To: bugtraq@securityfocus.com announce@lists.caldera.com scoannmod@xenitec.on.ca


______________________________________________________________________________

		Caldera International, Inc.  Security Advisory

Subject:		UnixWare 7.1.1 : Multiple Vulnerabilities in BIND
Advisory number: 	CSSA-2002-SCO.16
Issue date: 		2002 April 12
Cross reference:
______________________________________________________________________________


1. Problem Description

	This patch corrects several problems in earlier versions of
	BIND Version 8 which can result in security vulnerabilities of
	varying levels of severity.  These vulnerabilities are
	described in CERT Advisory CA-2001-02.  It is strongly
	recommended that users of BIND Version 8 upgrade to BIND
	Version 8.2.3-REL.


2. Vulnerable Supported Versions

	System				Files
	----------------------------------------------------------------------
	UnixWare 7.1.1 			/usr/lib/nslookup.help
					/usr/sbin/addr
					/usr/sbin/dig
					/usr/sbin/dnskeygen
					/usr/sbin/dnsquery
					/usr/sbin/host
					/usr/sbin/in.named
					/usr/sbin/irpd
					/usr/sbin/mkservdb
					/usr/sbin/named-bootconf
					/usr/sbin/named-xfer
					/usr/sbin/ndc
					/usr/sbin/nslookup
					/usr/sbin/nsupdate


3. Solution

	The proper solution is to install the latest packages.


4. UnixWare 7.1.1

	4.1 Location of Fixed Binaries

	ftp://stage.caldera.com/pub/security/unixware/CSSA-2002-SCO.16

4.2 Verification

	MD5 (ptf7705a.pkg.Z) = a1aaccb7a523c241c9380c7ea97d3398

	md5 is available for download from
		ftp://stage.caldera.com/pub/security/tools/


4.3 Installing Fixed Binaries

	Upgrade the affected binaries with the following commands:

	Download ptf7705a.pkg.Z to the /var/spool/pkg directory

	# uncompress /var/spool/pkg/ptf7705a.pkg.Z
	# pkgadd -d /var/spool/pkg/ptf7705a.pkg


5. References

	Specific references for this advisory:
		http://www.cert.org/advisories/CA-2001-02.html

Caldera UNIX security resources:
		http://stage.caldera.com/support/security/

Caldera OpenLinux security resources:
		http://www.caldera.com/support/security/index.html

This security fix closes Caldera incidents sr379321, fz515683,
	erg711601.


6. Disclaimer

	Caldera International, Inc. is not responsible for the misuse
	of any of the information we provide on this website and/or
	through our security advisories. Our advisories are a service
	to our customers intended to promote secure installation and
	use of Caldera products.