Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 =========================================================================== AUSCERT External Security Bulletin Redistribution ESB-2017.0111.2 K86272821: BIND vulnerability CVE-2016-9131 and K40181790: BIND vulnerability CVE-2016-9444 2 November 2017 =========================================================================== AusCERT Security Bulletin Summary --------------------------------- Product: F5 products Publisher: F5 Networks Operating System: Network Appliance Impact/Access: Denial of Service -- Remote/Unauthenticated Resolution: Patch/Upgrade CVE Names: CVE-2016-9444 CVE-2016-9131 Reference: ESB-2017.0097 ESB-2017.0094 ESB-2017.0088 ESB-2017.0087 Original Bulletin: https://support.f5.com/csp/article/K86272821 https://support.f5.com/csp/article/K40181790 Comment: This bulletin contains two (2) F5 Networks security advisories. Revision History: November 2 2017: Patch released January 13 2017: Initial Release - --------------------------BEGIN INCLUDED TEXT-------------------- K86272821: BIND vulnerability CVE-2016-9131 Security Advisory Original Publication Date: Jan 13, 2017 Updated Date: Nov 01, 2017 Applies to (see versions): o Product: BIG-IQ, BIG-IQ Cloud, BIG-IQ Device, BIG-IQ Security, BIG-IQ ADC, BIG-IQ Centralized Management 5.3.0, 5.2.0, 5.1.0, 5.0.0, 4.6.0, 4.5.0, 4.4.0, 4.3.0, 4.2.0, 4.1.0, 4.0.0 o Product: BIG-IP, BIG-IP AAM, BIG-IP AFM, BIG-IP Analytics, BIG-IP APM, BIG-IP ASM, BIG-IP DNS, BIG-IP Edge Gateway, BIG-IP GTM, BIG-IP Link Controller, BIG-IP LTM, BIG-IP PEM, BIG-IP PSM, BIG-IP WebAccelerator 13.0.0, 12.1.2, 12.1.1, 12.1.0, 12.0.0, 11.6.2, 11.6.1, 11.6.0, 11.5.5, 11.5.4, 11.5.3, 11.5.2, 11.5.1, 11.5.0, 11.4.1, 11.4.0, 11.2.1 o Product: Enterprise Manager 3.1.1 o Product: F5 iWorkflow 2.3.0, 2.2.0, 2.1.0, 2.0.2, 2.0.1, 2.0.0 o Product: LineRate 2.6.1, 2.6.0, 2.5.2, 2.5.1, 2.5.0 o Product: ARX, ARX 6.4.0, 6.3.0, 6.2.0 o Product: F5 WebSafe 1.0.0 o Product: Traffix SDC 5.1.0, 4.4.0, 4.0.5, 4.0.2, 4.0.0 o Product: BIG-IQ Cloud and Orchestration 1.0.0 Security Advisory Description named in ISC BIND 9.x before 9.9.9-P5, 9.10.x before 9.10.4-P5, and 9.11.x before 9.11.0-P2 allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a malformed response to an RTYPE ANY query. (CVE-2016-9131) Impact When the BIND recursion option is enabled, an attacker may exploit this vulnerability to cause the named process to restart. Additionally, the restarted process does not trigger the BIG-IP system high availability (HA) failover event. By default, the BIND recursion option is not enabled on BIG-IP DNS or GTM systems. If the BIND recursion option is enabled, BIG-IP DNS or GTM systems are vulnerable. Security Advisory Status F5 Product Development has assigned ID 636699 (BIG-IP) to this vulnerability. To determine if your release is known to be vulnerable, the components or features that are affected by the vulnerability, and for information about releases or hotfixes that address the vulnerability, refer to the following table: +---------------+---------------+-----------------+-----------+---------------+ | |Versions known |Versions known to| |Vulnerable | |Product |to be |be not vulnerable|Severity |component or | | |vulnerable | | |feature | +---------------+---------------+-----------------+-----------+---------------+ | | |13.0.0 HF1 | | | | |13.0.0 |12.1.2 HF1 | | | | |12.0.0 - 12.1.2|11.6.2 | | | | |11.4.1 - 11.6.1|11.5.4 HF3 | | | | |11.4.0 HF3 and |11.4.0 - 11.4.0 | | | |BIG-IP LTM |later |HF2 |High |BIND | | |11.3.0 HF7 and |11.3.0 - 11.3.0 | | | | |later |HF6 | | | | |11.2.1 HF9 and |11.0.0 - 11.2.1 | | | | |later |HF8 | | | | | |10.1.0 - 10.2.4 | | | +---------------+---------------+-----------------+-----------+---------------+ | |13.0.0 |13.0.0 HF1 | | | | |12.0.0 - 12.1.2|12.1.2 HF1 | | | |BIG-IP AAM |11.4.1 - 11.6.1|11.6.2 |High |BIND | | |11.4.0 HF3 and |11.5.4 HF3 | | | | |later |11.4.0 - 11.4.0 | | | | | |HF2 | | | +---------------+---------------+-----------------+-----------+---------------+ | |13.0.0 |13.0.0 HF1 | | | | |12.0.0 - 12.1.2|12.1.2 HF1 | | | |BIG-IP AFM |11.4.1 - 11.6.1|11.6.2 |High |BIND | | |11.4.0 HF3 and |11.5.4 HF3 | | | | |later |11.4.0 - 11.4.0 | | | | | |HF2 | | | +---------------+---------------+-----------------+-----------+---------------+ | |13.0.0 |13.0.0 HF1 | | | | |12.0.0 - 12.1.2|12.1.2 HF1 | | | | |11.4.1 - 11.6.1|11.6.2 | | | | |11.4.0 HF3 and |11.5.4 HF3 | | | |BIG-IP |later |11.4.0 - 11.4.0 |High |BIND | |Analytics |11.3.0 HF7 and |HF2 | | | | |later |11.3.0 - 11.3.0 | | | | |11.2.1 HF9 and |HF6 | | | | |later |11.2.1 - 11.2.1 | | | | | |HF8 | | | +---------------+---------------+-----------------+-----------+---------------+ | |13.0.0 |13.0.0 HF1 | | | | |12.0.0 - 12.1.2|12.1.2 HF1 | | | | |11.4.1 - 11.6.1|11.6.2 | | | | |11.4.0 HF3 and |11.5.4 HF3 | | | |BIG-IP APM |later |11.4.0 - 11.4.0 |High |BIND | | |11.3.0 HF7 and |HF2 | | | | |later |11.3.0 - 11.3.0 | | | | |11.2.1 HF9 and |HF6 | | | | |later |11.2.1 - 11.2.1 | | | | | |HF8 | | | +---------------+---------------+-----------------+-----------+---------------+ | |13.0.0 |13.0.0 HF1 | | | | |12.0.0 - 12.1.2|12.1.2 HF1 | | | | |11.4.1 - 11.6.1|11.6.2 | | | | |11.4.0 HF3 and |11.5.4 HF3 | | | |BIG-IP ASM |later |11.4.0 - 11.4.0 |High |BIND | | |11.3.0 HF7 and |HF2 | | | | |later |11.3.0 - 11.3.0 | | | | |11.2.1 HF9 and |HF6 | | | | |later |11.2.1 - 11.2.1 | | | | | |HF8 | | | +---------------+---------------+-----------------+-----------+---------------+ |BIG-IP DNS |13.0.0 |13.0.0 HF1 |High |BIND | | |12.0.0 - 12.1.2|12.1.2 HF1 | | | +---------------+---------------+-----------------+-----------+---------------+ |BIG-IP Edge |11.2.1 HF9 and |11.2.1 - 11.2.1 |High |BIND | |Gateway |later |HF8 | | | +---------------+---------------+-----------------+-----------+---------------+ | | |11.6.2 | | | | |11.4.1 - 11.6.1|11.5.4 HF3 | | | | |11.4.0 HF3 and |11.4.0 - 11.4.0 | | | | |later |HF2 | | | |BIG-IP GTM |11.3.0 HF7 and |11.3.0 - 11.3.0 |High |BIND | | |later |HF6 | | | | |11.2.1 HF9 and |11.0.0 - 11.2.1 | | | | |later |HF8 | | | | | |10.1.0 - 10.2.4 | | | +---------------+---------------+-----------------+-----------+---------------+ | | |13.0.0 HF1 | | | | |13.0.0 |12.1.2 HF1 | | | | |12.0.0 - 12.1.2|11.6.2 | | | | |11.4.1 - 11.6.1|11.5.4 HF3 | | | |BIG-IP Link |11.4.0 HF3 and |11.4.0 - 11.4.0 | | | |Controller |later |HF2 |High |BIND | | |11.3.0 HF7 and |11.3.0 - 11.3.0 | | | | |later |HF6 | | | | |11.2.1 HF9 and |11.0.0 - 11.2.1 | | | | |later |HF8 | | | | | |10.1.0 - 10.2.4 | | | +---------------+---------------+-----------------+-----------+---------------+ | |13.0.0 |13.0.0 HF1 | | | | |12.0.0 - 12.1.2|11.6.2 | | | |BIG-IP PEM |11.4.1 - 11.6.1|12.1.2 HF1 |High |BIND | | |11.4.0 HF3 and |11.5.4 HF3 | | | | |later |11.4.0 - 11.4.0 | | | | | |HF2 | | | +---------------+---------------+-----------------+-----------+---------------+ | |11.4.1 |11.4.0 - 11.4.0 | | | |BIG-IP PSM |11.4.0 HF3 and |HF2 |High |BIND | | |later | | | | +---------------+---------------+-----------------+-----------+---------------+ |BIG-IP |11.2.1 HF9 and |11.2.1 - 11.2.1 |High |BIND | |WebAccelerator |later |HF8 | | | +---------------+---------------+-----------------+-----------+---------------+ | |13.0.0 | | | | |BIG-IP WebSafe |12.0.0 - 12.1.2|11.6.2 |High |BIND | | |11.6.0 - 11.6.1| | | | +---------------+---------------+-----------------+-----------+---------------+ |ARX |None |6.2.0 - 6.4.0 |Not |None | | | | |vulnerable | | +---------------+---------------+-----------------+-----------+---------------+ |Enterprise | | |Not | | |Manager |None |3.1.1 |vulnerable^|None | | | | |1 | | +---------------+---------------+-----------------+-----------+---------------+ | | | |Not | | |BIG-IQ Cloud |None |4.0.0 - 4.5.0 |vulnerable^|None | | | | |1 | | +---------------+---------------+-----------------+-----------+---------------+ | | | |Not | | |BIG-IQ Device |None |4.2.0 - 4.5.0 |vulnerable^|None | | | | |1 | | +---------------+---------------+-----------------+-----------+---------------+ | | | |Not | | |BIG-IQ Security|None |4.0.0 - 4.5.0 |vulnerable^|None | | | | |1 | | +---------------+---------------+-----------------+-----------+---------------+ | | | |Not | | |BIG-IQ ADC |None |4.5.0 |vulnerable^|None | | | | |1 | | +---------------+---------------+-----------------+-----------+---------------+ |BIG-IQ | |5.0.0 - 5.3.0 |Not | | |Centralized |None |4.6.0 |vulnerable^|None | |Management | | |1 | | +---------------+---------------+-----------------+-----------+---------------+ |BIG-IQ Cloud | | |Not | | |and |None |1.0.0 |vulnerable^|None | |Orchestration | | |1 | | +---------------+---------------+-----------------+-----------+---------------+ | | | |Not | | |F5 iWorkflow |None |2.0.0 - 2.3.0 |vulnerable^|None | | | | |1 | | +---------------+---------------+-----------------+-----------+---------------+ | | | |Not | | |LineRate |None |2.5.0 - 2.6.1 |vulnerable^|None | | | | |1 | | +---------------+---------------+-----------------+-----------+---------------+ |Traffix SDC |None |4.0.0 - 5.1.0 |Not |None | | | | |vulnerable | | +---------------+---------------+-----------------+-----------+---------------+ ^1 The specified products contain the affected code. However, F5 identifies the vulnerability status as Not vulnerable because the attacker cannot exploit the code in default, standard, or recommended configurations. Security Advisory Recommended Actions If you are running a version listed in the Versions known to be vulnerable column, you can eliminate this vulnerability by upgrading to a version listed in the Versions known to be not vulnerable column. If the table lists only an older version than what you are currently running, or does not list a non-vulnerable version, then no upgrade candidate currently exists. Mitigation To mitigate this vulnerability, you can use an iRule to drop client RTYPE=ANY queries. Impact of action: The impact of the suggested mitigation will depend on the specific environment. F5 recommends that you test any such changes during a maintenance window and consider the possible impact on your specific environment. Supplemental Information o K17329: BIG-IP GTM name has changed to