The Vigil@nce team watches public vulnerabilities impacting your computers, and then offers security solutions, a vigilance database and tools to fix them.

Vulnerability of DNS: cache poisoning

Synthesis of the vulnerability 

An attacker can predict DNS queries in order to poison the DNS client or cache (caching resolver).
Impacted systems: ProxyRA, ProxySG par Blue Coat, IOS by Cisco, Cisco Router, Debian, Dnsmasq, BIG-IP Hardware, TMOS, Fedora, FreeBSD, MPE/iX, Tru64 UNIX, HP-UX, AIX, BIND, Juniper E-Series, Juniper J-Series, JUNOSe, Junos OS, Mandriva Linux, Mandriva NF, Windows 2000, Windows 2003, Windows 2008 R0, Windows (platform) ~ not comprehensive, Windows XP, NetBSD, NetScreen Firewall, ScreenOS, NLD, Netware, OES, OpenBSD, OpenSolaris, openSUSE, Solaris, Trusted Solaris, DNS protocol, RHEL, Slackware, SLES, TurboLinux, Unix (platform) ~ not comprehensive, ESX.
Severity of this alert: 3/4.
Creation date: 09/07/2008.
Revisions dates: 22/07/2008, 24/07/2008, 25/07/2008.
Références of this alert: 107064, 239392, 240048, 6702096, 7000912, 953230, BID-30131, c01506861, c01660723, CAU-EX-2008-0002, CAU-EX-2008-0003, CERTA-2002-AVI-189, CERTA-2002-AVI-200, cisco-sa-20080708-dns, CR102424, CR99135, CSCso81854, CVE-2008-1447, draft-ietf-dnsext-forgery-resilience-05, DSA-1544-2, DSA-1603-1, DSA-1604-1, DSA-1605-1, DSA-1617-1, DSA-1619-1, DSA-1619-2, DSA-1623-1, FEDORA-2008-6256, FEDORA-2008-6281, FEDORA-2009-1069, FreeBSD-SA-08:06.bind, HPSBMP02404, HPSBTU02358, HPSBUX02351, MDVSA-2008:139, MS08-037, NetBSD-SA2008-009, powerdns-advisory-2008-01, PSN-2008-06-040, RHSA-2008:0533-01, RHSA-2008:0789-01, SOL8938, SSA:2008-191-02, SSA:2008-205-01, SSRT080058, SSRT090014, SUSE-SA:2008:033, TA08-190B, TLSA-2008-26, VIGILANCE-VUL-7937, VMSA-2008-0014, VMSA-2008-0014.1, VMSA-2008-0014.2, VU#800113.

Description of the vulnerability 

The DNS protocol defines a 16 bit identifier to associate an answer to its query. When attacker predicts this identifier and the UDP port number, he can send fake answers and thus poison the DNS cache.

Most implementation use a fixed port number, which increases the probability of a poisoning success. As there is only one chance of success during the TTL period, and as the poisoning does not work for each trial, this direct and old attack is not practical.

However, instead of poisoning the answer record, the attacker can poison additional records. Indeed, when the DNS client asks the address of www.example.com, the DNS server returns:
  www.example.com A 1.2.3.4 (answer)
  example.com NS dns.example.com (authoritative)
  dns.example.com A 1.2.3.5 (additional)

An attacker can therefore force the client to ask the resolution of several names (via a web page containing images for example): aaa.example.com, aab.example.com, ..., aaz.example.com. In his answers, the attacker then always provides the same additional malicious answer (www.example.com A 5.6.7.8). Even if, for example, only aab.example.com is poisoned, its additional record (www.example.com = 5.6.7.8) will be stored in the cache.

An attacker can therefore poison the DNS cache/client and redirect all users to a malicious site.
Full bulletin, software filtering, emails, fixes, ... (Request your free trial)

This vulnerability note impacts software or systems such as ProxyRA, ProxySG par Blue Coat, IOS by Cisco, Cisco Router, Debian, Dnsmasq, BIG-IP Hardware, TMOS, Fedora, FreeBSD, MPE/iX, Tru64 UNIX, HP-UX, AIX, BIND, Juniper E-Series, Juniper J-Series, JUNOSe, Junos OS, Mandriva Linux, Mandriva NF, Windows 2000, Windows 2003, Windows 2008 R0, Windows (platform) ~ not comprehensive, Windows XP, NetBSD, NetScreen Firewall, ScreenOS, NLD, Netware, OES, OpenBSD, OpenSolaris, openSUSE, Solaris, Trusted Solaris, DNS protocol, RHEL, Slackware, SLES, TurboLinux, Unix (platform) ~ not comprehensive, ESX.

Our Vigil@nce team determined that the severity of this cybersecurity vulnerability is important.

The trust level is of type confirmed by the editor, with an origin of internet server.

A proof of concept or an attack tool is available, so your teams have to process this alert. An attacker with a beginner ability can exploit this computer threat note.

Solutions for this threat 

DNS: workarounds.
A workaround is to use DNSSEC when available.
Other workarounds are indicated in the US-CERT announce.

BIND: version 9.5.0-P1.
Version 9.5.0-P1 is corrected:
  ftp://ftp.isc.org/isc/bind9/9.5.0-P1/bind-9.5.0-P1.tar.gz
  ftp://ftp.isc.org/isc/bind9/9.5.0-P1/bind-9.5.0-P1.tar.gz.asc
  ftp://ftp.isc.org/isc/bind9/9.5.0-P1/bind-9.5.0-P1.tar.gz.sha256.asc
  ftp://ftp.isc.org/isc/bind9/9.5.0-P1/bind-9.5.0-P1.tar.gz.sha512.asc
This version uses variable port numbers, which uses more resources. Administrators have to ensure that firewalls do not restrict allowed ports.
The configuration file must not contain query-source nor query-source-v6 options.

BIND: version 9.4.3.
Version 9.4.3 is corrected:
  ftp://ftp.isc.org/isc/bind9/9.4.3/bind-9.4.3.tar.gz

BIND: version 9.4.2-P1.
Version 9.4.2-P1 is corrected:
  ftp://ftp.isc.org/isc/bind9/9.4.2-P1/bind-9.4.2-P1.tar.gz
  ftp://ftp.isc.org/isc/bind9/9.4.2-P1/bind-9.4.2-P1.tar.gz.asc
  ftp://ftp.isc.org/isc/bind9/9.4.2-P1/bind-9.4.2-P1.tar.gz.sha256.asc
  ftp://ftp.isc.org/isc/bind9/9.4.2-P1/bind-9.4.2-P1.tar.gz.sha512.asc
This version uses variable port numbers, which uses more resources. Administrators have to ensure that firewalls do not restrict allowed ports.
The configuration file must not contain query-source nor query-source-v6 options.

BIND: version 9.3.6.
Version 9.3.6 is corrected:
  ftp://ftp.isc.org/isc/bind9/9.3.6/bind-9.3.6.tar.gz

BIND: version 9.3.5-P1.
Version 9.3.5-P1 is corrected:
  ftp://ftp.isc.org/isc/bind9/9.3.5-P1/bind-9.3.5-P1.tar.gz
  ftp://ftp.isc.org/isc/bind9/9.3.5-P1/bind-9.3.5-P1.tar.gz.asc
  ftp://ftp.isc.org/isc/bind9/9.3.5-P1/bind-9.3.5-P1.tar.gz.sha256.asc
  ftp://ftp.isc.org/isc/bind9/9.3.5-P1/bind-9.3.5-P1.tar.gz.sha512.asc
This version uses variable port numbers, which uses more resources. Administrators have to ensure that firewalls do not restrict allowed ports.
The configuration file must not contain query-source nor query-source-v6 options.

Dnsmasq: version 2.43 (2.44).
Version 2.43 is corrected:
  http://www.thekelleys.org.uk/dnsmasq/CHANGELOG
The version 2.44 corrects several bugs introduced in version 2.43.

PowerDNS: version 3.1.5 (3.1.6).
Version 3.1.5 is corrected, but version 3.1.6 is more secure (VIGILANCE-VUL-7937):
  http://www.powerdns.com/

AIX: APAR for DNS.
An APAR will be available:
  5.2.0 : IZ42034
    http://www.ibm.com/support/docview.wss?uid=isg1IZ42034
  5.3.0 : IZ42035
    http://www.ibm.com/support/docview.wss?uid=isg1IZ42035
  5.3.7 : IZ40776
    http://www.ibm.com/support/docview.wss?uid=isg1IZ40776
  5.3.8 : IZ42037
    http://www.ibm.com/support/docview.wss?uid=isg1IZ42037
  5.3.9 : IZ42064
    http://www.ibm.com/support/docview.wss?uid=isg1IZ42064
  6.1.0 : IZ42066
    http://www.ibm.com/support/docview.wss?uid=isg1IZ42066
  6.1.1 : IZ42123
    http://www.ibm.com/support/docview.wss?uid=isg1IZ42123
  6.1.2 : IZ42126
    http://www.ibm.com/support/docview.wss?uid=isg1IZ42126
An efix is available:
  http://aix.software.ibm.com/aix/efixes/security/bind_fix.tar

Blue Coat ProxyRA: version 2.3.2.1.
Version 2.3.2.1 is corrected.

