Security update for bind SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2020:14400-1 Final 1 1 2020-06-19T14:11:27Z current 2020-06-19T14:11:27Z 2020-06-19T14:11:27Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for bind This update for bind fixes the following issues: - CVE-2020-8616: Fixed the insufficient limit on the number of fetches performed when processing referrals (bsc#1171740). - CVE-2020-8617: Fixed a logic error in code which checks TSIG validity (bsc#1171740). - CVE-2018-5741: Fixed the documentation (bsc#1109160). - Removed rndc.key generation from bind.spec file (bsc#1092283, bsc#1033843) bind should create the key on first boot or if it went missing. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). sleposp3-bind-14400,slessp4-bind-14400 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2020/suse-su-202014400-1/ Link for SUSE-SU-2020:14400-1 https://lists.suse.com/pipermail/sle-security-updates/2020-June/006991.html E-Mail link for SUSE-SU-2020:14400-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1033843 SUSE Bug 1033843 https://bugzilla.suse.com/1092283 SUSE Bug 1092283 https://bugzilla.suse.com/1109160 SUSE Bug 1109160 https://bugzilla.suse.com/1171740 SUSE Bug 1171740 https://bugzilla.suse.com/1172220 SUSE Bug 1172220 https://bugzilla.suse.com/1172680 SUSE Bug 1172680 https://www.suse.com/security/cve/CVE-2018-5741/ SUSE CVE CVE-2018-5741 page https://www.suse.com/security/cve/CVE-2020-8616/ SUSE CVE CVE-2020-8616 page https://www.suse.com/security/cve/CVE-2020-8617/ SUSE CVE CVE-2020-8617 page SUSE Linux Enterprise Point of Sale 11 SP3 SUSE Linux Enterprise Server 11 SP4-LTSS bind-9.9.6P1-0.51.20.1 bind-chrootenv-9.9.6P1-0.51.20.1 bind-devel-9.9.6P1-0.51.20.1 bind-doc-9.9.6P1-0.51.20.1 bind-libs-9.9.6P1-0.51.20.1 bind-utils-9.9.6P1-0.51.20.1 bind-libs-32bit-9.9.6P1-0.51.20.1 bind-9.9.6P1-0.51.20.1 as a component of SUSE Linux Enterprise Point of Sale 11 SP3 bind-chrootenv-9.9.6P1-0.51.20.1 as a component of SUSE Linux Enterprise Point of Sale 11 SP3 bind-devel-9.9.6P1-0.51.20.1 as a component of SUSE Linux Enterprise Point of Sale 11 SP3 bind-doc-9.9.6P1-0.51.20.1 as a component of SUSE Linux Enterprise Point of Sale 11 SP3 bind-libs-9.9.6P1-0.51.20.1 as a component of SUSE Linux Enterprise Point of Sale 11 SP3 bind-utils-9.9.6P1-0.51.20.1 as a component of SUSE Linux Enterprise Point of Sale 11 SP3 bind-9.9.6P1-0.51.20.1 as a component of SUSE Linux Enterprise Server 11 SP4-LTSS bind-chrootenv-9.9.6P1-0.51.20.1 as a component of SUSE Linux Enterprise Server 11 SP4-LTSS bind-doc-9.9.6P1-0.51.20.1 as a component of SUSE Linux Enterprise Server 11 SP4-LTSS bind-libs-9.9.6P1-0.51.20.1 as a component of SUSE Linux Enterprise Server 11 SP4-LTSS bind-libs-32bit-9.9.6P1-0.51.20.1 as a component of SUSE Linux Enterprise Server 11 SP4-LTSS bind-utils-9.9.6P1-0.51.20.1 as a component of SUSE Linux Enterprise Server 11 SP4-LTSS To provide fine-grained controls over the ability to use Dynamic DNS (DDNS) to update records in a zone, BIND 9 provides a feature called update-policy. Various rules can be configured to limit the types of updates that can be performed by a client, depending on the key used when sending the update request. Unfortunately, some rule types were not initially documented, and when documentation for them was added to the Administrator Reference Manual (ARM) in change #3112, the language that was added to the ARM at that time incorrectly described the behavior of two rule types, krb5-subdomain and ms-subdomain. This incorrect documentation could mislead operators into believing that policies they had configured were more restrictive than they actually were. This affects BIND versions prior to BIND 9.11.5 and BIND 9.12.3. CVE-2018-5741 SUSE Linux Enterprise Point of Sale 11 SP3:bind-9.9.6P1-0.51.20.1 SUSE Linux Enterprise Point of Sale 11 SP3:bind-chrootenv-9.9.6P1-0.51.20.1 SUSE Linux Enterprise Point of Sale 11 SP3:bind-devel-9.9.6P1-0.51.20.1 SUSE Linux Enterprise Point of Sale 11 SP3:bind-doc-9.9.6P1-0.51.20.1 SUSE Linux Enterprise Point of Sale 11 SP3:bind-libs-9.9.6P1-0.51.20.1 SUSE Linux Enterprise Point of Sale 11 SP3:bind-utils-9.9.6P1-0.51.20.1 SUSE Linux Enterprise Server 11 SP4-LTSS:bind-9.9.6P1-0.51.20.1 SUSE Linux Enterprise Server 11 SP4-LTSS:bind-chrootenv-9.9.6P1-0.51.20.1 SUSE Linux Enterprise Server 11 SP4-LTSS:bind-doc-9.9.6P1-0.51.20.1 SUSE Linux Enterprise Server 11 SP4-LTSS:bind-libs-32bit-9.9.6P1-0.51.20.1 SUSE Linux Enterprise Server 11 SP4-LTSS:bind-libs-9.9.6P1-0.51.20.1 SUSE Linux Enterprise Server 11 SP4-LTSS:bind-utils-9.9.6P1-0.51.20.