Vulnerability Note VU#187297

ISC BIND does not correctly set default access controls

Overview

ISC (Internet Systems Consortiuim) BIND fails to properly set default access control lists. This may allow unauthorized users to make recursive querries and querry the cache.

I. Description

From the ISC BIND security page:

The default access control lists (acls) are not being correctly set. If not set anyone can make recursive queries and/or query the cache contents.

Note that the BIND advisory lists BIND 9.4.0, 9.4.1, 9.5.0a1, 9.5.0a2, 9.5.0a3, 9.5.0a4, and 9.5.0a5 as the versions affected.

II. Impact

A remote, unauthenticated attacker may be able to cause a vulnerable DNS server perform recursion. This could be used to perform denial-of-service attacks. An attacker may also be able to querry the cache.

III. Solution

Upgrade or Patch

This issue is addressed in ISC BIND 9.2.8-P1, BIND 9.3.4-P1, BIND 9.4.1-P1 or BIND 9.5.0a6. Users who obtain BIND from their operating system vendor should see the systems affected portion of this document for a partial list of affected vendors.

Workarounds for administrators of non-publicly accessisble recursive DNS servers

Using firewall rules, limit access to the DNS server to authorized networks.

Workarounds for administrators of publicly accessisble recursive DNS servers

Rate limiting the number of external recursion requests may mitigate potential abuse of the DNS server.

Systems Affected

Vendor	Status	Date Notified
Apple Computer, Inc.	Unknown	27-Jul-2007
Conectiva Inc.	Unknown	27-Jul-2007
Cray Inc.	Unknown	27-Jul-2007
Debian GNU/Linux	Vulnerable	30-Jul-2007
EMC Corporation	Not Vulnerable	30-Jul-2007
Engarde Secure Linux	Unknown	27-Jul-2007
F5 Networks, Inc.	Unknown	27-Jul-2007
Fedora Project	Unknown	27-Jul-2007
FreeBSD, Inc.	Unknown	27-Jul-2007
Fujitsu	Unknown	27-Jul-2007
Gentoo Linux	Unknown	27-Jul-2007
Hewlett-Packard Company	Unknown	27-Jul-2007
Hitachi	Not Vulnerable	30-Jul-2007
IBM Corporation	Unknown	27-Jul-2007
Immunix Communications, Inc.	Unknown	27-Jul-2007
Ingrian Networks, Inc.	Unknown	27-Jul-2007
Internet Software Consortium	Vulnerable	27-Jul-2007
Juniper Networks, Inc.	Unknown	27-Jul-2007
Mandriva, Inc.	Unknown	27-Jul-2007
Microsoft Corporation	Unknown	27-Jul-2007
MontaVista Software, Inc.	Unknown	27-Jul-2007
NEC Corporation	Unknown	27-Jul-2007
NetBSD	Unknown	27-Jul-2007
Novell, Inc.	Unknown	27-Jul-2007
OpenBSD	Unknown	27-Jul-2007
Openwall GNU/*/Linux	Not Vulnerable	8-Aug-2007
QNX, Software Systems, Inc.	Unknown	27-Jul-2007
Red Hat, Inc.	Not Vulnerable	28-Jul-2007
Silicon Graphics, Inc.	Unknown	27-Jul-2007
Slackware Linux Inc.	Unknown	27-Jul-2007
Sony Corporation	Unknown	27-Jul-2007
Sun Microsystems, Inc.	Not Vulnerable	3-Aug-2007
SUSE Linux	Not Vulnerable	2-Aug-2007
The SCO Group	Unknown	27-Jul-2007
Trustix Secure Linux	Unknown	27-Jul-2007
Turbolinux	Unknown	27-Jul-2007
Ubuntu	Unknown	27-Jul-2007
Unisys	Unknown	27-Jul-2007
Wind River Systems, Inc.	Unknown	27-Jul-2007

References

http://www.isc.org/sw/bind/bind-security.php
http://www.netfilter.org/documentation/HOWTO/packet-filtering-HOWTO-7.html

Credit

Thanks to ISC for information that was used in this report.

This document was written by Ryan Giobbi.

Other Information

Date Public:	2007-07-24
Date First Published:	2007-07-27
Date Last Updated:	2008-06-04
CERT Advisory:
CVE-ID(s):	CVE-2007-2925
NVD-ID(s):	CVE-2007-2925
US-CERT Technical Alerts:
Metric:	16.98
Document Revision:	25

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Produced 2007 by US-CERT, a government organization
Disclaimers and copyright information

Get Adobe Reader