Blue Coat ProxySG: version 4.2.8.7, 5.2.4.3.
Version 4.2.8.7 or 5.2.4.3 is corrected.

Cisco IOS: version for DNS.
Cisco IOS is vulnerable when the DNS server is enabled.
The Cisco announce indicates corrected versions.

Debian 4.0: new pdns-recursor packages.
New packages are available:
amd64 architecture (AMD x86_64 (AMD64))
  http://security.debian.org/pool/updates/main/p/pdns-recursor/pdns-recursor_3.1.4-1+etch2_amd64.deb
    Size/MD5 checksum: 418498 f5c48c3dfa05a888c38416b7c3b1e9ee
i386 architecture (Intel ia32)
  http://security.debian.org/pool/updates/main/p/pdns-recursor/pdns-recursor_3.1.4-1+etch2_i386.deb
    Size/MD5 checksum: 433786 33e5e4d147b1f7408dee93f014845e4b
ia64 architecture (Intel ia64)
  http://security.debian.org/pool/updates/main/p/pdns-recursor/pdns-recursor_3.1.4-1+etch2_ia64.deb
    Size/MD5 checksum: 598166 f1b98150ec6cb205eb10d5dcc69f1684

Debian: new bind9 packages.
New packages are available:
  http://security.debian.org/pool/updates/main/b/bind9/bind9*_9.3.4-2etch3_*.deb
The announces contain additional information.

Debian: new dnsmasq packages.
New packages are available:
http://security.debian.org/pool/updates/main/d/dnsmasq/dnsmasq_2.35-1+etch4_*.deb

Debian: new python-dns packages.
New packages are available:
http://security.debian.org/pool/updates/main/p/python-dns/python-dns_2.3.0-5.2+etch2_all.deb

Debian: new refpolicy packages.
New packages are available:
http://security.debian.org/pool/updates/main/r/refpolicy/selinux-policy-refpolicy*_0.0.20061018-5.1+etch1_all.deb

F5 BIG-IP: workaround for BIND.
A workaround is to disable recursion.

Fedora 9: new dnsmasq packages.
New packages are available:
  dnsmasq-2.45-1.fc9

Fedora: new bind packages.
New packages are available:
  bind-9.5.0-28.P1.fc8
  bind-9.5.0-33.P1.fc9

FreeBSD: patch for bind.
A patch is available:
[FreeBSD 6.3]
# fetch http://security.FreeBSD.org/patches/SA-08:06/bind63.patch
# fetch http://security.FreeBSD.org/patches/SA-08:06/bind63.patch.asc
[FreeBSD 7.0]
# fetch http://security.FreeBSD.org/patches/SA-08:06/bind7.patch
# fetch http://security.FreeBSD.org/patches/SA-08:06/bind7.patch.asc
The configuration file must not contain query-source nor query-source-v6 options.

HP Tru64: patch for dns.
A patch is available:
HP Tru64 UNIX Version 5.1B-4 :
 - Prerequisite : HP Tru64 UNIX 5.1B-4 PK6 (BL27)
 - Patch: http://www.itrc.hp.com/service/patch/patchDetail.do?patchid=T64KIT1001520-V51BB27-ES-20080808
 
HP Tru64 UNIX Version 5.1B-3 :
 - Prerequisite : HP Tru64 UNIX 5.1B-3 PK5 (BL26)
 - Patch : http://www.itrc.hp.com/service/patch/patchDetail.do?patchid=T64KIT1001522-V51BB26-ES-20080808

HP-UX: BIND version C.9.3.2.3.0.
For BIND v9.3.2 :
  Version C.9.3.2.7.0 is corrected (http://software.hp.com/).
Then, remove "query-source port" and "query-source-v6 port" from the /etc/named.conf file.
For BIND v9.2.0 :
  HP-UX B.11.11 : revision B.11.11.01.015 (http://software.hp.com/).
  HP-UX B.11.23 : patch PHNE_37865 (http://itrc.hp.com/)
Then, remove "query-source port" and "query-source-v6 port" from the /etc/named.conf file.

