-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 _______________________________________________________________________ Mandriva Linux Security Advisory MDKSA-2007:146 http://www.mandriva.com/security/ _______________________________________________________________________ Package : perl-Net-DNS Date : July 12, 2007 Affected: 2007.0, 2007.1, Corporate 3.0, Corporate 4.0 _______________________________________________________________________ Problem Description: A flaw was discovered in the perl Net::DNS module in the way it generated the ID field in a DNS query. Because it is so predictable, a remote attacker could exploit this to return invalid DNS data (CVE-2007-3377). A denial of service vulnerability was found in how Net::DNS parsed certain DNS requests. A malformed response to a DNS request could cause the application using Net::DNS to crash or stop responding (CVE-2007-3409). The updated packages have been patched to prevent these issues. _______________________________________________________________________ References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3377 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3409 _______________________________________________________________________ Updated Packages: Mandriva Linux 2007.0: 92d215a4965bb8d944c030cf1dd73a11 2007.0/i586/perl-Net-DNS-0.58-1.1mdv2007.0.i586.rpm 06c1dd9d596004e261a9706060a4c167 2007.0/SRPMS/perl-Net-DNS-0.58-1.1mdv2007.0.src.rpm Mandriva Linux 2007.0/X86_64: 34bc7cfb39bd239dea991559a05f66b7 2007.0/x86_64/perl-Net-DNS-0.58-1.1mdv2007.0.x86_64.rpm 06c1dd9d596004e261a9706060a4c167 2007.0/SRPMS/perl-Net-DNS-0.58-1.1mdv2007.0.src.rpm Mandriva Linux 2007.1: cd6db816556ae5f3c172dafb5ee98002 2007.1/i586/perl-Net-DNS-0.59-1.1mdv2007.1.i586.rpm dc954016fe3924ab2a362285cd780636 2007.1/SRPMS/perl-Net-DNS-0.59-1.1mdv2007.1.src.rpm Mandriva Linux 2007.1/X86_64: d9cbd72d34d8eab851473716740290f3 2007.1/x86_64/perl-Net-DNS-0.59-1.1mdv2007.1.x86_64.rpm dc954016fe3924ab2a362285cd780636 2007.1/SRPMS/perl-Net-DNS-0.59-1.1mdv2007.1.src.rpm Corporate 3.0: 338edc98b82b661a4245c8dfdea463fa corporate/3.0/i586/perl-Net-DNS-0.39-2.1.C30mdk.i586.rpm eeeb5c182365d9726f36326892065015 corporate/3.0/SRPMS/perl-Net-DNS-0.39-2.1.C30mdk.src.rpm Corporate 3.0/X86_64: e47654bec20760643ce0e4d7b78ab394 corporate/3.0/x86_64/perl-Net-DNS-0.39-2.1.C30mdk.x86_64.rpm eeeb5c182365d9726f36326892065015 corporate/3.0/SRPMS/perl-Net-DNS-0.39-2.1.C30mdk.src.rpm Corporate 4.0: 51e6714b343575136bf296a495c32de3 corporate/4.0/i586/perl-Net-DNS-0.52-1.1.20060mlcs4.i586.rpm 862ceacd8ba656dee551039d5074dd46 corporate/4.0/SRPMS/perl-Net-DNS-0.52-1.1.20060mlcs4.src.rpm Corporate 4.0/X86_64: 99cb67c8f400c7f826ce63702e863508 corporate/4.0/x86_64/perl-Net-DNS-0.52-1.1.20060mlcs4.x86_64.rpm 862ceacd8ba656dee551039d5074dd46 corporate/4.0/SRPMS/perl-Net-DNS-0.52-1.1.20060mlcs4.src.rpm _______________________________________________________________________ To upgrade automatically use MandrivaUpdate or urpmi. The verification of md5 checksums and GPG signatures is performed automatically for you. All packages are signed by Mandriva for security. You can obtain the GPG public key of the Mandriva Security Team by executing: gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98 You can view other update advisories for Mandriva Linux at: http://www.mandriva.com/security/advisories If you want to report vulnerabilities, please contact security_(at)_mandriva.com _______________________________________________________________________ Type Bits/KeyID Date User ID pub 1024D/22458A98 2000-07-10 Mandriva Security Team <security*mandriva.com> -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.7 (GNU/Linux) iD8DBQFGlqB9mqjQ0CJFipgRAtR2AJ9k0gv3DiQhhRnitqXz+ZDG2OimbwCfacXe aq9g2vyl8V79tBNKBAMG5VY= =OBVo -----END PGP SIGNATURE-----
