-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 IBM SECURITY ADVISORY First Issued: Wed Dec 28 16:20:43 CST 2011 The most recent version of this document is available here: http://aix.software.ibm.com/aix/efixes/security/bind9_advisory3.asc VULNERABILITY SUMMARY VULNERABILITY: Multiple vulnerabilities in AIX BIND PLATFORMS: AIX 5.3, 6.1, and 7.1 releases SOLUTION: Apply the fix or workaround as described below. THREAT: A remote attacker can cause a denial of service CVE Numbers: CVE-2011-4313 CVE-2010-0382 CVE-2010-0097 CVE-2009-0025 Reboot required? NO Workarounds? NO DETAILED INFORMATION I. DESCRIPTION An as-yet unidentified network event caused BIND 9 resolvers to cache an invalid record, subsequent queries for which could crash the resolvers with an assertion failure. Please see the following for more information: http://www.isc.org/software/bind/advisories/cve-2011-4313 Furthermore, AIX BIND 9.4.1 is affected by the following three security vulnerabilities: CVE-2010-0382 - ISC BIND Out-Of-Bailwick Data Handling Error CVE-2010-0097 - ISC BIND Improper DNSSEC NSEC and NSEC3 Record CVE-2009-0025 - BIND OpenSSL DSA_do_verify and EVP_VerifyFinal II. PLATFORM VULNERABILITY ASSESSMENT Note: To use the following commands on VIOS you must first execute: oem_setup_env To determine if your system is vulnerable, execute the following command: lslpp -L bos.net.tcp.client bos.net.tcp.server The following fileset levels are vulnerable: AIX Fileset Lower Level Upper Level ------------------------------------------------ bos.net.tcp.client 5.3.12.0 5.3.12.5 bos.net.tcp.server 5.3.12.0 5.3.12.3 bos.net.tcp.client 6.1.5.0 6.1.5.7 bos.net.tcp.server 6.1.5.0 6.1.5.6 bos.net.tcp.client 6.1.6.0 6.1.6.16 bos.net.tcp.server 6.1.6.0 6.1.6.16 bos.net.tcp.client 6.1.7.0 6.1.7.1 bos.net.tcp.server 6.1.7.0 6.1.7.0 bos.net.tcp.client 7.1.0.0 7.1.0.17 bos.net.tcp.server 7.1.0.0 7.1.0.16 bos.net.tcp.client 7.1.1.0 7.1.1.1 bos.net.tcp.server 7.1.1.0 7.1.1.0 III. SOLUTION A. FIXES Fixes are now available. The fixes can be downloaded from: http://aix.software.ibm.com/aix/efixes/security/bind9_ifix3.tar The links above are to a tar file containing this signed advisory, fix packages, and PGP signatures for each package. AIX Level Fix ------------------------------------------------------ 5.3.12.5 IV09491m05.111226.epkg.Z 6.1.5.7 IV11742m07.111206.epkg.Z 6.1.6.16 IV11743m06.111216.epkg.Z 6.1.7.1 IV09978m01.111207.epkg.Z 7.1.0.17 IV11744m04.111207.epkg.Z 7.1.1.1 IV10049m01.111208.epkg.Z NOTE: For 6.1 TL07 and 7.1 TL01, following ifixes may be required to install prior to installing BIND ifix due to emgr script issue: ftp://aix.software.ibm.com/aix/efixes/iv12335/IV12335s01.epkg.Z ftp://aix.software.ibm.com/aix/efixes/iv12342/IV12342s01.epkg.Z To extract the fixes from the tar file: tar xvf bind9_ifix3.tar cd bind9_ifix3 Verify you have retrieved the fixes intact: The checksums below were generated using the "csum -h SHA1" (sha1sum) commands and are as follows: csum -h SHA1 (sha1sum) filename ------------------------------------------------------------------ 25b3efc2050a355389e54ecfa1c75112f2f3a9c1 IV09491m05.111226.epkg.Z 915fefd318654e37cb30462c64e2d03badf20b2f IV09978m01.111207.epkg.Z 03401f6d52899602959f3f21b04b83bf1f9590e4 IV10049m01.111208.epkg.Z 28e81ddcf600dedcfd28b046b8e6799045513f0e IV11742m07.111206.epkg.Z 666c4c66bda95c3fb030928afea897cff0f51b43 IV11743m06.111216.epkg.Z 7327c22ff990879d62977634c2ae2babf713bff1 IV11744m04.111207.epkg.Z To verify the sums, use the text of this advisory as