Product
Solaris 10 Operating System

Bug Id
6582717

Date of Workaround Release
25-JUL-2007

Date of Resolved Release
22-AUG-2007

Impact

Remote unprivileged users may cause named(1M) to ultimately return incorrect addresses for Internet hosts thereby redirecting end users to unintended hosts and or services.

This issue is also referenced in the following documents:

• CVE-2007-2926 (CERT-US VU#553201) at: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2926
• Internet Systems Consortium Security bulletin at:  http://www.isc.org/sw/bind/bind-security.php

Contributing Factors

This issue can occur in the following releases:

SPARC Platform

• Solaris 10 without patch 119783-05

x86 Platform

• Solaris 10 without patch 119784-05

Note: Solaris 8 and Solaris 9 are not impacted by this issue.

Only systems with the BIND named(1M) service enabled are impacted by this issue. To verify if the DNS service instance is enabled under smf(5), use the svcs(1) command as follows:

    $ svcs -l svc:/network/dns/server:default | grep enabled
    enabled      true

 

Symptoms

There are no reliable symptoms that would indicate the described issue has occurred.

Workaround

There is no workaround.  Please see the Resolution section below.

Resolution

This issue is addressed in the following releases:

SPARC Platform

• Solaris 10 with patch 119783-05 or later

x86 Platform

• Solaris 10 with patch 119784-05 or later

Note: The resolution provides BIND 9.3.4-P1 as provided by the custodians of BIND; the Internet Systems Consortium (ISC).

After the patch has been installed, it is recommended that BIND administrators familiarize themselves with the "/usr/share/doc/bind/migration.txt" document.

Further information on BIND 9.3 is available in the BIND 9.3 Advanced Reference Manual (ARM) available on the ISC web site at:

• http://www.isc.org/sw/bind/arm93/index.php

Modification History
Date: 08-AUG-2007

• Updated Relif/Workaround section

Date: 22-AUG-2007

• State: Resolved
• Updated Contributing Factors, Relief/Workaround, and Resolution sections.

Date: 04-SEP-2007

• Updated Resolution section

References

119783-05
119784-05




Attachments

This solution has no attachment