BIG-IP DNS o K9970: Subscribing to email notifications regarding F5 products o K9957: Creating a custom RSS feed to view new and updated documents o K4602: Overview of the F5 security vulnerability response policy o K4918: Overview of the F5 critical issue hotfix policy o K167: Downloading software and firmware from F5 o K13123: Managing BIG-IP product hotfixes (11.x - 13.x) o K9502: BIG-IP hotfix matrix ============================================================================== Final - K40181790: BIND vulnerability CVE-2016-9444 Security Advisory Original Publication Date: Jan 13, 2017 Updated Date: Nov 01, 2017 Applies to (see versions): o Product: BIG-IQ, BIG-IQ Cloud, BIG-IQ Device, BIG-IQ Security, BIG-IQ ADC, BIG-IQ Centralized Management 5.1.0, 5.0.0, 4.6.0, 4.5.0, 4.4.0, 4.3.0, 4.2.0, 4.1.0, 4.0.0 o Product: BIG-IP, BIG-IP AAM, BIG-IP AFM, BIG-IP Analytics, BIG-IP APM, BIG-IP ASM, BIG-IP DNS, BIG-IP Edge Gateway, BIG-IP GTM, BIG-IP Link Controller, BIG-IP LTM, BIG-IP PEM, BIG-IP PSM, BIG-IP WebAccelerator 13.0.0, 12.1.2, 12.1.1, 12.1.0, 12.0.0, 11.6.2, 11.6.1, 11.6.0, 11.5.5, 11.5.4, 11.5.3, 11.5.2, 11.5.1, 11.5.0, 11.4.1, 11.4.0, 11.2.1 o Product: Enterprise Manager 3.1.1 o Product: F5 iWorkflow 2.0.2, 2.0.1, 2.0.0 o Product: LineRate 2.6.1, 2.6.0, 2.5.2, 2.5.1, 2.5.0 o Product: ARX, ARX 6.4.0, 6.3.0, 6.2.0 o Product: F5 WebSafe 1.0.0 o Product: Traffix SDC 5.1.0, 4.4.0, 4.0.5, 4.0.2, 4.0.0 o Product: BIG-IQ Cloud and Orchestration 1.0.0 The security issue described in this article has been resolved or does not affect any F5 products. There will be no further updates, unless new information is discovered. Security Advisory Description named in ISC BIND 9.x before 9.9.9-P5, 9.10.x before 9.10.4-P5, and 9.11.x before 9.11.0-P2 allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a crafted DS resource record in an answer. (CVE-2016-9444) Impact When the BIND recursion option is enabled, an attacker may exploit this vulnerability to cause the named process to restart. Additionally, the restarted process does not trigger the BIG-IP system high availability (HA) failover event. By default, the BIND recursion option is not enabled on BIG-IP DNS or GTM systems. If the BIND recursion option is enabled, BIG-IP DNS or GTM systems are vulnerable. Security Advisory Status F5 Product Development has assigned ID 636702 (BIG-IP) to this vulnerability. To determine if your release is known to be vulnerable, the components or features that are affected by the vulnerability, and for information about releases or hotfixes that address the vulnerability, refer to the following table: +---------------+---------------+-----------------+-----------+---------------+ | |Versions known |Versions known to| |Vulnerable | |Product |to be |be not vulnerable|Severity |component or | | |vulnerable | | |feature | +---------------+---------------+-----------------+-----------+---------------+ | |13.0.0 |13.0.0 HF1 | | | | |12.0.0 - 12.1.2|12.1.2 HF1 | | | |BIG-IP LTM |11.3.0 - 11.6.1|11.6.2 |High |BIND | | |11.2.1 HF9 and |11.5.4 HF3 | | | | |later |11.2.1 - 11.2.1 | | | | | |HF8 | | | +---------------+---------------+-----------------+-----------+---------------+ | |13.0.0 |13.0.0 HF1 | | | |BIG-IP AAM |12.0.0 - 12.1.2|12.1.2 HF1 |High |BIND | | |11.4.0 - 11.6.1|11.6.2 | | | | | |11.5.4 HF3 | | | +---------------+---------------+-----------------+-----------+---------------+ | |13.0.0 |13.0.0 HF1 | | | |BIG-IP AFM |12.0.0 - 12.1.2|12.1.2 HF1 |High |BIND | | |11.4.0 - 11.6.1|11.6.2 | | | | | |11.5.4 HF3 | | | +---------------+---------------+-----------------+-----------+---------------+ | |13.0.0 |13.0.0 HF1 | | | | |12.0.0 - 12.1.2|12.1.2 HF1 | | | |BIG-IP |11.3.0 - 11.6.1|11.6.2 |High |BIND | |Analytics |11.2.1 HF9 and |11.5.4 HF3 | | | | |later |11.2.1 - 11.2.1 | | | | | |HF8 | | | +---------------+---------------+-----------------+-----------+---------------+ | |13.0.0 |13.0.0 HF1 | | | | |12.0.0 - 12.1.2|12.1.2 HF1 | | | |BIG-IP APM |11.3.0 - 11.6.1|11.6.2 |High |BIND | | |11.2.1 HF9 and |11.5.4 HF3 | | | | |later |11.2.1 - 11.2.1 | | | | | |HF8 | | | +---------------+---------------+-----------------+-----------+---------------+ | |13.0.0 |13.0.0 HF1 | | | | |12.0.0 - 12.1.2|12.1.2 HF1 | | | |BIG-IP ASM |11.3.0 - 11.6.1|11.6.2 |High |BIND | | |11.2.1 HF9 and |11.5.4 HF3 | | | | |later |11.2.1 - 11.2.1 | | | | | |HF8 | | | +---------------+---------------+-----------------+-----------+---------------+ |BIG-IP DNS |13.0.0 |13.0.0 HF1 |High |BIND | | |12.0.0 - 12.1.2|12.1.2 HF1 | | | +---------------+---------------+-----------------+-----------+---------------+ |BIG-IP Edge |11.2.1 HF9 and |11.2.1 - 11.2.1 |High |BIND | |Gateway |later |HF8 | | | +---------------+---------------+-----------------+-----------+---------------+ | |11.3.0 - 11.6.1|11.6.2 | | | |BIG-IP GTM |11.2.1 HF9 and |11.5.4 HF3 |High |BIND | | |later |11.2.1 - 11.2.1 | | | | | |HF8 | | | +---------------+---------------+-----------------+-----------+---------------+ | |13.0.0 |13.0.0 HF1 | | | | |12.0.0 - 12.1.2|12.1.2 HF1 | | | |BIG-IP Link |11.3.0 - 11.6.1|11.6.2 |High |BIND | |Controller |11.2.1 HF9 and |11.5.4 HF3 | | | | |later |11.2.1 - 11.2.1 | | | | | |HF8 | | | +---------------+---------------+-----------------+-----------+---------------+ | |13.0.0 |13.0.0 HF1 | | | |BIG-IP PEM |12.0.0 - 12.1.2|12.1.2 HF1 |High |BIND | | |11.4.0 - 11.6.1|11.6.2 | | | | | |11.5.4 HF3 | | | +---------------+---------------+-----------------+-----------+---------------+ | |11.3.0 - 11.4.1|11.2.1 - 11.2.1 | | | |BIG-IP PSM |11.2.1 HF9 and |HF8 |High |BIND | | |later | | | | +---------------+---------------+-----------------+-----------+---------------+ |BIG-IP |11.3.0 |11.2.1 - 11.2.1 | | | |WebAccelerator |11.2.1 HF9 and |HF8 |High |BIND | | |later | | | | +---------------+---------------+-----------------+-----------+---------------+ | |13.0.0 |13.0.0 HF1 | | | |BIG-IP WebSafe |12.0.0 - 12.1.2|12.1.2 HF1 |High |BIND | | |11.6.0 - 11.6.1|11.6.2 | | | +---------------+---------------+-----------------+-----------+---------------+ |ARX |None |6.2.0 - 6.4.0 |Not |None | | | | |vulnerable | | +---------------+---------------+-----------------+-----------+---------------+ |Enterprise | | |Not | | |Manager |None |3.1.1 |vulnerable^|None | | | | |1 | | +---------------+---------------+-----------------+-----------+---------------+ | | | |Not | | |BIG-IQ Cloud |None |4.0.0 - 4.5.0 |vulnerable^|None | | | | |1 | | +---------------+---------------+-----------------+-----------+---------------+ | | | |Not | | |BIG-IQ Device |None |4.2.0 - 4.5.0 |vulnerable^|None | | | | |1 | | +---------------+---------------+-----------------+-----------+---------------+ | | | |Not | | |BIG-IQ Security|None |4.0.0 - 4.5.0 |vulnerable^|None | | | | |1 | | +---------------+---------------+-----------------+-----------+---------------+ | | | |Not | | |BIG-IQ ADC |None |4.5.0 |vulnerable^|None | | | | |1 | | +---------------+---------------+-----------------+-----------+---------------+ |BIG-IQ | |5.0.0 - 5.1.0 |Not | | |Centralized |None |4.6.0 |vulnerable^|None | |Management | | |1 | | +---------------+---------------+-----------------+-----------+---------------+ |BIG-IQ Cloud | | |Not | | |and |None |1.0.0 |vulnerable^|None | |Orchestration | | |1 | | +---------------+---------------+-----------------+-----------+---------------+ |F5 iWorkflow |None |2.0.0 |Not |None | | | | |vulnerable | | +---------------+---------------+-----------------+-----------+---------------+ | | | |Not | | |LineRate |None |2.5.0 - 2.6.1 |vulnerable^|None | | | | |1 | | +---------------+---------------+-----------------+-----------+---------------+ |Traffix SDC |None |4.0.0 - 5.1.0 |Not |None | | | | |vulnerable | | +---------------+---------------+-----------------+-----------+---------------+ ^1 The specified products contain the affected code. However, F5 identifies the vulnerability status as Not vulnerable because the attacker cannot exploit the code in default, standard, or recommended configurations. Security Advisory Recommended Actions If you are running a version listed in the Versions known to be vulnerable column, you can eliminate this vulnerability by upgrading to a version listed in the Versions known to be not vulnerable column. If the table lists only an older version than what you are currently running, or does not list a non-vulnerable version, then no upgrade candidate currently exists. Mitigation To mitigate this vulnerability, you can disable the recursion option on the BIND configuration if it is not required in your environment. To do so, perform the following procedure. Impact of action: This procedure disables the recursion feature in the BIND configuration and restarts the system service that may affect the BIG-IP system responding to DNS queries. F5 recommends that you perform this procedure during a scheduled maintenance period. 1. Log in to the Advanced Shell (bash) of the BIG-IP system as the root user. 2. Check if the system has recursion enabled for the named service by typing the following command: grep "recursion\ " /var/named/config/named.conf If the output displays "recursion yes," proceed to step 4. 3. Check if the system has recursion enabled for the dnscached service by typing the following command: grep "recursion\ " /var/dnscached/config/named.conf If the output displays "recursion yes," proceed to step 4. Note: The /var/dnscached/config/named.conf configuration file is valid only if the BIG-IP system is provisioned or was previously provisioned with the BIG-IP APM module. 4. Use an editor of your choice to remove the following lines from the target configuration file: recursion yes; allow-recursion { <IP-Addresses-ACL> }; If you have more than one file to edit, after evaluating the files in step 2 and step 3, repeat step 4 for the next configuration file. 5. If you have modified the configuration of the dnscached service in step 4, you must restart the dnscached service by typing the following command: tmsh restart /sys service dnscached 6. If you have modified the configuration of the named service in step 4, you must restart the named service by typing the following command: tmsh restart /sys service named Supplemental