JUNOS: version of 23rd of May 2008.
Versions published after the 23rd of May are corrected.

Mandriva: new bind packages.
New packages are available:
 
 Mandriva Linux 2007.1:
 73cc24fc9586b7ab290d755012c16a79 2007.1/i586/bind-9.4.2-0.1mdv2007.1.i586.rpm
 70867c50cfd64b4406aa002d627d740b 2007.1/i586/bind-devel-9.4.2-0.1mdv2007.1.i586.rpm
 3603e9d9115466753397a1f472011703 2007.1/i586/bind-utils-9.4.2-0.1mdv2007.1.i586.rpm
 cf5e4100ecb21a4eb603831e5a6ec23d 2007.1/SRPMS/bind-9.4.2-0.1mdv2007.1.src.rpm
 Mandriva Linux 2007.1/X86_64:
 4eb7ce0984d3ce3befff667392e3bf3e 2007.1/x86_64/bind-9.4.2-0.1mdv2007.1.x86_64.rpm
 d7b9a9e7d4c52a5b0c54f59ca20bf2d5 2007.1/x86_64/bind-devel-9.4.2-0.1mdv2007.1.x86_64.rpm
 c5c66c9609615029d2f07f7b09a63118 2007.1/x86_64/bind-utils-9.4.2-0.1mdv2007.1.x86_64.rpm
 cf5e4100ecb21a4eb603831e5a6ec23d 2007.1/SRPMS/bind-9.4.2-0.1mdv2007.1.src.rpm
 Mandriva Linux 2008.0:
 52dfe3970fcd9495b2bb9379a9312b25 2008.0/i586/bind-9.4.2-1mdv2008.0.i586.rpm
 97d20d35b6814aa2f9fab549ca6237c0 2008.0/i586/bind-devel-9.4.2-1mdv2008.0.i586.rpm
 87a7bb3dd25abd8cd882a8f2fdc2398e 2008.0/i586/bind-utils-9.4.2-1mdv2008.0.i586.rpm
 da4444a8074e6ede39dfa557fb258db7 2008.0/SRPMS/bind-9.4.2-1mdv2008.0.src.rpm
 Mandriva Linux 2008.0/X86_64:
 b9d0337363bc1e2b14505f25d4ee5f99 2008.0/x86_64/bind-9.4.2-1mdv2008.0.x86_64.rpm
 9b75e2a96784c00c2912bc3bf333d089 2008.0/x86_64/bind-devel-9.4.2-1mdv2008.0.x86_64.rpm
 0a593b090d9e6bda3666e234056e19ba 2008.0/x86_64/bind-utils-9.4.2-1mdv2008.0.x86_64.rpm
 da4444a8074e6ede39dfa557fb258db7 2008.0/SRPMS/bind-9.4.2-1mdv2008.0.src.rpm
 Mandriva Linux 2008.1:
 2534ef007262d4ea2d219bab0190466c 2008.1/i586/bind-9.5.0-3mdv2008.1.i586.rpm
 c3feee5d05aa3aee14cd70a2d295d0b1 2008.1/i586/bind-devel-9.5.0-3mdv2008.1.i586.rpm
 f306c06665b723a2530258e6d1dbdae2 2008.1/i586/bind-doc-9.5.0-3mdv2008.1.i586.rpm
 967ef80628f92160930bc3a3827a216e 2008.1/i586/bind-utils-9.5.0-3mdv2008.1.i586.rpm
 70fc7a7964944a2926979710c5148ed1 2008.1/SRPMS/bind-9.5.0-3mdv2008.1.src.rpm
 Mandriva Linux 2008.1/X86_64:
 3f4d96d7a7f913c141e1f63cdc7e7336 2008.1/x86_64/bind-9.5.0-3mdv2008.1.x86_64.rpm
