There is a Denial of Service vulnerability in ISC Bind (versions 9 up to 9.2.1) When this is exploited by a remote attacker, the BIND server will abort and shut down. After this, you must manually restart BIND. By disabling BIND, other services which depend on BIND may also fail.
More detailed description (from CERT Advisory CA-2002-15):
A vulnerability exists in version 9 of BIND that allows remote attackers to shut down BIND servers. An attacker can cause the shutdown by sending a specific DNS packet designed to trigger an internal consistency check. However, this vulnerability will not allow an attacker to execute arbitrary code or write data to arbitrary locations in memory.
The internal consistency check that triggers the shutdown occurs when the rdataset parameter to the dns_message_findtype() function in message.c is not NULL as expected. The condition causes the code to
assert an error message and call abort() to shut down the BIND server. It is also possible to accidentally trigger this vulnerability using common queries found in routine operation, especially queries originating from SMTP servers.
Full CERT advisory on this subject can be found over here:
Vendor (Internet Software Consortium) response:
As provided on BIND Security page:
Name: "DoS internal consistancy check"
Versions affected: All BIND 9 version prior to 9.2.1
Type: Denial of Service
Description: When chasing additional data chains in a response it is possible to trigger an internal consistancy check.
Workarounds / fix: Upgrade to 9.2.1.
BIND 9.2.1 - ftp://ftp.isc.org/isc/bind9/9.2.1/bind-9.2.1.tar.gz
PGP Signature for the file - ftp://ftp.isc.org/isc/bind9/9.2.1/bind-9.2.1.tar.gz.asc
Linux vendor responses:
Vulnerable systems: Open UNIX 8.0.0
Full advisory: http://www.net-security.org/advisory.php?id=757
Vulnerable systems: Conectiva Linux 7.0 and Conectiva Linux 8
Full advisory: http://www.net-security.org/advisory.php?id=751
Vulnerable systems: SuSE Linux 7.0, SuSE Linux 7.1, SuSE Linux 7.2, SuSE Linux 7.3 and SuSE Linux 8.0
By subscribing to our early morning news update, you will receive a daily digest of the latest security news published on Help Net Security.
With over 500 issues so far, reading our newsletter every Monday morning will keep you up-to-date with security risks out there.