Vulnerability Note VU#844360

Domain Name System (DNS) stub resolver libraries vulnerable to buffer overflows via network name or address lookups

Overview

The DNS stub resolver library in ISC BIND 4.9.2 through 4.9.10 contains buffer overflows in code that handles responses for network name and address requests. Other resolver libraries derived from BIND 4 such as BSD libc, GNU glibc, and those used by System V UNIX systems may also be affected. An attacker could execute arbitrary code with the privileges of the application that made the request or cause a denial of service.

I. Description

A DNS stub resolver library provides an interface for network applications to make requests and receive responses from the domain name system. The BIND 4 resolver library (libresolv.a) contains several buffer overflows in the functions that handle responses for network name and address requests (getnetbyname(), getnetbyaddr()). While reading the answer portion of a DNS response, the functions copy data received from the network into inadequately sized buffers. A specially crafted DNS response could overflow the buffers, possibly injecting arbitrary code onto the stack.

ISC BIND 4.9.2 through 4.9.10 are vulnerable. DNS stub resolver libraries that are derived from BIND 4 may vulnerable, including BSD libc, GNU glibc, and resolvers used by System V UNIX systems. In addition, some network applications provide their own resolver functions which may use vulnerable code from BIND 4.

The buffer overflows described in this document are different than the network lookup vulnerability described in CA-2002-19/VU#542971/CAN-2002-0684.

When performing a DNS lookup, applications issue calls to resolver functions, at which point most applications dynamically load the relevant portion of the resolver library. Other applications are statically linked at compile time to include resolver functions. In order to use updated resolver code, dynamically linked process must be restarted, and statically linked binaries must be recompiled.

II. Impact

An attacker could execute arbitrary code with the privileges of the application that made the request or cause a denial of service. The attacker would need to control DNS responses, possibly by spoofing responses or gaining control of a DNS server.

III. Solution

Patch or Upgrade

Upgrade or apply a patch as specified by your vendor. Dynamically linked processes must be restarted and statically linked binaries must be recompiled and in order to use the fixed resolver libraries.

Local Caching DNS Server Not Effective

A local caching DNS server will not prevent malicious responses from reaching vulnerable stub resolvers.

Systems Affected

Vendor	Status	Date Notified
Alcatel	Unknown	25-Feb-2003
Apple Computer Inc.	Vulnerable	25-Feb-2003
AT&T	Unknown	4-Apr-2003
Avaya	Unknown	27-Feb-2003
BlueCat Networks	Unknown	12-Nov-2002
Check Point	Unknown	27-Feb-2003
Cisco Systems Inc.	Unknown	15-Nov-2002
Computer Associates	Unknown	15-Nov-2002
Conectiva	Unknown	12-Nov-2002
Cray Inc.	Unknown	14-Nov-2002
D-Link Systems	Unknown	27-Feb-2003
Data General	Unknown	15-Nov-2002
Debian	Unknown	26-Feb-2003
djbdns	Unknown	27-Feb-2003
F5 Networks	Unknown	27-Feb-2003
fetchmail	Unknown	14-Nov-2002
FreeBSD	Not Vulnerable	14-Nov-2002
FreeRADIUS	Unknown	27-Feb-2003
Fujitsu	Unknown	27-Feb-2003
Funk Software	Unknown	27-Feb-2003
GNU adns	Unknown	12-Nov-2002
GNU glibc	Vulnerable	16-Jan-2003
Guardian Digital Inc.	Unknown	4-Apr-2003
Hewlett-Packard Company	Vulnerable	15-Apr-2003
IBM	Vulnerable	27-Feb-2003
Intel	Unknown	27-Feb-2003
ISC	Vulnerable	13-Nov-2002
Juniper Networks	Unknown	27-Feb-2003
KTH Kerberos	Unknown	14-Nov-2002
Lotus Software	Unknown	27-Feb-2003
Lucent Technologies	Unknown	27-Feb-2003
MandrakeSoft	Unknown	12-Nov-2002
Men&Mice	Unknown	12-Nov-2002
MetaSolv Software Inc.	Vulnerable	15-Nov-2002
Microsoft Corporation	Unknown	12-Nov-2002
MiT Kerberos Development Team	Unknown	12-Nov-2002
MontaVista Software	Unknown	12-Nov-2002
NcFTP Software	Not Vulnerable	5-Dec-2002
NEC Corporation	Unknown	4-Apr-2003
NetBSD	Vulnerable	25-Feb-2003
Network Appliance	Unknown	4-Apr-2003
Nixu	Unknown	12-Nov-2002
Nokia	Unknown	13-Nov-2002
Nominum	Unknown	27-Feb-2003
Nortel Networks	Unknown	15-Nov-2002
OpenBSD	Not Vulnerable	14-Nov-2002
OpenSSH	Unknown	27-Feb-2003
Openwall GNU/*/Linux	Vulnerable	14-Nov-2002
PADL Software	Not Vulnerable	14-Nov-2002
PuTTY	Unknown	27-Feb-2003
Red Hat Inc.	Unknown	12-Nov-2002
Sequent	Unknown	27-Feb-2003
SGI	Vulnerable	5-Dec-2002
Sony Corporation	Unknown	15-Nov-2002
Sun Microsystems Inc.	Vulnerable	15-Nov-2002
SuSE Inc.	Unknown	12-Nov-2002
The Open Group	Unknown	27-Feb-2003
The SCO Group	Vulnerable	27-Feb-2003
Trend Micro	Unknown	27-Feb-2003
Trustix	Unknown	27-Feb-2003
Unisys	Unknown	4-Apr-2003
Wind River Systems Inc.	Unknown	12-Nov-2002
Wirex	Unknown	13-Nov-2002
Xerox Corporation	Vulnerable	24-Apr-2003
Xi Graphics	Unknown	27-Feb-2003
YARD RADIUS	Unknown	27-Feb-2003

References

http://www.isc.org/products/BIND/bind-security.html
http://www.isc.org/products/BIND/patches/bind4910.diff

Credit

This vulnerability was reported by CERT/CC staff.

This document was written by Art Manion.

Other Information

Date Public:	2002-11-12
Date First Published:	2002-11-13
Date Last Updated:	2003-04-24
CERT Advisory:	CA-2002-31
CVE-ID(s):	CAN-2002-0029
NVD-ID(s):	CAN-2002-0029
US-CERT Technical Alerts:
Metric:	8.91
Document Revision:	22

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Get Adobe Reader