Vulnerability Note VU#739123
ISC BIND 9 fails to process additional data chains in responses correctly thereby causing the server to fail an internal consistency check
A denial-of-service vulnerability exists in version 9 of the Internet Software Consortium's (ISC) Berkeley Internet Name Domain (BIND) server. ISC BIND versions 8 and 4 are not affected. Exploiting this vulnerability will cause vulnerable BIND servers to shut down.
BIND is an implementation of the Domain Name System (DNS) that is maintained by the ISC. A vulnerability in Version 9 of BIND exists which may result in the deliberate shutdown of vulnerable BIND servers by arbitrary remote attackers. The shutdown can be caused by a specific DNS packet designed to create an improperly-handled error condition. Because the error condition is correctly detected but is not handled properly, this vulnerability will not allow an intruder to execute arbitrary code or write data to arbitrary locations in memory. The error condition that triggers the shutdown occurs when the rdataset parameter to the dns_message_findtype() function in message.c is not NULL as expected. The condition causes the code to assert an error message and call abort() to shutdown the BIND server.
Exploitation of this vulnerability will cause the vulnerable BIND server to abort and shut down. As a result, the BIND server will not be available unless restarted.
Apply a patch from your vendor or upgrade to BIND 9.2.1. BIND 9.2.1 is available from http://www.isc.org/products/BIND/bind9.html.
Systems Affected (Learn More)
|Vendor||Status||Date Notified||Date Updated|
|F5 Networks||Affected||30 May 2002||11 Jun 2002|
|Hewlett-Packard Company||Affected||30 May 2002||08 Aug 2002|
|ISC||Affected||-||30 May 2002|
|MandrakeSoft||Affected||30 May 2002||03 Jun 2002|
|NetBSD||Affected||30 May 2002||04 Jun 2002|
|Red Hat Inc.||Affected||30 May 2002||03 Jun 2002|
|SuSE Inc.||Affected||30 May 2002||03 Jun 2002|
|The SCO Group (SCO UnixWare)||Affected||30 May 2002||13 Sep 2002|
|Alcatel||Not Affected||30 May 2002||18 Sep 2002|
|Apple Computer Inc.||Not Affected||30 May 2002||31 May 2002|
|BSDI||Not Affected||30 May 2002||04 Jun 2002|
|Compaq Computer Corporation||Not Affected||30 May 2002||04 Jun 2002|
|Cray Inc.||Not Affected||30 May 2002||30 May 2002|
|djbdns||Not Affected||04 Jun 2002||11 Jun 2002|
|Engarde||Not Affected||30 May 2002||30 May 2002|
CVSS Metrics (Learn More)
The CERT/CC thanks the Internet Software Consortium (ISC) for reporting this vulnerability to us.
This document was written by Ian A. Finlay.
- CVE IDs: CAN-2002-0400
- CERT Advisory: CA-2002-15
- Date Public: 04 May 2001
- Date First Published: 04 Jun 2002
- Date Last Updated: 18 Sep 2002
- Severity Metric: 40.80
- Document Revision: 56
If you have feedback, comments, or additional information about this vulnerability, please send us email.