[ For Public Release ]
-----BEGIN PGP SIGNED MESSAGE-----

             __________________________________________________________

                       The U.S. Department of Energy
                     Computer Incident Advisory Center
                           ___  __ __    _     ___
                          /       |     /_\   /
                          \___  __|__  /   \  \___
             __________________________________________________________

                             INFORMATION BULLETIN

            BIND Inadvertent Local Exposure of HMAC-MD5 (TSIG) Keys
                              [Unix/Linux Systems]

June 12, 2001 17:00 GMT                                           Number L-094
______________________________________________________________________________
PROBLEM:       Keys generated by the dnskeygen utility and the dnssec-keygen 
               utility have an access control vulnerability in one of two 
               files. This vulnerability only exists for systems performing 
               dynamic updates using HMAC-MD5 keys. 
PLATFORM:      All versions of BIND with dnskeygen, up to and including BIND 
               8.2.4.
               All versions of BIND with dnssec-keygen, up to and 
               including BIND 9.1.2. 

               This flaw only affects sites that use Dynamic DNS updates with
               HMAC-MD5 keys and does not affect any sites that only use static
               zone files (the majority of BIND installations). Sites that
               perform dynamic DNS updates from otherwise secured systems (such
               as a dedicated DHCP server having no common users) are not
               affected by this flaw. 
DAMAGE:        A malicious party accessing the vulnerable key file may cause 
               unintended updates to a DNS server. The keying material for DNS 
               updates is also vulnerable to retrieval. The integrity of the 
               DNS server is placed at risk. 
SOLUTION:      Review the advisory and perform necessary upgrading and file 
               checking, as specified. 
______________________________________________________________________________
VULNERABILITY  The risk is LOW. There have been no reported exploits of this 
ASSESSMENT:    vulnerability. This vulnerability does not exist for those 
               sites using static zone files, or sites that perform dynamic 
               updates from other secured servers. 
______________________________________________________________________________

[******  Begin ISS Bulletin ******]

http://www.ciac.org/ciac/bulletins/l-094.shtml

[******  End ISS Bulletin ******]

_______________________________________________________________________________


-----BEGIN PGP SIGNATURE-----
Version: 4.0 Business Edition

iQCVAwUBOyaL+LnzJzdsy3QZAQGW0AQA+v6lv2RdkPoz6loSzCi79inVWTSj4KHW
gGyRKu9rifgQw5c3n5Vdh/S+Ve9bZcFdX5rBqEwfn8AAaTPGGdn6BnAqwQPd0kl+
4IsDvHMh5xcZKNJdrkRZtydyJZdcIxG5Z7Cj80sP8qDlZTjJbR/rdkDPsUC1gP8B
4+zXR1Iy+Kc=
=CFlg
-----END PGP SIGNATURE-----

-+#+--+#+--+#+--+#+--+#+--+#+--+#+--+#+--+#+--+#+--+#+--+#+--+#+--+#+--+
This message was posted through the FIRST mailing list server.  If you
wish to unsubscribe from this mailing list, send the message body of
"unsubscribe first-info" to first-majordomo@FIRST.ORG
-+#+--+#+--+#+--+#+--+#+--+#+--+#+--+#+--+#+--+#+--+#+--+#+--+#+--+#+--+