Updated bind packages fixing DoS attack available

A remote DoS (denial of service) attack is possible with bind versions
prior to 8.2.2_P7.

2000-11-12: Added bind-devel, bind-utils packages to package list.

A bug in bind 8.2.2_P5 allows for a denial of service attack.
If named is open to zone transfers and recursive resolving, it will crash
after a ZXFR for the authoritative zone and a query of a remote hostname.

For each RPM for your particular architecture, run:

rpm -Fvh [filename]

where filename is the name of the RPM.


Disabling zone transfers to non-trusted hosts by adding
allow-transfer { trusted-hosts; };
to /etc/named.conf prevents the exploit from working on older releases,
however, this does not fix the problem.

20546 - bind 8.2.2-P5 remote DoS

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2000-0887
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2000-0888
http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=20546

security