September 2006

ID: 00601
Ref: 576/2006
Date: 07 September 2006:15:18:43
Version: 1

---

Title: Two OpenPKG Security Advisories: 1. OpenPKG-SA-2006.018 - openssl 2. OpenPKG-SA-2006.019 - bind
Abstract:
Vendors affected: OpenPKG
Operating systems affected: OpenPKG
Applications affected: OpenPKG

---

Title
=====

Two OpenPKG Security Advisories:

1. OpenPKG-SA-2006.018 - openssl

2. OpenPKG-SA-2006.019 - bind

Detail
======

1. According to a vendor security advisory [0], Daniel Bleichenbacher
described a possible attack on PKCS #1 v1.5 signatures which affects
the cryptography and SSL/TLS toolkit OpenSSL [1].

2. Two vulnerabilities were discovered in the DNS server BIND




1.



- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

________________________________________________________________________

OpenPKG Security Advisory The OpenPKG Project
http://www.openpkg.org/security/ http://www.openpkg.org
openpkg-security@openpkg.org openpkg@openpkg.org
OpenPKG-SA-2006.018 06-Sep-2006
________________________________________________________________________

Package: openssl
Vulnerability: signature verification failure
OpenPKG Specific: no

Affected Releases: Affected Packages: Corrected Packages:
OpenPKG CURRENT <= openssl-0.9.8b-20060505 >= openssl-0.9.8c-20060905
OpenPKG 2-STABLE <= openssl-0.9.8b-2.20060622 >= openssl-0.9.8c-2.20060906
OpenPKG 2.5-RELEASE <= openssl-0.9.8a-2.5.1 >= openssl-0.9.8a-2.5.2

Description:
According to a vendor security advisory [0], Daniel Bleichenbacher
described a possible attack on PKCS #1 v1.5 signatures which affects
the cryptography and SSL/TLS toolkit OpenSSL [1].

If an RSA key with exponent 3 is used it may be possible to forge
a PKCS #1 v1.5 signature signed by that key. Implementations may
incorrectly verify the certificate if they are not checking for excess
data in the RSA exponentiation result of the signature. Since there
are CAs using exponent 3 in wide use, and PKCS #1 v1.5 is used in
X.509 certificates, all software that uses OpenSSL to verify X.509
certificates is potentially vulnerable, as well as any other use of
PKCS #1 v1.5. This includes software that uses OpenSSL for SSL or TLS.

The Common Vulnerabilities and Exposures (CVE) project assigned the id
CVE-2006-4339 [2] to the problem.
________________________________________________________________________

References:
[0] http://www.openssl.org/news/secadv_20060905.txt
[1] http://www.openssl.org/
[2] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4339
________________________________________________________________________

For security reasons, this advisory was digitally signed with the
OpenPGP public key "OpenPKG " (ID 63C4CB9F) of the
OpenPKG project which you can retrieve from http://pgp.openpkg.org and
hkp://pgp.openpkg.org. Follow the instructions on http://pgp.openpkg.org
for details on how to verify the integrity of this advisory.
________________________________________________________________________

- -----BEGIN PGP SIGNATURE-----
Comment: OpenPKG

iD8DBQFE/o9xgHWT4GPEy58RAn09AJ0RvSOCTihCxY4vWJdKsh9a/tpr5ACggXBe
dEOgfhj33twaWWmWa0T7zio=
=zkpQ
- -----END PGP SIGNATURE-----



2.


- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

________________________________________________________________________

OpenPKG Security Advisory The OpenPKG Project
http://www.openpkg.org/security/ http://www.openpkg.org
openpkg-security@openpkg.org openpkg@openpkg.org
OpenPKG-SA-2006.019 07-Sep-2006
________________________________________________________________________

Package: bind
Vulnerability: denial of service
OpenPKG Specific: no

Affected Releases: Affected Packages: Corrected Packages:
OpenPKG CURRENT <= bind-9.3.2-20060825 >= bind-9.3.2-20060907
OpenPKG 2-STABLE <= bind-9.3.2-2.20060622 >= bind-9.3.2-2.20060907
OpenPKG 2.5-RELEASE <= bind-9.3.1-2.5.0 >= bind-9.3.1-2.5.1

Description:
Two vulnerabilities were discovered in the DNS server BIND [0]:

1. SIG Query Processing [1][2][3]: On recursive servers queries
for SIG records will trigger a assertion failure if more than one
SIG (covered) RR set is returned. On authoritative servers, if a
nameserver is serving a RFC 2535 DNSSEC zone and is queried for the
SIG records where multiple SIG (covered) RRsets (e.g. a zone apex)
exist, then BIND will trigger a assertion failure when it trys to
construct the response. The Common Vulnerabilities and Exposures (CVE)
project assigned the id CVE-2006-4095 [4] to the problem.

2. Excessive Recursive Queries INSIST failure [1][2][5]: It is
possible to trigger an INSIST failure by sending enough recursive
queries that the response to the query arrives after all the
clients looking for the response have left the recursion queue. The
Common Vulnerabilities and Exposures (CVE) project assigned the id
CVE-2006-4096 [6] to the problem.
________________________________________________________________________

References:
[0] http://www.isc.org/sw/bind/
[1] http://www.isc.org/sw/bind/bind9.3.php#security
[2] http://www.niscc.gov.uk/niscc/docs/re-20060905-00590.pdf?lang=en
[3] http://www.kb.cert.org/vuls/id/915404
[4] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4095
[5] http://www.kb.cert.org/vuls/id/697164
[6] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4096
________________________________________________________________________

For security reasons, this advisory was digitally signed with the
OpenPGP public key "OpenPKG " (ID 63C4CB9F) of the
OpenPKG project which you can retrieve from http://pgp.openpkg.org and
hkp://pgp.openpkg.org. Follow the instructions on http://pgp.openpkg.org
for details on how to verify the integrity of this advisory.
________________________________________________________________________

- -----BEGIN PGP SIGNATURE-----
Comment: OpenPKG

iD8DBQFE/794gHWT4GPEy58RAo0wAJsGu/E4cbPEvrM5sy+5OWJVorpspQCg0pAy
l7e+/Gb7VPAlKUEuyh52nS0=
=rrBf
- -----END PGP SIGNATURE-----