Information o K9970: Subscribing to email notifications regarding F5 products o K9957: Creating a custom RSS feed to view new and updated documents o K4602: Overview of the F5 security vulnerability response policy o K4918: Overview of the F5 critical issue hotfix policy o K167: Downloading software and firmware from F5 o K13123: Managing BIG-IP product hotfixes (11.x - 13.x) o K9502: BIG-IP hotfix matrix - --------------------------END INCLUDED TEXT-------------------- You have received this e-mail bulletin as a result of your organisation's registration with AusCERT. The mailing list you are subscribed to is maintained within your organisation, so if you do not wish to continue receiving these bulletins you should contact your local IT manager. If you do not know who that is, please send an email to auscert@auscert.org.au and we will forward your request to the appropriate person. NOTE: Third Party Rights This security bulletin is provided as a service to AusCERT's members. As AusCERT did not write the document quoted above, AusCERT has had no control over its content. The decision to follow or act on information or advice contained in this security bulletin is the responsibility of each user or organisation, and should be considered in accordance with your organisation's site policies and procedures. AusCERT takes no responsibility for consequences which may arise from following or acting on information or advice contained in this security bulletin. NOTE: This is only the original release of the security bulletin. It may not be updated when updates to the original are made. If downloading at a later date, it is recommended that the bulletin is retrieved directly from the author's website to ensure that the information is still current. Contact information for the authors of the original document is included in the Security Bulletin above. If you have any questions or need further information, please contact them directly. Previous advisories and external security bulletins can be retrieved from: https://www.auscert.org.au/bulletins/ =========================================================================== Australian Computer Emergency Response Team The University of Queensland Brisbane Qld 4072 Internet Email: auscert@auscert.org.au Facsimile: (07) 3365 7031 Telephone: (07) 3365 4417 (International: +61 7 3365 4417) AusCERT personnel answer during Queensland business hours which are GMT+10:00 (AEST). On call after hours for member emergencies only. =========================================================================== -----BEGIN PGP SIGNATURE----- Comment: http://www.auscert.org.au/render.html?it=1967 iQIVAwUBWfq1Oox+lLeg9Ub1AQgcAg/7BQY9edBkFb5x7HxnKsMNfO79tZaRHsYy nGnOBJVvf24xWeikULfDy937jogtKzQsIbaE+bq6oTZEYz7Cqmhp+bedqv3OO3c6 Vh2hzNPzieqqTver6XBMP6msdPBwJsZ7WARcjrKPB5DEpc8/PTwR52/0wQXHD9il vCsbSSTZTdbEg3l6JUiVkgZEdnb1ivIchRH8YvQZdZRJFJmqfDjncdSj59YU5Mr+ BSIrsrS/IguVANUebcrEgpJPvycdtcUpvfGliPtr499v7/1/vEusWA9PM+LLkNSc UPrKKpriqeLslQUNAeWc3n/emrbYoVSK4HwEiOXBIxJC6WTVuCVygd0P4XKQ6liR QzWkqW4gdST4tbvTPgxNNVlWtraBFI0x1BblqmgctxwdEb4OiX4HaSWMB0NU+Y03 EgVr5jinY5eLdXp4p9At3bGa8cwGpRWiS1inyhlDzHvNLl1iTxy4Jb6lQ+PAYwV3 l3W+Q/lXCnE+eGLtgfNm8eXHwwVuliULavMpNNAGFC7FqNgbmLOVMAiktKZxVLJO OQX1EY7DpIv/+f2QdQUt7O58Si97sHJ4XIrt4WkV8blWLi0AMDgkSPe3urR7wV5E ukVdYW/eM2LHhkXLfXCIcOGZf/SteT20HCNdm7EjvGVahC0X39bKlFS2Gs/VHQNH zwQsCO4I86I= =OIwn -----END PGP SIGNATURE-----