Vulnerability Note VU#739123

ISC BIND 9 fails to process additional data chains in responses correctly thereby causing the server to fail an internal consistency check

Original Release date: 04 Jun 2002 | Last revised: 18 Sep 2002

Overview

A denial-of-service vulnerability exists in version 9 of the Internet Software Consortium's (ISC) Berkeley Internet Name Domain (BIND) server. ISC BIND versions 8 and 4 are not affected. Exploiting this vulnerability will cause vulnerable BIND servers to shut down.

Description

BIND is an implementation of the Domain Name System (DNS) that is maintained by the ISC. A vulnerability in Version 9 of BIND exists which may result in the deliberate shutdown of vulnerable BIND servers by arbitrary remote attackers. The shutdown can be caused by a specific DNS packet designed to create an improperly-handled error condition. Because the error condition is correctly detected but is not handled properly, this vulnerability will not allow an intruder to execute arbitrary code or write data to arbitrary locations in memory. The error condition that triggers the shutdown occurs when the rdataset parameter to the dns_message_findtype() function in message.c is not NULL as expected. The condition causes the code to assert an error message and call abort() to shutdown the BIND server.

Impact

Exploitation of this vulnerability will cause the vulnerable BIND server to abort and shut down. As a result, the BIND server will not be available unless restarted.

Solution

Apply a patch from your vendor or upgrade to BIND 9.2.1. BIND 9.2.1 is available from http://www.isc.org/products/BIND/bind9.html.

Systems Affected (Learn More)

VendorStatusDate NotifiedDate Updated
F5 NetworksAffected30 May 200211 Jun 2002
Hewlett-Packard CompanyAffected30 May 200208 Aug 2002
ISCAffected-30 May 2002
MandrakeSoftAffected30 May 200203 Jun 2002
NetBSDAffected30 May 200204 Jun 2002
Red Hat Inc.Affected30 May 200203 Jun 2002
SuSE Inc.Affected30 May 200203 Jun 2002
The SCO Group (SCO UnixWare)Affected30 May 200213 Sep 2002
AlcatelNot Affected30 May 200218 Sep 2002
Apple Computer Inc.Not Affected30 May 200231 May 2002
BSDINot Affected30 May 200204 Jun 2002
Compaq Computer CorporationNot Affected30 May 200204 Jun 2002
Cray Inc.Not Affected30 May 200230 May 2002
djbdnsNot Affected04 Jun 200211 Jun 2002
EngardeNot Affected30 May 200230 May 2002
If you are a vendor and your product is affected, let us know.View More »

CVSS Metrics (Learn More)

Group Score Vector
Base N/A N/A
Temporal N/A N/A
Environmental N/A N/A

References

Credit

The CERT/CC thanks the Internet Software Consortium (ISC) for reporting this vulnerability to us.

This document was written by Ian A. Finlay.

Other Information

  • CVE IDs: CAN-2002-0400
  • CERT Advisory: CA-2002-15
  • Date Public: 04 May 2001
  • Date First Published: 04 Jun 2002
  • Date Last Updated: 18 Sep 2002
  • Severity Metric: 40.80
  • Document Revision: 56

Feedback

If you have feedback, comments, or additional information about this vulnerability, please send us email.