BIND 버그 패치방법 도와주세요

안녕하세요 항상 많은 도움을 얻고있습니다. 저는 RadHat 6.2에 BIND 8.3.3을 사용하고 있습니다. 그런데 BIND 에 아래와 같은 버그가 발견되었군요 

KA-2002-90 : Remote Vulnerabilities in BIND4 and BIND8
----------------------

최초작성일 : 2002-11-13
갱  신  일 :
출      처 : http://www.ciac.org/ciac/bulletins/n-013.shtml
작  성  자 : 정현철(hcjung@certcc.or.kr)

-- 제목 --------------
BIND4와 BIND8의 원격 다중 취약점들

-- 해당 시스템 --------
BIND 4.9.5 - 4.9.10
BIND 8.1, 8.2 - 8.2.6, 8.3.0 - 8.3.3

--영향-----------------
취약한 DNS 서버에 원격 침입 및 서비스거부공격이 가능하다.

-- 설명---------------

1. BIND SIG Cached RR 버퍼오버플로우 취약점

SIG resource records(RR)를 포함하는 DNS 응답 작성 과정에 버퍼오버플로우 취약점이 존재하여 named 권한으로 임의의 명령 수행이 가능하다.

2. BIND 다중 서비스거부공격 취약점

클라이언트가 존재하지 않는 subdomain에 대한 DNS lookup 요청을 할 경우 대규모 UDP를 가진 OPT RR을 첨부하게 되어, BIND 8 서버들이 갑자기 멈출 수 있다.(BIND 8.3.0 - 8.3.3에서 취약함)

또한, 유효하지 않는 만료 기간을 가진 SIG RR을 캐쉬하고자 할때 BIND는 내부 DB에서 이를 제거하지만 나중에 부적절하게 재참고(de-feference)되고 이로 인해 서비스거부상태가 유발될 수 있다.(BIND 8.2 - 8.2.6, BIND 8.3.0 - 8.3.3에서 취약함)

-- 해결책---------------

1. BIND 9.2.1로 업그레이드 한다.
ftp://ftp.isc.org/isc/bind9/9.2.1/bind-9.2.1.tar.gz

2. 임시조치로 recursive 기능이 필요 없다면 이를 중지시킨다.

BIND 8에서는 named.conf 파일에 다음과 같이 설정한다.

options {
 recursion no;
};

BIND 4에서는 named.boot 파일에 다음과 같이 설정한다.

options no-recursion

그러나 마땅한 update 방법을 모색하고 있습니다만 방법이 떠오르지안군요 BIND9로 UPDATE하려니 저희 System이 6.2라 아직  ker 2.2x 버젼에 BIND 9를 사용한단 말은 들어보지못해고 또System자체를 RedHat 7.x로 update 하려니 시간과 또는 현제 사용하고있는 다른 에플리케이션과의 관계도 있고 해서입니다. 8.3.3의 patch 가 text file로 올라와 있어 하번 보니 아마8.3.3의 소스를 여러 군데군데 수정을하여 다시 컴파일 하란말  같은데 아직 경력이 일천하여 어떻게 해볼 방법을 몰라(+ - *...) 이렇게 도움을 구합니다. 아래patch file 입니다. 도와 주십시요

Index: CHANGES
===================================================================
RCS file: /proj/cvs/isc/bind8/src/CHANGES,v
retrieving revision 8.1040
diff -u -r8.1040 CHANGES
--- CHANGES 27 Jun 2002 04:25:08 -0000 8.1040
+++ CHANGES 30 Oct 2002 11:16:03 -0000
@@ -1,3 +1,23 @@
+1469. [bug]  buffer length calculation for PX was wrong.
+
+1468. [bug]  ns_name_ntol() could overwite a zero length buffer.
+
+1467. [bug]  off by one bug in ns_makecannon().
+
+1466. [bug]  large ENDS UDP buffer size could trigger a assertion.
+
+1465. [bug]  possible NULL pointer dereference in db_sec.c
+
+1464. [bug]       the buffer used to construct the -ve record was not
+   big enough for all possible SOA records.  use pointer
+   arithmetic to calculate the remaining size in this
+   buffer.
+
+1463. [bug]  use serial space arithmetic to determine if a SIG is
+   too old, in the future or has internally constistant
+   times.
+
+1462. [bug]  write buffer overflow in make_rr().
 
