BIND 9 Update fixing CVE-2013-3919

Published: 2013-06-05. Last Updated: 2013-06-05 22:00:12 UTC
by Richard Porter (Version: 1)

Today BIND9 recevied an update fixing a "recursive resolver with a RUNTIME_CHECK error in resolver.c" [1] Affected versions are BIND 9.6-ESV-R9, 9.8.5, and 9.9.3. The rated CVSS on this one is 7.8 [1,2]

To quote isc.org:

"At the time of this advisory no intentional exploitation of this bug has been observed in the wild. However, the existence of the issue has been disclosed on an open mailing list with enough accompanying detail to reverse engineer an attack and ISC is therefore treating this as a Type II (publicly disclosed) vulnerability, in accordance with our Phased Disclosure Process."

It it is time to review those BIND9 servers and start the process of patching.

[1] https://kb.isc.org/article/AA-00967

[2] http://nvd.nist.gov/cvss.cfm?calculator&adv&version=2&vector=(AV:N/AC:L/Au:N/C:N/I:N/A:C)

Richard Porter

--- ISC Handler on Duty

Keywords: bind9 ddos dns dos patch

2 comment(s)

Wireshark 1.10.0 Stable Released http://www.wireshark.org/download.html

New version of "Ouch", the SANS Securing the Human Newsletter http://www.securingthehuman.org/resources/newsletters/ouch/2013

Windows Sysinternals Updated http://technet.microsoft.com/en-us/sysinternals/default.aspx

Apple releases OS 10.8.4

Published: 2013-06-05. Last Updated: 2013-06-05 02:43:44 UTC
by Johannes Ullrich (Version: 1)

6 comment(s)

Apple released the next update for OS X, 10.8.4. Eventually, we should learn more about the security content of the update, but at this point, the security page has not been updated yet [1].

However, Apple did distribute a list of patched vulnerabilities via e-mail (thanks Dave for sharing). The update fixes a total of 33 vulnerabilities. Here are some of the highlights:

OS 10.8.4 Update Overview
CVE #	Component	Affected Versions
2013-0982	CFNetwork	10.8 - 10.8.3	data leakage (authentication cookies)
2013-0983	CoreAnimation	10.8 - 10.8.3	code execution
2013-1024	CoreMedia	10.7-10.7.5 (Server 10.8-10.8.3	code execution
2013-5519	CUPS	10.8-10.8.3	priv. escalation
2013-0984	Directory Service	10.6.8	remote code execution as system
2013-0985	Disk Management	10.8-10.8.3	data leakage (disable file vault)
2012-4829	OpenSSL	10.6.8, 10.7-10.7.5, 10.8-10.8.3	data leakage ("CRIME" attack)
multiple	OpenSSL	10.6.8, 10.7-10.7.5, 10.8-10.8.3	DoS, data leakage
2013-0987	QuickTime QTIF Files	10.6.8, 10.7-10.7.5, 10.8-10.8.3	code execution
2013-0988	QuickTime FPX Files	10.6.8., 10.7-10.7.5, 10.8-10.8.3	code execution
2013-0989	QuickTime MP3 Files	10.8-10.8.3	code execution
multiple	Ruby on Rails	10.6.8	code execution (EXPLOITED)
2013-0990	SMB	10.7-10.7.5, 10.8-10.8.3	authenticated user may write files outside of shared directory

Other changes:

Gatekeeper will check downloaded JNLP applications and may require a valid developer ID certificate.

In addition, this update includes Safari 6.0.5 with various improvements / security fixes not listed here.

Safari 6.0.5 patches a total of 23 arbitrary code execution vulnerabilities, two cross site scriting issue and one problem with the XSS Auditor that may cause form submissions to be altered.

------
Johannes B. Ullrich, Ph.D.
SANS Technology Institute
Twitter

Keywords: apple os x

6 comment(s)

ISC StormCast for Wednesday, June 5th 2013 http://isc.sans.edu/podcastdetail.html?id=3347