Roundup on BIND Denial of Service
by Berislav Kucan
Short description (from Incidents.org Handler's Diary):

There is a Denial of Service vulnerability in ISC Bind (versions 9 up to 9.2.1) When this is exploited by a remote attacker, the BIND server will abort and shut down. After this, you must manually restart BIND. By disabling BIND, other services which depend on BIND may also fail.

More detailed description (from CERT Advisory CA-2002-15):

A vulnerability exists in version 9 of BIND that allows remote attackers to shut down BIND servers. An attacker can cause the shutdown by sending a specific DNS packet designed to trigger an internal consistency check. However, this vulnerability will not allow an attacker to execute arbitrary code or write data to arbitrary locations in memory.

The internal consistency check that triggers the shutdown occurs when the rdataset parameter to the dns_message_findtype() function in message.c is not NULL as expected. The condition causes the code to
assert an error message and call abort() to shut down the BIND server. It is also possible to accidentally trigger this vulnerability using common queries found in routine operation, especially queries originating from SMTP servers.

Full CERT advisory on this subject can be found over here:
http://www.net-security.org/advisory.php?id=740



Vendor (Internet Software Consortium) response:

As provided on BIND Security page:

Name: "DoS internal consistancy check"
Versions affected: All BIND 9 version prior to 9.2.1
Severity: SERIOUS
Exploitable: Remotely
Type: Denial of Service
Description: When chasing additional data chains in a response it is possible to trigger an internal consistancy check.
Workarounds / fix: Upgrade to 9.2.1.

BIND 9.2.1 - ftp://ftp.isc.org/isc/bind9/9.2.1/bind-9.2.1.tar.gz
PGP Signature for the file - ftp://ftp.isc.org/isc/bind9/9.2.1/bind-9.2.1.tar.gz.asc



Linux vendor responses:

Vendor: Caldera
Vulnerable systems: Open UNIX 8.0.0
Full advisory: http://www.net-security.org/advisory.php?id=757

Vendor: Conectiva
Vulnerable systems: Conectiva Linux 7.0 and Conectiva Linux 8
Full advisory: http://www.net-security.org/advisory.php?id=751

Vendor: SuSE
Vulnerable systems: SuSE Linux 7.0, SuSE Linux 7.1, SuSE Linux 7.2, SuSE Linux 7.3 and SuSE Linux 8.0
Full advisory: http://www.net-security.org/advisory.php?id=749

Vendor: Red Hat
Vulnerable systems:Red Hat Linux 7.1 (alpha, i386 and ia64), Red Hat Linux 7.2 (i386 and ia64), Red Hat Linux 7.3 (i386)
Full advisory: http://www.net-security.org/advisory.php?id=742

Mandrake Linux 8.x ships with BIND9 and as such updated packages will be available as early as possible.

Spotlight

The context-aware security lifecycle and the cloud

Posted on 25 November 2014.  |  Ofer Wolf, CEO at Sentrix, explains the role of the context-aware security lifecycle and illustrates how the cloud is shaping the modern security architecture.


Weekly newsletter

Reading our newsletter every Monday will keep you up-to-date with security news.
  



Daily digest

Receive a daily digest of the latest security news.
  

DON'T
MISS

Wed, Nov 26th
    COPYRIGHT 1998-2014 BY HELP NET SECURITY.   // READ OUR PRIVACY POLICY // ABOUT US // ADVERTISE //