 420db658366763686198f41394aa72b3 2008.1/x86_64/bind-devel-9.5.0-3mdv2008.1.x86_64.rpm
 6f3674f68311494c5a9ff0dbce831e82 2008.1/x86_64/bind-doc-9.5.0-3mdv2008.1.x86_64.rpm
 4294b3a086b89bf53c5c967c17962447 2008.1/x86_64/bind-utils-9.5.0-3mdv2008.1.x86_64.rpm
 70fc7a7964944a2926979710c5148ed1 2008.1/SRPMS/bind-9.5.0-3mdv2008.1.src.rpm
 Corporate 3.0:
 de2a4372d1c25d73f343c9fcb044c9dd corporate/3.0/i586/bind-9.2.3-6.5.C30mdk.i586.rpm
 1f24f6dbdb6c02e21cbbef99555049cb corporate/3.0/i586/bind-devel-9.2.3-6.5.C30mdk.i586.rpm
 00405b98290d5a41f226081baa57e18d corporate/3.0/i586/bind-utils-9.2.3-6.5.C30mdk.i586.rpm
 6a237dc290f4f7c463b1996e6a4a4515 corporate/3.0/SRPMS/bind-9.2.3-6.5.C30mdk.src.rpm
 Corporate 3.0/X86_64:
 628162f3d6a414828d2231fefc46842b corporate/3.0/x86_64/bind-9.2.3-6.5.C30mdk.x86_64.rpm
 dd29ff31a9cffcc1b20fd045869d7013 corporate/3.0/x86_64/bind-devel-9.2.3-6.5.C30mdk.x86_64.rpm
 c475c1a4d048e04da1fc27dcbb17c3f3 corporate/3.0/x86_64/bind-utils-9.2.3-6.5.C30mdk.x86_64.rpm
 6a237dc290f4f7c463b1996e6a4a4515 corporate/3.0/SRPMS/bind-9.2.3-6.5.C30mdk.src.rpm
 Corporate 4.0:
 271ead204904be302d197cd542f5ae23 corporate/4.0/i586/bind-9.3.5-0.4.20060mlcs4.i586.rpm
 42413dcc1cf053e735216f767eff4e5d corporate/4.0/i586/bind-devel-9.3.5-0.4.20060mlcs4.i586.rpm
 0201afe493a41e1deedc9bf7e9725f4a corporate/4.0/i586/bind-utils-9.3.5-0.4.20060mlcs4.i586.rpm
 86bc0cdc9ed1b959b6f56e0660268f2e corporate/4.0/SRPMS/bind-9.3.5-0.4.20060mlcs4.src.rpm
 Corporate 4.0/X86_64:
 b1a18a7d0578dab7bd825eda6c682b3d corporate/4.0/x86_64/bind-9.3.5-0.4.20060mlcs4.x86_64.rpm
 6a2ebd550feb9147058de05b1a1ef04d corporate/4.0/x86_64/bind-devel-9.3.5-0.4.20060mlcs4.x86_64.rpm
 670a1b934ce4974b8505018ab69ade0b corporate/4.0/x86_64/bind-utils-9.3.5-0.4.20060mlcs4.x86_64.rpm
 86bc0cdc9ed1b959b6f56e0660268f2e corporate/4.0/SRPMS/bind-9.3.5-0.4.20060mlcs4.src.rpm
 Multi Network Firewall 2.0:
 5b694c24cc2092e38f531dbfdd5c9d41 mnf/2.0/i586/bind-9.2.3-6.5.C30mdk.i586.rpm
 c08bc805027059c47bed32215f17eacb mnf/2.0/i586/bind-utils-9.2.3-6.5.C30mdk.i586.rpm
 39225289516498e1b071c5059306f2b9 mnf/2.0/SRPMS/bind-9.2.3-6.5.C30mdk.src.rpm

