Vulnerability Note VU#325431

Queries to ISC BIND servers may disclose environment variables

Overview

The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) by the Internet Software Consortium (ISC). There is an information leakage vulnerability in BIND 4.9.x and 8.2.x, which may allow remote intruders to obtain information from systems running BIND. Although BIND 4.9.x is no longer officially maintained by ISC, various versions are still widely deployed on the Internet.

This vulnerability has been exploited in a laboratory environment and presents a moderate threat to the Internet infrastructure.

I. Description

There is a vulnerability in ISC BIND that allows a remote attacker to access the program stack, possibly exposing program and/or environment variables. This vulnerability affects both BIND 4 and BIND 8, and can be triggered by sending a specially formatted query to vulnerable BIND servers.

II. Impact

This vulnerability may allow attackers to read information from the program stack, possibly exposing environment variables.

III. Solution

The ISC has released BIND versions 4.9.8 and 8.2.3 to address this security issue. The CERT/CC recommends that users of BIND 4.9.x or 8.2.x upgrade to BIND 4.9.8 or BIND 8.2.3, respectively. Because BIND 4 is no longer actively maintained, the ISC recommends that users affected by this vulnerability upgrade to either BIND 8.2.3 or BIND 9.1. Upgrading to one of these two version will also provide functionality enhancements that are not related to security.

The BIND 4.9.8 and 8.2.3 distributions can be downloaded from:

ftp://ftp.isc.org/isc/bind/src/

The BIND 9.1 distribution can be downloaded from:

ftp://ftp.isc.org/isc/bind9/

Please note that upgrading to BIND 4.9.8 also addresses the vulnerabilities discussed in VU#572183 and VU#868916, while upgrading to 8.2.3 will address the vulnerability discussed in VU#196945.

Systems Affected

Vendor	Status	Date Updated
Apple	Not Vulnerable	5-Apr-2001
BSDI	Unknown	26-Jan-2001
Caldera	Vulnerable	29-Jan-2001
Compaq Computer Corporation	Vulnerable	4-Apr-2001
Conectiva	Vulnerable	4-Apr-2001
Data General	Unknown	26-Jan-2001
Debian	Vulnerable	5-Apr-2001
FreeBSD	Vulnerable	5-Apr-2001
Fujitsu	Unknown	26-Jan-2001
Hewlett Packard	Vulnerable	5-Apr-2001
IBM	Vulnerable	5-Apr-2001
Immunix	Vulnerable	5-Apr-2001
ISC	Vulnerable	4-Apr-2001
MandrakeSoft	Vulnerable	4-Apr-2001
Microsoft	Not Vulnerable	30-Jan-2001
NCR	Unknown	27-Jan-2001
NEC	Unknown	27-Jan-2001
NetBSD	Vulnerable	5-Apr-2001
NeXT	Unknown	27-Jan-2001
OpenBSD	Not Vulnerable	30-Jan-2001
RedHat	Vulnerable	4-Apr-2001
SCO	Vulnerable	1-May-2002
Sequent	Unknown	27-Jan-2001
SGI	Unknown	27-Apr-2001
Siemens Nixdorf	Unknown	27-Jan-2001
Slackware	Vulnerable	5-Apr-2001
Sony	Unknown	27-Jan-2001
Sun	Vulnerable	7-Aug-2001
SuSE	Vulnerable	5-Apr-2001
Unisys	Unknown	27-Jan-2001

References

VU#325431,VU#196945, VU#572183, VU#868916
http://www.cymru.com/~robt/Docs/Articles/secure-bind-template.html
http://www.isi.edu/~bmanning/in-addr-audit.html
http://www.securityfocus.com/news/144
http://www.securityfocus.com/bid/2321

Credit

The CERT/CC thanks Claudio Musmarra for discovering this vulnerability and the Internet Software Consortium for providing a patch to fix it.

This document was written by Jeffrey P. Lanza.

Other Information

Date Public	01/29/2001
Date First Published	01/29/2001 08:47:27 AM
Date Last Updated	05/01/2002
CERT Advisory	CA-2001-02
CVE Name	CAN-2001-0012
US-CERT Technical Alerts
Metric	16.38
Document Revision	54

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Get Adobe Reader