Vulnerability Note VU#803539

Multiple vendors' Domain Name System (DNS) stub resolvers vulnerable to buffer overflows

Original Release date: 27 Jun 2002 | Last revised: 16 Apr 2003

Overview

Buffer overflow vulnerabilities exists in the DNS stub resolver library used by BSD, ISC BIND, and GNU glibc. Other systems that use DNS resolver code derived from ISC BIND may also be affected. An attacker who is able to control DNS responses could exploit arbitrary code or cause a denial of service on vulnerable systems.

Description

The Domain Name System (DNS) provides name, address, and other information about Internet Protocol (IP) networks and devices. By issuing queries to and interpreting responses from DNS servers, IP-enabled network operating systems can access DNS information. When an IP network application needs to access or process DNS information, it calls functions in the stub resolver library, which may be part of the underlying network operating system. On BSD-based systems, DNS stub resolver functions are implemented in the system library libc. In ISC BIND, they are implemented in libbind, and on GNU/Linux-based systems, they are implemented in glibc.

The DNS resolver libraries on BSD-based systems (libc), ISC BIND (libbind), GNU/Linux (glibc), and possibly other systems that use code derived from ISC BIND contain buffer overflow vulnerabilities in the way the resolvers handle DNS responses. Quoting from FreeBSD Security Advisory FreeBSD-SA-02:28.resolv:

    DNS messages have specific byte alignment requirements, resulting in padding in messages. In a few instances in the resolver code, this padding is not taken into account when computing available buffer space. As a result, the parsing of a DNS message may result in a buffer overrun of up to a few bytes for each record included in the message.
NetBSD Security Advisory 2002-006 provides further detail:
    In lib/libc/net/gethnamaddr.c:getanswer() and lib/libc/net/getnetnamadr.c:getnetanswer(), two variables manage packet buffer parsing - a pointer to the byte we are looking at, and the remaining length on the buffer. The remaining length was not updated consistently, and malicious DNS responses are able to write outside the buffer.
This problem is not limited to DNS servers or to BIND. Any application that uses a vulnerable resolver library is likely to be affected. Applications that are statically linked must be recompiled using patched resolver libraries.

Note that the DNS stub resolver implemented in glibc on GNU/Linux systems is vulnerable via DNS lookups for network names and addresses (VU#542971).

Impact

An attacker who is able to control DNS responses could exploit arbitrary code or cause a denial of service on vulnerable systems. The attacker would need to be able to spoof DNS responses or control a DNS server that provides responses to a vulnerable system. Any code executed by the attacker would run with the privileges of the process that called the vulnerable resolver function, potentially root.

Solution


Apply a Patch

Apply a patch from your vendor. In the case of statically linked binaries, it is necessary to recompile using the patched version of the DNS stub resolver libraries.

Upgrade

Upgrade your system as specified by your vendor.


Use of a local caching DNS server is not an effective workaround

When this document was initially published, it was thought that a caching DNS server that reconstructs DNS responses would prevent malicious code from reaching systems with vulnerable resolver libraries. This workaround does not prevent some DNS responses that contain malicious code from reaching clients, whether or not the responses are reconstructed by a local caching DNS server. Since the server may cache the responses, the malicious code could persist until the server's cache is purged or the entries expire.

Disable Reverse DNS Lookups

Disable the reverse DNS lookup functions in applications that perform DNS name lookups from IP addresses. For example, some HTTP and FTP servers perform reverse DNS lookups to convert IP addresses to hostnames in logs. Disabling reverse DNS lookups will only protect against specific exploit attempts that rely on the reverse lookup as an attack vector.

Systems Affected (Learn More)

VendorStatusDate NotifiedDate Updated
Compaq Computer CorporationAffected27 Jun 200201 Apr 2003
ConectivaAffected-14 Aug 2002
Cray Inc.Affected27 Jun 200228 Jun 2002
DebianAffected27 Jun 200214 Aug 2002
FreeBSDAffected27 Jun 200227 Jun 2002
GNU glibcAffected28 Jun 200218 Jul 2002
Guardian Digital Inc. Affected27 Jun 200225 Jul 2002
Hewlett-Packard CompanyAffected27 Jun 200215 Apr 2003
IBMAffected27 Jun 200215 Apr 2003
ISCAffected27 Jun 200207 Mar 2003
Juniper NetworksAffected27 Jun 200229 Jun 2002
MandrakeSoftAffected27 Jun 200214 Aug 2002
MetaInfoAffected-15 Apr 2003
MetaSolv Software Inc.Affected-26 Jul 2002
NetBSDAffected27 Jun 200227 Jun 2002
If you are a vendor and your product is affected, let us know.View More »

CVSS Metrics (Learn More)

Group Score Vector
Base N/A N/A
Temporal N/A N/A
Environmental N/A N/A

References

Credit

The CERT/CC thanks PINE-CERT for reporting this vulnerability and The FreeBSD Project, the NetBSD Project, and David Conrad of Nominum for information used in this document.

This document was written by Art Manion.

Other Information

  • CVE IDs: CAN-2002-0651
  • CERT Advisory: CA-2002-19
  • Date Public: 26 Jun 2002
  • Date First Published: 27 Jun 2002
  • Date Last Updated: 16 Apr 2003
  • Severity Metric: 29.72
  • Document Revision: 58

Feedback

If you have feedback, comments, or additional information about this vulnerability, please send us email.