MPE/iX: workaround for BIND/iX.
A workaround is to install another DNS server.

NetBSD: patches for bind.
Patches are available, and indicated in the NetBSD announce.

NetWare: corrected named.nlm.
The named.nlm published on 25/07/2008 is corrected.

OpenBSD: patch for BIND.
A patch is available:
ftp://ftp.openbsd.org/pub/OpenBSD/patches/4.3/common/004_bind.patch
ftp://ftp.openbsd.org/pub/OpenBSD/patches/4.2/common/013_bind.patch

RHEL: new bind packages.
New packages are available:
Red Hat Enterprise Linux 2.1 : bind-9.2.1-10.el2
Red Hat Enterprise Linux 3: bind-9.2.4-22.el3
Red Hat Enterprise Linux 4: bind-9.2.4-28.0.1.el4
Red Hat Enterprise Linux 5: bind-9.3.4-6.0.1.P1.el5_2

RHEL: new dnsmasq packages.
Version is corrected:
Red Hat Enterprise Linux: dnsmasq*-2.45-1.el5_2.1.*.rpm

ScreenOS: version 5.4r10, 6.0r5a, 6.1R2.
Versions 5.4r10, 6.0r5a and 6.1R2 are corrected:
  http://www.juniper.net/

Slackware: new bind packages.
New packages are available:
Slackware 8.1:
ftp://ftp.slackware.com/pub/slackware/slackware-8.1/patches/packages/bind-9.3.5_P1-i386-1_slack8.1.tgz
Slackware 9.0:
ftp://ftp.slackware.com/pub/slackware/slackware-9.0/patches/packages/bind-9.3.5_P1-i386-1_slack9.0.tgz
Slackware 9.1:
ftp://ftp.slackware.com/pub/slackware/slackware-9.1/patches/packages/bind-9.3.5_P1-i486-1_slack9.1.tgz
Slackware 10.0:
ftp://ftp.slackware.com/pub/slackware/slackware-10.0/patches/packages/bind-9.3.5_P1-i486-1_slack10.0.tgz
Slackware 10.1:
ftp://ftp.slackware.com/pub/slackware/slackware-10.1/patches/packages/bind-9.3.5_P1-i486-1_slack10.1.tgz
Slackware 10.2:
ftp://ftp.slackware.com/pub/slackware/slackware-10.2/patches/packages/bind-9.3.5_P1-i486-1_slack10.2.tgz
Slackware 11.0:
ftp://ftp.slackware.com/pub/slackware/slackware-11.0/patches/packages/bind-9.3.5_P1-i486-1_slack11.0.tgz
Slackware 12.0:
ftp://ftp.slackware.com/pub/slackware/slackware-12.0/patches/packages/bind-9.4.2_P1-i486-1_slack12.0.tgz
Slackware 12.1:
ftp://ftp.slackware.com/pub/slackware/slackware-12.1/patches/packages/bind-9.4.2_P1-i486-1_slack12.1.tgz

Slackware: new dnsmasq packages.
New packages are available:
Slackware 10.0:
ftp://ftp.slackware.com/pub/slackware/slackware-10.0/patches/packages/dnsmasq-2.45-i486-1_slack10.0.tgz
Slackware 10.1:
ftp://ftp.slackware.com/pub/slackware/slackware-10.1/patches/packages/dnsmasq-2.45-i486-1_slack10.1.tgz
Slackware 10.2:
ftp://ftp.slackware.com/pub/slackware/slackware-10.2/patches/packages/dnsmasq-2.45-i486-1_slack10.2.tgz
Slackware 11.0:
ftp://ftp.slackware.com/pub/slackware/slackware-11.0/patches/packages/dnsmasq-2.45-i486-1_slack11.0.tgz
Slackware 12.0:
ftp://ftp.slackware.com/pub/slackware/slackware-12.0/patches/packages/dnsmasq-2.45-i486-1_slack12.0.tgz
Slackware 12.1:
ftp://ftp.slackware.com/pub/slackware/slackware-12.1/patches/packages/dnsmasq-2.45-i486-1_slack12.1.tgz

Solaris: patch for DNS.
A patch is available:
  SPARC Platform
    * Solaris 8 IDR138951-01
    * Solaris 9 IDR138950-02
    * Solaris 10 : patch 119783-06
  x86 Platform
    * Solaris 8 IDR138959-01
    * Solaris 9 IDR138958-02
    * Solaris 10 : patch 119784-06

SUSE: new bind packages.
New packages are available:
   
   openSUSE 11.0:
   http://download.opensuse.org/pub/opensuse/update/11.0/rpm/i586/bind-9.4.2-39.2.i586.rpm
   http://download.opensuse.org/pub/opensuse/update/11.0/rpm/i586/bind-chrootenv-9.4.2-39.2.i586.rpm
   http://download.opensuse.org/pub/opensuse/update/11.0/rpm/i586/bind-devel-9.4.2-39.2.i586.rpm
   http://download.opensuse.org/pub/opensuse/update/11.0/rpm/i586/bind-doc-9.4.2-39.2.i586.rpm
   http://download.opensuse.org/pub/opensuse/update/11.0/rpm/i586/bind-libs-9.4.2-39.2.i586.rpm
   http://download.opensuse.org/pub/opensuse/update/11.0/rpm/i586/bind-utils-9.4.2-39.2.i586.rpm
   
