164724bca3438f5290f44720efa880275223dd8d2d6af377e82fe11eb354c
bind-libs-9.8.2-0.62.rc1.el6_9.4.x86_64.rpm	SHA-256: 21b6249b47e8a760e42dab10de4fc3f1c4013bd6b3a5efff113f4724723a2b2a
bind-sdb-9.8.2-0.62.rc1.el6_9.4.x86_64.rpm	SHA-256: f419a2bf5f708207f4d71ef64361310167b0c3a68fc59c884cd070c204cde354
bind-utils-9.8.2-0.62.rc1.el6_9.4.x86_64.rpm	SHA-256: cdd90cbabb554d7c11b50aaa6759d1ed4e84344b7d8303d5dd30e1fa41452b19
i386
bind-9.8.2-0.62.rc1.el6_9.4.i686.rpm	SHA-256: 34ed64246f1932c2483fe5f3e38861e9bcf89d0573aad948a6acd8263d86b79a
bind-chroot-9.8.2-0.62.rc1.el6_9.4.i686.rpm	SHA-256: 473d93973c681f817fac6e64ec58153e3c34dcc8312e782f64a84d13514571c8
bind-debuginfo-9.8.2-0.62.rc1.el6_9.4.i686.rpm	SHA-256: 2eda3196b09a0a80388e17bff3b7bc0f5dd69ccf34eb286c099b37bf12b085bb
bind-debuginfo-9.8.2-0.62.rc1.el6_9.4.i686.rpm	SHA-256: 2eda3196b09a0a80388e17bff3b7bc0f5dd69ccf34eb286c099b37bf12b085bb
bind-devel-9.8.2-0.62.rc1.el6_9.4.i686.rpm	SHA-256: 6f6f7d9265eaaf1c9ee7df9e4d65735d9fb6849e1370db862b1a17a53f10215d
bind-libs-9.8.2-0.62.rc1.el6_9.4.i686.rpm	SHA-256: af5164724bca3438f5290f44720efa880275223dd8d2d6af377e82fe11eb354c
bind-sdb-9.8.2-0.62.rc1.el6_9.4.i686.rpm	SHA-256: be94c31cbf86a4c24afc588e6ee9db68ed0ae3afd8d2cbd7a049225fb4b3bdf0
bind-utils-9.8.2-0.62.rc1.el6_9.4.i686.rpm	SHA-256: df3924ba2dbf4c0d2704dcf48339e9da267f8e98ee8b5c2263f3ba1fc79808db