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2020/suse-su-202014400-1/ https://www.suse.com/security/cve/CVE-2018-5741.html CVE-2018-5741 https://bugzilla.suse.com/1109160 SUSE Bug 1109160 https://bugzilla.suse.com/1171740 SUSE Bug 1171740 A malicious actor who intentionally exploits this lack of effective limitation on the number of fetches performed when processing referrals can, through the use of specially crafted referrals, cause a recursing server to issue a very large number of fetches in an attempt to process the referral. This has at least two potential effects: The performance of the recursing server can potentially be degraded by the additional work required to perform these fetches, and The attacker can exploit this behavior to use the recursing server as a reflector in a reflection attack with a high amplification factor. CVE-2020-8616 SUSE Linux Enterprise Point of Sale 11 SP3:bind-9.9.6P1-0.51.20.1 SUSE Linux Enterprise Point of Sale 11 SP3:bind-chrootenv-9.9.6P1-0.51.20.1 SUSE Linux Enterprise Point of Sale 11 SP3:bind-devel-9.9.6P1-0.51.20.1 SUSE Linux Enterprise Point of Sale 11 SP3:bind-doc-9.9.6P1-0.51.20.1 SUSE Linux Enterprise Point of Sale 11 SP3:bind-libs-9.9.6P1-0.51.20.1 SUSE Linux Enterprise Point of Sale 11 SP3:bind-utils-9.9.6P1-0.51.20.1 SUSE Linux Enterprise Server 11 SP4-LTSS:bind-9.9.6P1-0.51.20.1 SUSE Linux Enterprise Server 11 SP4-LTSS:bind-chrootenv-9.9.6P1-0.51.20.1 SUSE Linux Enterprise Server 11 SP4-LTSS:bind-doc-9.9.6P1-0.51.20.1 SUSE Linux Enterprise Server 11 SP4-LTSS:bind-libs-32bit-9.9.6P1-0.51.20.1 SUSE Linux Enterprise Server 11 SP4-LTSS:bind-libs-9.9.6P1-0.51.20.1 SUSE Linux Enterprise Server 11 SP4-LTSS:bind-utils-9.9.6P1-0.51.20.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2020/suse-su-202014400-1/ https://www.suse.com/security/cve/CVE-2020-8616.html CVE-2020-8616 https://bugzilla.suse.com/1109160 SUSE Bug 1109160 https://bugzilla.suse.com/1171740 SUSE Bug 1171740 Using a specially-crafted message, an attacker may potentially cause a BIND server to reach an inconsistent state if the attacker knows (or successfully guesses) the name of a TSIG key used by the server. Since BIND, by default, configures a local session key even on servers whose configuration does not otherwise make use of it, almost all current BIND servers are vulnerable. In releases of BIND dating from March 2018 and after, an assertion check in tsig.c detects this inconsistent state and deliberately exits. Prior to the introduction of the check the server would continue operating in an inconsistent state, with potentially harmful results. CVE-2020-8617 SUSE Linux Enterprise Point of Sale 11 SP3:bind-9.9.6P1-0.51.20.1 SUSE Linux Enterprise Point of Sale 11 SP3:bind-chrootenv-9.9.6P1-0.51.20.1 SUSE Linux Enterprise Point of Sale 11 SP3:bind-devel-9.9.6P1-0.51.20.1 SUSE Linux Enterprise Point of Sale 11 SP3:bind-doc-9.9.6P1-0.51.20.1 SUSE Linux Enterprise Point of Sale 11 SP3:bind-libs-9.9.6P1-0.51.20.1 SUSE Linux Enterprise Point of Sale 11 SP3:bind-utils-9.9.6P1-0.51.20.1 SUSE Linux Enterprise Server 11 SP4-LTSS:bind-9.9.6P1-0.51.20.1 SUSE Linux Enterprise Server 11 SP4-LTSS:bind-chrootenv-9.9.6P1-0.51.20.1 SUSE Linux Enterprise Server 11 SP4-LTSS:bind-doc-9.9.6P1-0.51.20.1 SUSE Linux Enterprise Server 11 SP4-LTSS:bind-libs-32bit-9.9.6P1-0.51.20.1 SUSE Linux Enterprise Server 11 SP4-LTSS:bind-libs-9.9.6P1-0.51.20.1 SUSE Linux Enterprise Server 11 SP4-LTSS:bind-utils-9.9.6P1-0.51.20.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2020/suse-su-202014400-1/ https://www.suse.com/security/cve/CVE-2020-8617.html CVE-2020-8617 https://bugzilla.suse.com/1109160 SUSE Bug 1109160 https://bugzilla.suse.com/1171740 SUSE Bug 1171740