ID de Prueba:	1.3.6.1.4.1.25623.1.0.51526
Categoría:	Conectiva Local Security Checks
Título:	Conectiva Security Advisory CLA-2002:507
Resumen:	NOSUMMARY
Descripción:	Description: The remote host is missing updates announced in advisory CLA-2002:507. There is a buffer overflow vulnerability[1,4] in several DNS resolver libraries that affect all applications linked to these libraries. In Conectiva Linux the vulnerability affects the libbind library included in the BIND[2] distribution and a resolver library included with glibc. A remote attacker who is able to send malicious DNS responses to vulnerable machines could exploit this vulnerability and potentially execute arbitrary code with the privileges of the application making use of the vulnerable resolver library. Regarding the BIND 9.x packages distributed with Conectiva Linux 7.0 and 8, the libbind library is not included nor generated, which means that these packages are not vulnerable to this problem. The 8.2 BIND packages shipped with Conectiva Linux 6.0, on the other hand, use the libbind library in their utilities and are being upgraded to the 8.2.6 version which was released by ISC[3] to address this problem. Please note that the named daemon is believed to be *not* vulnerable to this problem, even in versions prior to 8.2.6. Glibc has this vulnerability in the getnetby* script_family( of functions when the system is configured to use dns to resolve network names. In the default installation, however, this is disabled in the /etc/nsswitch.conf configuration file: Example of a vulnerable system: networks: files dns System without this vulnerability exposed (default nsswitch configuration): networks: files Solution: The apt tool can be used to perform RPM package upgrades by running 'apt-get update' followed by 'apt-get upgrade' https://secure1.securityspace.com/smysecure/catid.html?in=CLA-2002:507 http://distro.conectiva.com.br/atualizacoes/index.php?id=a&anuncio=002002 Risk factor : High
Copyright	Copyright (c) 2005 E-Soft Inc. http://www.securityspace.com

Esta es sólo una de 146377 pruebas de vulnerabilidad en nuestra serie de pruebas. Encuentre más sobre cómo ejecutar una auditoría de seguridad completa. Para ejecutar una prueba gratuita de esta vulnerabilidad contra su sistema, regístrese ahora.