Red Hat Enterprise Linux Workstation 6

SRPM
bind-9.8.2-0.62.rc1.el6_9.4.src.rpm	SHA-256: 75c46a57eae91e43f5be6690f759754b5e213623153e9c3fd58b869bc2ca5ca6
x86_64
bind-9.8.2-0.62.rc1.el6_9.4.x86_64.rpm	SHA-256: b48219cd4ad5c9f4a30b4b8a0e886bfbb4e9ddd2abf6754e212c3b44a91cea23
bind-chroot-9.8.2-0.62.rc1.el6_9.4.x86_64.rpm	SHA-256: 0d7ae1be762d79e75539e029c5aadd1fd22b1d73abfb6f5b9ca554b7c9e1b019
bind-debuginfo-9.8.2-0.62.rc1.el6_9.4.i686.rpm	SHA-256: 2eda3196b09a0a80388e17bff3b7bc0f5dd69ccf34eb286c099b37bf12b085bb
bind-debuginfo-9.8.2-0.62.rc1.el6_9.4.i686.rpm	SHA-256: 2eda3196b09a0a80388e17bff3b7bc0f5dd69ccf34eb286c099b37bf12b085bb
bind-debuginfo-9.8.2-0.62.rc1.el6_9.4.x86_64.rpm	SHA-256: b38233730c6380bf0d3b4c992cc2cb75dc4d282c04bed755dd60edcd219f107d
bind-debuginfo-9.8.2-0.62.rc1.el6_9.4.x86_64.rpm	SHA-256: b38233730c6380bf0d3b4c992cc2cb75dc4d282c04bed755dd60edcd219f107d
bind-devel-9.8.2-0.62.rc1.el6_9.4.i686.rpm	SHA-256: 6f6f7d9265eaaf1c9ee7df9e4d65735d9fb6849e1370db862b1a17a53f10215d
bind-devel-9.8.2-0.62.rc1.el6_9.4.x86_64.rpm	SHA-256: 8f9e5f25a44dfc7b5dd5f37b93e79d47ded27ae3b9a5a2acb0ca42ad4d02fff9
bind-libs-9.8.2-0.62.rc1.el6_9.4.i686.rpm	SHA-256: af5164724bca3438f5290f44720efa880275223dd8d2d6af377e82fe11eb354c
bind-libs-9.8.2-0.62.rc1.el6_9.4.x86_64.rpm	SHA-256: 21b6249b47e8a760e42dab10de4fc3f1c4013bd6b3a5efff113f4724723a2b2a
bind-sdb-9.8.2-0.62.rc1.el6_9.4.x86_64.rpm	SHA-256: f419a2bf5f708207f4d71ef64361310167b0c3a68fc59c884cd070c204cde354
bind-utils-9.8.2-0.62.rc1.el6_9.4.x86_64.rpm	SHA-256: cdd90cbabb554d7c11b50aaa6759d1ed4e84344b7d8303d5dd30e1fa41452b19
i386
bind-9.8.2-0.62.rc1.el6_9.4.i686.rpm	SHA-256: 34ed64246f1932c2483fe5f3e38861e9bcf89d0573aad948a6acd8263d86b79a
bind-chroot-9.8.2-0.62.rc1.el6_9.4.i686.rpm	SHA-256: 473d93973c681f817fac6e64ec58153e3c34dcc8312e782f64a84d13514571c8
bind-debuginfo-9.8.2-0.62.rc1.el6_9.4.i686.rpm	SHA-256: 2eda3196b09a0a80388e17bff3b7bc0f5dd69ccf34eb286c099b37bf12b085bb
bind-debuginfo-9.8.2-0.62.rc1.el6_9.4.i686.rpm	SHA-256: 2eda3196b09a0a80388e17bff3b7bc0f5dd69ccf34eb286c099b37bf12b085bb
bind-devel-9.8.2-0.62.rc1.el6_9.4.i686.rpm	SHA-256: 6f6f7d9265eaaf1c9ee7df9e4d65735d9fb6849e1370db862b1a17a53f10215d
bind-libs-9.8.2-0.62.rc1.el6_9.4.i686.rpm	SHA-256: af5164724bca3438f5290f44720efa880275223dd8d2d6af377e82fe11eb354c
bind-sdb-9.8.2-0.62.rc1.el6_9.4.i686.rpm	SHA-256: be94c31cbf86a4c24afc588e6ee9db68ed0ae3afd8d2cbd7a049225fb4b3bdf0
bind-utils-9.8.2-0.62.rc1.el6_9.4.i686.rpm	SHA-256: df3924ba2dbf4c0d2704dcf48339e9da267f8e98ee8b5c2263f3ba1fc79808db

