Vulnerability Note VU#142646

ISC BIND 9 named denial of service vulnerability

Original Release date: 05 Jul 2011 | Last revised: 20 Jul 2011

Overview

ISC BIND 9 contains a remote packet denial of service vulnerability when running as an authoritative or recursive server.

Description

According to ISC:

A defect in the affected BIND 9 versions allows an attacker to remotely cause the "named" process to exit using a specially crafted packet. This defect affects both recursive and authoritative servers. The code location of the defect makes it impossible to protect BIND using ACLs configured within named.conf or by disabling any features at compile-time or run-time.

A remote attacker would need to be able to send a specially crafted packet directly to a server running a vulnerable version of BIND. There is also the potential for an indirect attack via malware that is inadvertently installed and run, where infected machines have direct access to an organization's nameservers.

Impact

A remote, unauthenticated attacker can cause the named daemon to crash creating a denial of service condition.

Solution

Apply an update

Users who obtain BIND from a third-party vendor, such as their operating system vendor, should see the vendor information portion of this document for a partial list of affected vendors.

This vulnerability is addressed in ISC BIND versions 9.6-ESV-R4-P3, 9.7.3-P3 and 9.8.0-P4. Users of BIND from the original source distribution should upgrade to this version.

See also http://www.isc.org/software/bind/advisories/cve-2011-2464

Vendor Information

VendorStatusDate NotifiedDate Updated
Debian GNU/LinuxAffected-20 Jul 2011
Internet Systems ConsortiumAffected16 Jun 201120 Jul 2011
Mandriva S. A.Affected-20 Jul 2011
Red Hat, Inc.Affected-20 Jul 2011

CVSS Metrics (Learn More)

Group Score Vector
Base N/A N/A
Temporal N/A N/A
Environmental N/A N/A

References

Credit

Thanks to Internet Systems Consortium for reporting this vulnerability.

This document was written by Michael Orlando.

Other Information

  • CVE IDs: CVE-2011-2464
  • Date Public: 05 Jul 2011
  • Date First Published: 05 Jul 2011
  • Date Last Updated: 20 Jul 2011
  • Severity Metric: 17.85
  • Document Revision: 14

Feedback

If you have feedback, comments, or additional information about this vulnerability, please send us email.

This product is provided subject to the Notification as indicated here: http://www.us-cert.gov/legal.html#notify

Document Feedback

Was this document helpful?   Yes   |   Somewhat   |  No