  --- 8.3.3-REL released --- (Wed Jun 26 21:15:43 PDT 2002)
 
Index: bin/named/db_defs.h
===================================================================
RCS file: /proj/cvs/isc/bind8/src/bin/named/db_defs.h,v
retrieving revision 8.47
diff -u -r8.47 db_defs.h
--- bin/named/db_defs.h 18 May 2002 01:02:53 -0000 8.47
+++ bin/named/db_defs.h 30 Oct 2002 11:16:06 -0000
@@ -78,7 +78,7 @@
  */
 
  /* max length of data in RR data field */
-#define MAXDATA  (2*MAXDNAME + 5*INT32SZ)
+#define MAXDATA  (3*MAXDNAME + 5*INT32SZ)
 
  /* max length of data in a TXT RR segment */
 #define MAXCHARSTRING 255
Index: bin/named/db_sec.c
===================================================================
RCS file: /proj/cvs/isc/bind8/src/bin/named/db_sec.c,v
retrieving revision 8.35
diff -u -r8.35 db_sec.c
--- bin/named/db_sec.c 18 Jun 2001 14:42:57 -0000 8.35
+++ bin/named/db_sec.c 30 Oct 2002 11:16:09 -0000
@@ -479,7 +479,9 @@
  struct sig_record *sigdata;
  struct dnode *sigdn;
  struct databuf *sigdp;
- time_t now;
+ u_int32_t now;
+ u_int32_t exptime;
+ u_int32_t signtime;
  char *signer;
  u_char name_n[MAXDNAME];
  u_char *sig, *eom;
@@ -492,6 +494,7 @@
  int dnssec_failed = 0, dnssec_succeeded = 0;
  int return_value;
  int i;
+ int expired = 0;
 
  if (rrset == NULL || rrset->rr_name == NULL) {
   ns_warning (ns_log_default, "verify_set: missing rrset/name");
@@ -527,11 +530,14 @@
    * Don't verify a set if the SIG inception time is in
    * the future.  This should be fixed before 2038 (BEW)
    */
-  if ((time_t)ntohl(sigdata->sig_time_n) > now)
+  signtime = ntohl(sigdata->sig_time_n);
+  if (SEQ_GT(signtime, now))
    continue;
 
   /* An expired set is dropped, but the data is not. */
-  if ((time_t)ntohl(sigdata->sig_exp_n) < now) {
+  exptime = ntohl(sigdata->sig_exp_n);
+  if (SEQ_GT(now, exptime)) {
+   expired++;
    db_detach(&sigdn->dp);
    sigdp = NULL;
    continue;
@@ -723,7 +729,7 @@
  }
 
 end:
- if (dnssec_failed > 0)
+ if (dnssec_failed > 0 || expired > 0)
   rrset_trim_sigs(rrset);
  if (trustedkey == 0 && key != NULL)
   dst_free_key(key);
Index: bin/named/ns_defs.h
===================================================================
RCS file: /proj/cvs/isc/bind8/src/bin/named/ns_defs.h,v
retrieving revision 8.121
diff -u -r8.121 ns_defs.h
--- bin/named/ns_defs.h 26 Jun 2002 03:27:19 -0000 8.121
+++ bin/named/ns_defs.h 30 Oct 2002 11:16:14 -0000
@@ -469,7 +469,7 @@
    q_cmsglen, /* len of cname message */
    q_cmsgsize; /* allocated size of cname message */
  int16_t  q_dfd;  /* UDP file descriptor */
- int16_t  q_udpsize; /* UDP message size */
+ u_int16_t q_udpsize; /* UDP message size */
  int  q_distance; /* distance this query is from the
       * original query that the server
       * received. */
Index: bin/named/ns_ncache.c
===================================================================
RCS file: /proj/cvs/isc/bind8/src/bin/named/ns_ncache.c,v
retrieving revision 8.29
diff -u -r8.29 ns_ncache.c
--- bin/named/ns_ncache.c 18 Jun 2001 14:43:16 -0000 8.29
+++ bin/named/ns_ncache.c 30 Oct 2002 11:16:20 -0000
@@ -66,7 +66,7 @@
  u_int16_t atype;
  u_char *sp, *cp1;
  u_char data[MAXDATA];
- size_t len = sizeof data;
+ u_char *eod = data + sizeof(data);
 #endif
 
  nameserIncr(from.sin_addr, nssRcvdNXD);
@@ -186,7 +186,7 @@
   rdatap = cp;
 