Red Hat Enterprise Linux Desktop 6

SRPM
bind-9.8.2-0.62.rc1.el6_9.4.src.rpm	SHA-256: 75c46a57eae91e43f5be6690f759754b5e213623153e9c3fd58b869bc2ca5ca6
x86_64
bind-9.8.2-0.62.rc1.el6_9.4.x86_64.rpm	SHA-256: b48219cd4ad5c9f4a30b4b8a0e886bfbb4e9ddd2abf6754e212c3b44a91cea23
bind-chroot-9.8.2-0.62.rc1.el6_9.4.x86_64.rpm	SHA-256: 0d7ae1be762d79e75539e029c5aadd1fd22b1d73abfb6f5b9ca554b7c9e1b019
bind-debuginfo-9.8.2-0.62.rc1.el6_9.4.i686.rpm	SHA-256: 2eda3196b09a0a80388e17bff3b7bc0f5dd69ccf34eb286c099b37bf12b085bb
bind-debuginfo-9.8.2-0.62.rc1.el6_9.4.i686.rpm	SHA-256: 2eda3196b09a0a80388e17bff3b7bc0f5dd69ccf34eb286c099b37bf12b085bb
bind-debuginfo-9.8.2-0.62.rc1.el6_9.4.x86_64.rpm	SHA-256: b38233730c6380bf0d3b4c992cc2cb75dc4d282c04bed755dd60edcd219f107d
bind-debuginfo-9.8.2-0.62.rc1.el6_9.4.x86_64.rpm	SHA-256: b38233730c6380bf0d3b4c992cc2cb75dc4d282c04bed755dd60edcd219f107d
bind-devel-9.8.2-0.62.rc1.el6_9.4.i686.rpm	SHA-256: 6f6f7d9265eaaf1c9ee7df9e4d65735d9fb6849e1370db862b1a17a53f10215d
bind-devel-9.8.2-0.62.rc1.el6_9.4.x86_64.rpm	SHA-256: 8f9e5f25a44dfc7b5dd5f37b93e79d47ded27ae3b9a5a2acb0ca42ad4d02fff9
bind-libs-9.8.2-0.62.rc1.el6_9.4.i686.rpm	SHA-256: af5164724bca3438f5290f44720efa880275223dd8d2d6af377e82fe11eb354c
bind-libs-9.8.2-0.62.rc1.el6_9.4.x86_64.rpm	SHA-256: 21b6249b47e8a760e42dab10de4fc3f1c4013bd6b3a5efff113f4724723a2b2a
bind-sdb-9.8.2-0.62.rc1.el6_9.4.x86_64.rpm	SHA-256: f419a2bf5f708207f4d71ef64361310167b0c3a68fc59c884cd070c204cde354
bind-utils-9.8.2-0.62.rc1.el6_9.4.x86_64.rpm	SHA-256: cdd90cbabb554d7c11b50aaa6759d1ed4e84344b7d8303d5dd30e1fa41452b19
i386
bind-9.8.2-0.62.rc1.el6_9.4.i686.rpm	SHA-256: 34ed64246f1932c2483fe5f3e38861e9bcf89d0573aad948a6acd8263d86b79a
bind-chroot-9.8.2-0.62.rc1.el6_9.4.i686.rpm	SHA-256: 473d93973c681f817fac6e64ec58153e3c34dcc8312e782f64a84d13514571c8
bind-debuginfo-9.8.2-0.62.rc1.el6_9.4.i686.rpm	SHA-256: 2eda3196b09a0a80388e17bff3b7bc0f5dd69ccf34eb286c099b37bf12b085bb
bind-debuginfo-9.8.2-0.62.rc1.el6_9.4.i686.rpm	SHA-256: 2eda3196b09a0a80388e17bff3b7bc0f5dd69ccf34eb286c099b37bf12b085bb
bind-devel-9.8.2-0.62.rc1.el6_9.4.i686.rpm	SHA-256: 6f6f7d9265eaaf1c9ee7df9e4d65735d9fb6849e1370db862b1a17a53f10215d
bind-libs-9.8.2-0.62.rc1.el6_9.4.i686.rpm	SHA-256: af5164724bca3438f5290f44720efa880275223dd8d2d6af377e82fe11eb354c
bind-sdb-9.8.2-0.62.rc1.el6_9.4.i686.rpm	SHA-256: be94c31cbf86a4c24afc588e6ee9db68ed0ae3afd8d2cbd7a049225fb4b3bdf0
bind-utils-9.8.2-0.62.rc1.el6_9.4.i686.rpm	SHA-256: df3924ba2dbf4c0d2704dcf48339e9da267f8e98ee8b5c2263f3ba1fc79808db