input to csum or sha1sum. For example: csum -h SHA1 -i bind9_advisory3.asc sha1sum -c bind9_advisory3.asc These sums should match exactly. The PGP signatures in the tar file and on this advisory can also be used to verify the integrity of the fixes. If the sums or signatures cannot be confirmed, contact IBM AIX Security and describe the discrepancy at the following addresses: security-alert@austin.ibm.com B. FIX INSTALLATION IMPORTANT: If possible, it is recommended that a mksysb backup of the system be created. Verify it is both bootable and readable before proceeding. Fix management documentation can be found at: http://www14.software.ibm.com/webapp/set2/sas/f/aix.efixmgmt/home.html To preview fix installation: emgr -e fix_name -p # where fix_name is the name of the # fix being previewed. To install fix package: emgr -e fix_name -X # where fix_name is the name of the # fix being installed. C. APARS IBM has assigned the following APARs to this problem: AIX Level APAR number Service pack date -------------------------------------------------------- 5.3.12 IV09491 tbd 6.1.5 IV11742 tbd 6.1.6 IV11743 tbd 6.1.7 IV09978 02/17/12 sp3 7.1.0 IV11744 tbd 7.1.1 IV10049 tbd Subscribe to the APARs here: http://www.ibm.com/support/docview.wss?uid=isg1IV09491 http://www.ibm.com/support/docview.wss?uid=isg1IV11742 http://www.ibm.com/support/docview.wss?uid=isg1IV11743 http://www.ibm.com/support/docview.wss?uid=isg1IV09978 http://www.ibm.com/support/docview.wss?uid=isg1IV11744 http://www.ibm.com/support/docview.wss?uid=isg1IV10049 By subscribing, you will receive periodic email alerting you to the status of the APAR, and a link to download the service pack when it becomes available. IV. WORKAROUND There are no workarounds available other than disabling the named service. V. CONTACT INFORMATION If you would like to receive AIX Security Advisories via email, please visit: http://www.ibm.com/systems/support and click on the "My notifications" link. To view previously issued advisories, please visit: http://www14.software.ibm.com/webapp/set2/subscriptions/pqvcmjd Comments regarding the content of this announcement can be directed to: security-alert@austin.ibm.com To obtain the PGP public key that can be used to communicate securely with the AIX Security Team you can either: A. Send an email with "get key" in the subject line to: security-alert@austin.ibm.com B. Download the key from our web page: http://www.ibm.com/systems/resources/systems_p_os_aix_security_pgpkey.txt C. Download the key from a PGP Public Key Server. The key ID is: 0x28BFAA12 Please contact your local IBM AIX support center for any assistance. eServer is a trademark of International Business Machines Corporation. IBM, AIX and pSeries are registered trademarks of International Business Machines Corporation. All other trademarks are property of their respective holders. VI. REFERENCES: Complete CVSS Guide: http://www.first.org/cvss/cvss-guide.html On-line Calculator V2: http://nvd.nist.gov/cvss.cfm?calculator&adv&version=2 X-Force Vulnerability Database: n/a CVE-2011-4313: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4313 CVE-2010-0382: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0382 CVE-2010-0097: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0097 CVE-2009-0025: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0025 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.7 (AIX) iD8DBQFO+2Cy4fmd+Ci/qhIRAmSFAJwJ4knHG1upERg2Ia1Ku74DvZlBGgCbBmPo RW3JZFPi5uQ/5UOiUi4sT2E= =BtcF -----END PGP SIGNATURE-----