site_archiver@lists.apple.com Delivered-To: security-announce@lists.apple.com -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 APPLE-SA-2009-08-12-1 Security Update 2009-004 Security Update 2009-004 is now available and addresses the following: BIND CVE-ID: CVE-2009-0696 Available for: Mac OS X v10.4.11, Mac OS X Server v10.4.11, Mac OS X v10.5.8, Mac OS X Server v10.5.8 Impact: A remote attacker may be able to cause the DNS server to unexpectedly terminate Description: A logic issue in the handling of dynamic DNS update messages may cause an assertion to be triggered. By sending a maliciously crafted update message to the BIND DNS server, a remote attacker may be able to interrupt the BIND service. The issue affects servers which are masters for one or more zones, regardless of whether they accept updates. BIND is included with Mac OS X and Mac OS X Server but it is not enabled by default. This update addresses the issue by properly rejecting messages with a record of type 'ANY' where an assertion would previously have been raised. Security Update 2009-004 may be obtained from the Software Update pane in System Preferences, or Apple's Software Downloads web site: http://www.apple.com/support/downloads/ For Mac OS X v10.5.8 and Mac OS X Server 10.5.8 The download file is named: "SecUpd2009-004.dmg" Its SHA-1 digest is: 9fefe6349e8fb9ed47d44b572a11e6c66daf4dac For Mac OS X v10.4.11 (Intel) The download file is named: "SecUpd2009-004Intel.dmg" Its SHA-1 digest is: 28e1d0ad3a97f3b5e17ebe6367532e103b69d3a0 For Mac OS X v10.4.11 (PPC) The download file is named: "SecUpd2009-004PPC.dmg" Its SHA-1 digest is: e9ed8d53d6bc055e44768f1d1e894f505f1fd6fe For Mac OS X Server v10.4.11 (Universal) The download file is named: "SecUpdSrvr2009-004Univ.dmg" Its SHA-1 digest is: dfb57125139c058655b847135bff50216f3ea577 For Mac OS X Server v10.4.11 (PPC) The download file is named: "SecUpdSrvr2009-004PPC.dmg" Its SHA-1 digest is: c95b0c305d7d3f365b7ff768b995da38529ec393 Information will also be posted to the Apple Security Updates web site: http://support.apple.com/kb/HT1222 This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.9 (Darwin) iQEcBAEBAgAGBQJKgw9WAAoJEHkodeiKZIkBDHEH/05S2RKm3kXqm73+tzlG9tH0 mDjalEZELKEeYLCfQebcqAFISDW05jNPiHHteCwiR/GYY52zmvnBYWc0mfjmHI97 9OaITgYDEO6e8cnToSgANfAvJ/tZfmC79F/eDjbSM1XTIJqD4pdyiQmZxTby9zpj APSO1xjxUFsgo5CqScxK3al9JIUs8yo/R+iA/VT+92JurR7m/wEma90CRggSfFKk gVZLhoOXAID3+Qxq5L20kyUBgI53WoAm8IKuq/0DULmZBrP5k4PAJCwBZHwdgWR1 nVmf6IN5BCGhyRGgbAMxo+pnBHsdofVkaD2ia9fh64U5MmB1rcUSFHk4TMMpFXM= =yJAK -----END PGP SIGNATURE----- _______________________________________________ Do not post admin requests to the list. They will be ignored. Security-announce mailing list (Security-announce@lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/security-announce/site_archiver%40lis... This email sent to site_archiver@lists.apple.com