Red Hat Enterprise Linux for IBM z Systems 6

SRPM
bind-9.8.2-0.62.rc1.el6_9.4.src.rpm	SHA-256: 75c46a57eae91e43f5be6690f759754b5e213623153e9c3fd58b869bc2ca5ca6
s390x
bind-9.8.2-0.62.rc1.el6_9.4.s390x.rpm	SHA-256: ff2bfd975ab1a00f2acc5e119ff67210a55b7a888333d18fbd8e05d3e7d25058
bind-chroot-9.8.2-0.62.rc1.el6_9.4.s390x.rpm	SHA-256: 00ad1f2c8df6d97568a2d19aee8b0adaa241b756da5e98f7232af70e84022050
bind-debuginfo-9.8.2-0.62.rc1.el6_9.4.s390.rpm	SHA-256: e93360aa50dc84fccf10dd15e233bc2c46fd6a545e0ee29eaddf3f3dccc5835a
bind-debuginfo-9.8.2-0.62.rc1.el6_9.4.s390.rpm	SHA-256: e93360aa50dc84fccf10dd15e233bc2c46fd6a545e0ee29eaddf3f3dccc5835a
bind-debuginfo-9.8.2-0.62.rc1.el6_9.4.s390x.rpm	SHA-256: d4e907d48f3e6e68b138b04c99af0ff059f77663f5302b86b5b1acceb3207b59
bind-debuginfo-9.8.2-0.62.rc1.el6_9.4.s390x.rpm	SHA-256: d4e907d48f3e6e68b138b04c99af0ff059f77663f5302b86b5b1acceb3207b59
bind-devel-9.8.2-0.62.rc1.el6_9.4.s390.rpm	SHA-256: 2fbdf155a19b21c68e18377a4fb1ce65de719f5a32be18f020274b902380ca65
bind-devel-9.8.2-0.62.rc1.el6_9.4.s390x.rpm	SHA-256: 9d78dc46cf34523de6bcb752031d8bd48851115e76dd6c26f451085cc5d5aae7
bind-libs-9.8.2-0.62.rc1.el6_9.4.s390.rpm	SHA-256: 34036616a955eeba124d085b739286ceb9d361e1a33731d174f6afa1f7856cba
bind-libs-9.8.2-0.62.rc1.el6_9.4.s390x.rpm	SHA-256: da1821f9ff3723adc790886e100e80ce867b4f1fa679771ba82b51b2d303ac46
bind-sdb-9.8.2-0.62.rc1.el6_9.4.s390x.rpm	SHA-256: 07185fb35b9d053d26bbff643b31cfa4609dbea3281066c45c872de138cbd058
bind-utils-9.8.2-0.62.rc1.el6_9.4.s390x.rpm	SHA-256: e256c7f090382c46cdd4810d93ab94ce1da6c54cf7047f31a72bd11bcf056b6d

Red Hat Enterprise Linux for Power, big endian 6

SRPM
bind-9.8.2-0.62.rc1.el6_9.4.src.rpm	SHA-256: 75c46a57eae91e43f5be6690f759754b5e213623153e9c3fd58b869bc2ca5ca6
ppc64
bind-9.8.2-0.62.rc1.el6_9.4.ppc64.rpm	SHA-256: 786cbe3ebaea1a23b253419fa5fef3aebc192b16a717f8727e65e60c9d872486
bind-chroot-9.8.2-0.62.rc1.el6_9.4.ppc64.rpm	SHA-256: 2502bcc89ade33c0707e41c171f305ad659f9ac6deb2d11c8fb0aa625eb31ef1
bind-debuginfo-9.8.2-0.62.rc1.el6_9.4.ppc.rpm	SHA-256: d16634403a063f447c8fa9d2afb26fa32e3015de36deeb85d6261b6edce1b07d
bind-debuginfo-9.8.2-0.62.rc1.el6_9.4.ppc.rpm	SHA-256: d16634403a063f447c8fa9d2afb26fa32e3015de36deeb85d6261b6edce1b07d
bind-debuginfo-9.8.2-0.62.rc1.el6_9.4.ppc64.rpm	SHA-256: 6d2b7db62a5d03d752601a5b04608d926c580a0b29a48546774672a0ae2d994d
bind-debuginfo-9.8.2-0.62.rc1.el6_9.4.ppc64.rpm	SHA-256: 6d2b7db62a5d03d752601a5b04608d926c580a0b29a48546774672a0ae2d994d
bind-devel-9.8.2-0.62.rc1.el6_9.4.ppc.rpm	SHA-256: 81d263c3554dbd8ea73a59680a50366166dcb1ab9baf1620c4cc9fc362f0065a
bind-devel-9.8.2-0.62.rc1.el6_9.4.ppc64.rpm	SHA-256: c7bd692d5b0c65c290b24b911015d34d9b23441ec67202407053c822a0aac1d1
bind-libs-9.8.2-0.62.rc1.el6_9.4.ppc.rpm	SHA-256: d9da3e64f85cee6f7038740c878dda49b32d9ae708d64e3b9c70af2928a08ab7
bind-libs-9.8.2-0.62.rc1.el6_9.4.ppc64.rpm	SHA-256: 6096ef751d287df2e45dbae2c31df080d57caba70667009f2632f8940a0fb02e
bind-sdb-9.8.2-0.62.rc1.el6_9.4.ppc64.rpm	SHA-256: 408c66c5f98cbb890f6a0648e927b8d38843f2d3a3a1314a8c40830e2da1bd43
bind-utils-9.8.2-0.62.rc1.el6_9.4.ppc64.rpm	SHA-256: 344270080c0afee55c34a098b33464ae935a05f2ca77940ea20eafe2c2952c4a