   /* origin */
-  n = dn_expand(msg, msg + msglen, cp, (char*)data, len);
+  n = dn_expand(msg, msg + msglen, cp, (char*)data, eod - data);
   if (n < 0) {
    ns_debug(ns_log_ncache, 3,
      "ncache: origin form error");
@@ -195,9 +195,8 @@
   cp += n;
   n = strlen((char*)data) + 1;
   cp1 = data + n;
-  len -= n;
   /* mail */
-  n = dn_expand(msg, msg + msglen, cp, (char*)cp1, len);
+  n = dn_expand(msg, msg + msglen, cp, (char*)cp1, eod - cp1);
   if (n < 0) {
    ns_debug(ns_log_ncache, 3, "ncache: mail form error");
    return;
@@ -205,20 +204,20 @@
   cp += n;
   n = strlen((char*)cp1) + 1;
   cp1 += n;
-  len -= n;
   n = 5 * INT32SZ;
+  if (n > (eod - cp1)) /* Can't happen. See MAXDATA. */
+   return;
   BOUNDS_CHECK(cp, n);
   memcpy(cp1, cp, n);
   /* serial, refresh, retry, expire, min */
   cp1 += n;
-  len -= n;
   cp += n;
   if (cp != rdatap + dlen) {
    ns_debug(ns_log_ncache, 3, "ncache: form error");
    return;
   }
   /* store the zone of the soa record */
-  n = dn_expand(msg, msg + msglen, sp, (char*)cp1, len);
+  n = dn_expand(msg, msg + msglen, sp, (char*)cp1, eod - cp1);
   if (n < 0) {
    ns_debug(ns_log_ncache, 3, "ncache: form error 2");
    return;
Index: bin/named/ns_req.c
===================================================================
RCS file: /proj/cvs/isc/bind8/src/bin/named/ns_req.c,v
retrieving revision 8.169
diff -u -r8.169 ns_req.c
--- bin/named/ns_req.c 12 May 2002 23:41:52 -0000 8.169
+++ bin/named/ns_req.c 30 Oct 2002 11:16:32 -0000
@@ -2195,7 +2195,7 @@
 
   /* first just copy over the type_covered, algorithm, */
   /* labels, orig ttl, two timestamps, and the footprint */
-  if ((dp->d_size - 18) > buflen)
+  if (buflen < 18)
    goto cleanup;  /* out of room! */
   memcpy(cp, cp1, 18);
   cp  += 18;
Index: bin/named/ns_resp.c
===================================================================
RCS file: /proj/cvs/isc/bind8/src/bin/named/ns_resp.c,v
retrieving revision 8.178
diff -u -r8.178 ns_resp.c
--- bin/named/ns_resp.c 27 Jun 2002 03:09:19 -0000 8.178
+++ bin/named/ns_resp.c 30 Oct 2002 11:17:11 -0000
@@ -2001,7 +2001,7 @@
    * to BOUNDS_CHECK() here.
    */
   cp1 += (n = strlen((char *)cp1) + 1);
-  n1 = sizeof(data) - n;
+  n1 = sizeof(data) - n - INT16SZ;
   n = dn_expand(msg, eom, cp, (char *)cp1, n1);
   if (n < 0) {
    hp->rcode = FORMERR;
@@ -2043,8 +2043,18 @@
    ttl = origTTL;
   }
 
+  /*
+   * Check that expire and signature times are internally
+   * consistant.
+   */
+  if (!SEQ_GT(exptime, signtime) && exptime != signtime) {
+   ns_debug(ns_log_default, 3,
+   "ignoring SIG: signature expires before it was signed");
+   return ((cp - rrp) + dlen);
+  }
+
   /* Don't let bogus signers "sign" in the future.  */
-  if (signtime > now) {
+  if (SEQ_GT(signtime, now)) {
    ns_debug(ns_log_default, 3,
      "ignoring SIG: signature date %s is in the future",
      p_secstodate (signtime));
@@ -2052,7 +2062,7 @@
   }
   
   /* Ignore received SIG RR's that are already expired.  */
-  if (exptime <= now) {
+  if (SEQ_GT(now, exptime)) {
    ns_debug(ns_log_default, 3,
     "ignoring SIG: expiration %s is in the past",
      p_secstodate (exptime));
Index: lib/nameser/ns_name.c
===================================================================
RCS file: /proj/cvs/isc/bind8/src/lib/nameser/ns_name.c,v
retrieving revision 8.18
diff -u -r8.18 ns_name.c
--- lib/nameser/ns_name.c 24 May 2002 05:10:40 -0000 8.18
+++ lib/nameser/ns_name.c 30 Oct 2002 11:17:21 -0000
@@ -341,6 +341,10 @@
  dn = dst;
  eom = dst + dstsiz;
 
+ if (dn >= eom) {
+  errno = EMSGSIZE;
+  return (-1);
+ }
  while ((n = *cp++) != 0) {
   if ((n & NS_CMPRSFLGS) == NS_CMPRSFLGS) {
    /* Some kind of compression pointer. */
Index: lib/nameser/ns_samedomain.c
===================================================================
RCS file: /proj/cvs/isc/bind8/src/lib/nameser/ns_samedomain.c,v
retrieving revision 8.9
diff -u -r8.9 ns_samedomain.c
--- lib/nameser/ns_samedomain.c 15 Oct 1999 21:06:51 -0000 8.9
+++ lib/nameser/ns_samedomain.c 30 Oct 2002 11:17:21 -0000
@@ -166,7 +166,7 @@
 ns_makecanon(const char *src, char *dst, size_t dstsize) {
  size_t n = strlen(src);
 
- if (n + sizeof "." > dstsize) {
+ if (n + sizeof "." + 1 > dstsize) {
   errno = EMSGSIZE;
   return (-1);
  }