   openSUSE 10.3:
   http://download.opensuse.org/pub/opensuse/update/10.3/rpm/i586/bind-9.4.1.P1-12.5.i586.rpm
   http://download.opensuse.org/pub/opensuse/update/10.3/rpm/i586/bind-chrootenv-9.4.1.P1-12.5.i586.rpm
   http://download.opensuse.org/pub/opensuse/update/10.3/rpm/i586/bind-devel-9.4.1.P1-12.5.i586.rpm
   http://download.opensuse.org/pub/opensuse/update/10.3/rpm/i586/bind-doc-9.4.1.P1-12.5.i586.rpm
   http://download.opensuse.org/pub/opensuse/update/10.3/rpm/i586/bind-libs-9.4.1.P1-12.5.i586.rpm
   http://download.opensuse.org/pub/opensuse/update/10.3/rpm/i586/bind-utils-9.4.1.P1-12.5.i586.rpm
   
   openSUSE 10.2:
   ftp://ftp.suse.com/pub/suse/update/10.2/rpm/i586/bind-9.3.5P1-0.1.i586.rpm
   ftp://ftp.suse.com/pub/suse/update/10.2/rpm/i586/bind-chrootenv-9.3.5P1-0.1.i586.rpm
   ftp://ftp.suse.com/pub/suse/update/10.2/rpm/i586/bind-devel-9.3.5P1-0.1.i586.rpm
   ftp://ftp.suse.com/pub/suse/update/10.2/rpm/i586/bind-doc-9.3.5P1-0.1.i586.rpm
   ftp://ftp.suse.com/pub/suse/update/10.2/rpm/i586/bind-libs-9.3.5P1-0.1.i586.rpm
   ftp://ftp.suse.com/pub/suse/update/10.2/rpm/i586/bind-utils-9.3.5P1-0.1.i586.rpm
   
   Open Enterprise Server
     http://support.novell.com/techcenter/psdb/aa846ea840c9bf29e6974f3b6913e550.html
   
   Novell Linux POS 9
     http://support.novell.com/techcenter/psdb/aa846ea840c9bf29e6974f3b6913e550.html
   
   Novell Linux Desktop 9
     http://support.novell.com/techcenter/psdb/aa846ea840c9bf29e6974f3b6913e550.html
   
   SUSE SLES 9
     http://support.novell.com/techcenter/psdb/aa846ea840c9bf29e6974f3b6913e550.html
   
   SUSE Linux Enterprise Server 10 SP1
     http://support.novell.com/techcenter/psdb/555065b7278085ce1ce7a6e84b6f07aa.html
   
   SUSE Linux Enterprise Server 10 SP2
     http://support.novell.com/techcenter/psdb/555065b7278085ce1ce7a6e84b6f07aa.html
   
   SLE SDK 10 SP2
     http://support.novell.com/techcenter/psdb/555065b7278085ce1ce7a6e84b6f07aa.html
   
   SUSE Linux Enterprise 10 SP2 DEBUGINFO
     http://support.novell.com/techcenter/psdb/555065b7278085ce1ce7a6e84b6f07aa.html
   
   SLE SDK 10 SP1
     http://support.novell.com/techcenter/psdb/555065b7278085ce1ce7a6e84b6f07aa.html
   
   SUSE Linux Enterprise Desktop 10 SP1
     http://support.novell.com/techcenter/psdb/555065b7278085ce1ce7a6e84b6f07aa.html
   
   SUSE Linux Enterprise Desktop 10 SP2
     http://support.novell.com/techcenter/psdb/555065b7278085ce1ce7a6e84b6f07aa.html

Turbolinux: new bind packages.
New packages are available:
Turbolinux Appliance Server 3.0 : bind-9.4.2-1
Turbolinux 11 Server : bind-9.4.2-1
Turbolinux Appliance Server 2.0 : bind-9.2.3-16
Turbolinux 10 Server : bind-9.2.3-16
Turbolinux Appliance Server 1.0 : bind-9.2.1-9