Red Hat Enterprise Linux for Scientific Computing 6

SRPM
bind-9.8.2-0.62.rc1.el6_9.4.src.rpm	SHA-256: 75c46a57eae91e43f5be6690f759754b5e213623153e9c3fd58b869bc2ca5ca6
x86_64
bind-9.8.2-0.62.rc1.el6_9.4.x86_64.rpm	SHA-256: b48219cd4ad5c9f4a30b4b8a0e886bfbb4e9ddd2abf6754e212c3b44a91cea23
bind-chroot-9.8.2-0.62.rc1.el6_9.4.x86_64.rpm	SHA-256: 0d7ae1be762d79e75539e029c5aadd1fd22b1d73abfb6f5b9ca554b7c9e1b019
bind-debuginfo-9.8.2-0.62.rc1.el6_9.4.i686.rpm	SHA-256: 2eda3196b09a0a80388e17bff3b7bc0f5dd69ccf34eb286c099b37bf12b085bb
bind-debuginfo-9.8.2-0.62.rc1.el6_9.4.i686.rpm	SHA-256: 2eda3196b09a0a80388e17bff3b7bc0f5dd69ccf34eb286c099b37bf12b085bb
bind-debuginfo-9.8.2-0.62.rc1.el6_9.4.x86_64.rpm	SHA-256: b38233730c6380bf0d3b4c992cc2cb75dc4d282c04bed755dd60edcd219f107d
bind-debuginfo-9.8.2-0.62.rc1.el6_9.4.x86_64.rpm	SHA-256: b38233730c6380bf0d3b4c992cc2cb75dc4d282c04bed755dd60edcd219f107d
bind-devel-9.8.2-0.62.rc1.el6_9.4.i686.rpm	SHA-256: 6f6f7d9265eaaf1c9ee7df9e4d65735d9fb6849e1370db862b1a17a53f10215d
bind-devel-9.8.2-0.62.rc1.el6_9.4.x86_64.rpm	SHA-256: 8f9e5f25a44dfc7b5dd5f37b93e79d47ded27ae3b9a5a2acb0ca42ad4d02fff9
bind-libs-9.8.2-0.62.rc1.el6_9.4.i686.rpm	SHA-256: af5164724bca3438f5290f44720efa880275223dd8d2d6af377e82fe11eb354c
bind-libs-9.8.2-0.62.rc1.el6_9.4.x86_64.rpm	SHA-256: 21b6249b47e8a760e42dab10de4fc3f1c4013bd6b3a5efff113f4724723a2b2a
bind-sdb-9.8.2-0.62.rc1.el6_9.4.x86_64.rpm	SHA-256: f419a2bf5f708207f4d71ef64361310167b0c3a68fc59c884cd070c204cde354
bind-utils-9.8.2-0.62.rc1.el6_9.4.x86_64.rpm	SHA-256: cdd90cbabb554d7c11b50aaa6759d1ed4e84344b7d8303d5dd30e1fa41452b19