diff options
author | Doug Barton <dougb@FreeBSD.org> | 2006-11-04 07:53:25 +0000 |
---|---|---|
committer | Doug Barton <dougb@FreeBSD.org> | 2006-11-04 07:53:25 +0000 |
commit | a02f92e875d0d48c46103eef0fbea835048a278b (patch) | |
tree | 3043007b955457643a8aaf7cdf24ff1224d3f8e4 /contrib/bind9/lib/isc/sha1.c | |
parent | 42b74b2549a0891d22d649ac2404abee2d26ccda (diff) | |
download | src-a02f92e875d0d48c46103eef0fbea835048a278b.tar.gz src-a02f92e875d0d48c46103eef0fbea835048a278b.zip |
Update to version 9.3.2-P2, which addresses the vulnerability
announced by ISC dated 31 October (delivered via e-mail to the
bind-announce@isc.org list on 2 November):
Description:
Because of OpenSSL's recently announced vulnerabilities
(CAN-2006-4339, CVE-2006-2937 and CVE-2006-2940) which affect named,
we are announcing this workaround and releasing patches. A proof of
concept attack on OpenSSL has been demonstrated for CAN-2006-4339.
OpenSSL is required to use DNSSEC with BIND.
Fix for version 9.3.2-P1 and lower:
Upgrade to BIND 9.3.2-P2, then generate new RSASHA1 and
RSAMD5 keys for all old keys using the old default exponent
and perform a key rollover to these new keys.
These versions also change the default RSA exponent to be
65537 which is not vulnerable to the attacks described in
CAN-2006-4339.
Notes
Notes:
svn path=/vendor/bind9/dist/; revision=163976
Diffstat (limited to 'contrib/bind9/lib/isc/sha1.c')
0 files changed, 0 insertions, 0 deletions