libbind buffer overflow

[Mark_Andrews at isc.org]

> 
> Mark_Andrews at isc.org wrote in message news:<aggo19$885c$1 at isrv4.isc.org>...
> > > 
> > > I just a bit confused on how to address this new security
> > > vulnerability. I am running ISC BIND 8.2.3 on Solaris 2.6. According
> > > to the security advisory, it says I should upgrade to version BIND
> > > 8.3.3 to update libbind. But it also has a Sun Systems section which
> > > says to wait for the patch from Sun to update libresolv.so.
> > > 
> > > So my question is, do I only need to upgrade to BIND 8.3.3, or just
> > > update libresolv.so, or do I need to do both?
> > 
> > 	Both.  You will also need to relink any applications you
> > 	linked with libbind from BIND 8.x.
>          
>         Thanx for the reply. Just one more question, is there a way to
> tell what applications are linked to either libbind or libresolv.so?
> Or should there be someway to check from each application
> individually.

	ldd will tell you if the application is linked with libresolv.so.

	Find libbind.a.  Extract all the .o's from it.  Run strings on them.
	Pick a likely string.
	e.g. "$Id: gethostent.c,v 1.28 2001/03/01 05:47:44 marka Exp $"
	Then for all non shared executables run strings on them looking for
	that string.

	gethostent.c was choosen because it should be in any potentially
	vulnerable applications.

	See the man pages for file, find, grep, xargs, ldd.

	e.g.

	find / -type f -perm +0111 -print |
	xargs strings -f |
	grep gethostent.c

	Note: this has not been tested.

	Mark

> 
> > 
> > > 
> > > Regards,
> > > Rudebwoy
> > >
> 
--
Mark Andrews, Internet Software Consortium
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742                 INTERNET: Mark.Andrews at isc.org