VMware ESX: patch for VCB, libpng, bind.
A patch is available:
ESX 3.5.0
  http://download3.vmware.com/software/esx/ESX350-200806203-UG.zip
  http://download3.vmware.com/software/vi/ESX350-200808409-SG.zip
  http://download3.vmware.com/software/esx/ESX350-200808401-BG.zip
ESX 3.0.3
  http://download3.vmware.com/software/vi/ESX303-200808403-SG.zip
  http://download3.vmware.com/software/vi/ESX303-200808404-SG.zip
  http://download3.vmware.com/software/vi/ESX303-200808406-SG.zip
  http://download3.vmware.com/software/vi/ESX-1005109.tgz
 
ESX 3.0.2
  http://download3.vmware.com/software/vi/ESX-1005113.tgz
  http://download3.vmware.com/software/vi/ESX-1005114.tgz
  http://download3.vmware.com/software/vi/ESX-1004824.tgz
  http://download3.vmware.com/software/vi/ESX-1006356.tgz
ESX 3.0.1
  http://download3.vmware.com/software/vi/ESX-1005111.tgz
  http://download3.vmware.com/software/vi/ESX-1005112.tgz
  http://download3.vmware.com/software/vi/ESX-1005108.tgz
  http://download3.vmware.com/software/vi/ESX-1004823.tgz
  http://download3.vmware.com/software/vi/ESX-1005117.tgz
ESX 2.5.5 Upgrade Patch 10
  http://download3.vmware.com/software/esx/esx-2.5.5-119702-upgrade.tar.gz
  md5sum: 2ee87cdd70b1ba84751e24c0bd8b4621
  http://vmware.com/support/esx25/doc/esx-255-200810-patch.html
ESX 2.5.4 Upgrade Patch 21
  http://download3.vmware.com/software/esx/esx-2.5.4-119703-upgrade.tar.gz
  md5sum: d791be525c604c852a03dd7df0eabf35
  http://vmware.com/support/esx25/doc/esx-254-200810-patch.html

Windows: patch for DNS.
A patch is available:
Windows 2000 SP4
  http://www.microsoft.com/downloads/details.aspx?familyid=269c219c-9d6b-4b12-b621-c70cd07cdd22
  http://www.microsoft.com/downloads/details.aspx?familyid=332aa92f-a1ad-42a0-87d0-485d2d41335b
Windows XP SP2, SP3
  http://www.microsoft.com/downloads/details.aspx?familyid=ed989a33-7a9e-4423-93a8-b38907467cdf
Windows XP x64 SP2, SP3
  http://www.microsoft.com/downloads/details.aspx?familyid=a2b016fa-b108-4e8e-b41b-4ca89002907b
Windows Server 2003 SP1, SP2
  http://www.microsoft.com/downloads/details.aspx?familyid=4ef5033c-9843-4e0b-bfad-fcaf05d7dab9
  http://www.microsoft.com/downloads/details.aspx?familyid=d1fcb794-e6a5-4c28-b3b3-9cd88f468a42
Windows Server 2003 x64 SP1, SP2
  http://www.microsoft.com/downloads/details.aspx?familyid=66624a1f-38bf-4af7-936d-3131474ffe1f
  http://www.microsoft.com/downloads/details.aspx?familyid=040a1ba8-21b0-439e-bf21-1acd1c43b162
Windows Server 2003 itanium SP1, SP2
  http://www.microsoft.com/downloads/details.aspx?familyid=facc80da-61d6-49c5-872d-a1980b66ae3e
  http://www.microsoft.com/downloads/details.aspx?familyid=c63e3ee6-6055-4313-b0f1-fec7408886bb
Windows Server 2008 32-bits
  http://www.microsoft.com/downloads/details.aspx?familyid=1fcea8f4-b233-42e1-b913-c4fcae276c7b
Windows Server 2008 x64
  http://www.microsoft.com/downloads/details.aspx?familyid=afac5bbc-71fa-457b-8b0a-f5902d37bfd0
Some firewalls, such as Zone Alarm ZoneAlarm and Check Point Endpoint Security, have to be updated:
  http://download.zonealarm.com/bin/free/pressReleases/2008/LossOfInternetAccessIssue.html
  https://supportcenter.checkpoint.com/supportcenter/index.jsp
Full bulletin, software filtering, emails, fixes, ... (Request your free trial)

Computer vulnerabilities tracking service 

Vigil@nce provides software vulnerability analysis. The technology watch team tracks security threats targeting the computer system.