The following security updates has been released for Debian GNU/Linux:

Debian GNU/Linux 7 Extended LTS:
ELA-31 bind9 security update

Debian GNU/Linux 8 LTS:
DLA 1483-1: 389-ds-base security update
DLA 1485-1: bind9 security update

ELA-31 bind9 security update

Package: bind9
Version: 1:9.8.4.dfsg.P1-6+nmu2+deb7u21
Related CVE: CVE-2018-5740
The “deny-answer-aliases” feature in BIND has a flaw which can cause named to exit with an assertion failure.

For Debian 7 Wheezy, these problems have been fixed in version 1:9.8.4.dfsg.P1-6+nmu2+deb7u21.

We recommend that you upgrade your bind9 packages.

Further information about Extended LTS security advisories can be found at: https://deb.freexian.com/extended-lts/

DLA 1483-1: 389-ds-base security update

Package : 389-ds-base
Version : 1.3.3.5-4+deb8u2
CVE ID : CVE-2018-10871 CVE-2018-10935
Debian Bug : 906985


CVE-2018-10871

By default nsslapd-unhashed-pw-switch was set to 'on'. So a copy of
the unhashed password was kept in modifiers and was possibly logged in
changelog and retroCL.

Unless it is used by some plugin it does not require to keep unhashed
passwords. The nsslapd-unhashed-pw-switch option is now 'off' by
default.


CVE-2018-10935

It was discovered that any authenticated user doing a search using
ldapsearch with extended controls for server side sorting could bring
down the LDAP server itself.

The fix is to check if we are able to index the provided value. If we
are not, then slapd_qsort returns an error (LDAP_OPERATION_ERROR) .


For Debian 8 "Jessie", these problems have been fixed in version
1.3.3.5-4+deb8u2.

We recommend that you upgrade your 389-ds-base packages.

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS

--

mike gabriel aka sunweaver (Debian Developer)
fon: +49 (1520) 1976 148

GnuPG Fingerprint: 9BFB AEE8 6C0A A5FF BF22 0782 9AF4 6B30 2577 1B31
mail: sunweaver@debian.org, http://sunweavers.net

DLA 1485-1: bind9 security update

Package : bind9
Version : 1:9.9.5.dfsg-9+deb8u16
CVE ID : CVE-2018-5740


CVE-2018-5740
The "deny-answer-aliases" feature in BIND has a flaw which can
cause named to exit with an assertion failure.


For Debian 8 "Jessie", this problem has been fixed in version
1:9.9.5.dfsg-9+deb8u16.

We recommend that you upgrade your bind9 packages.

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS