Vulnerability Note VU#868916

ISC BIND 4 contains input validation error in nslookupComplain()

Original Release date: 29 Jan 2001 | Last revised: 06 Dec 2002

Overview

The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) by the Internet Software Consortium (ISC). There is a format string vulnerability in BIND 4.9.4 that may allow remote intruders to gain access to systems running BIND. Although BIND 4.9.x is no longer officially maintained by ISC, various versions are still widely deployed on the Internet.

This vulnerability has been successfully exploited in a laboratory environment and presents a serious threat to the Internet infrastructure.

Description

There is a format string vulnerability in the nslookupComplain() routine of several versions of ISC BIND. This vulnerability is reported to exist in all versions prior to BIND 4.9.5-P1.

The vulnerable buffer is a locally defined character array used to build an error message intended for syslog. Attackers attempting to exploit this vulnerability could do so by sending a specially formatted DNS query to affected BIND servers. If properly constructed, this query could be used to disrupt the normal operation of the DNS server process, resulting in the execution of arbitrary code. If an attacker were able to execute code or commands, they would do so with the same privileges as the BIND process, which are typically superuser privileges.

It is important to note that other vendors of DNS software may be vulnerable to this problem as well. Please contact your vendor or check the vendor section of this document for further details.

Impact

This vulnerability may allow an attacker to execute privileged commands or code with the same permissions as the BIND server. Because BIND is typically run by a superuser account, the execution would occur with superuser privileges.

Solution

This vulnerability was patched by the ISC in an earlier version of BIND 4, most likely BIND 4.9.5-P1. However, there is strong evidence to suggest that some third party vendors who redistribute BIND have not included these changes in their BIND packages. Therefore, the CERT/CC recommends that all users of BIND 4 or its derivatives base their distributions on BIND 4.9.8.

The BIND 4.9.8 distribution can be downloaded from:


The BIND 9.1 distribution can be downloaded from:

Please note that upgrading to BIND 4.9.8 also addresses the vulnerabilities discussed in VU#325431 and VU#572183.

Systems Affected (Learn More)

VendorStatusDate NotifiedDate Updated
Compaq Computer CorporationAffected25 Jan 200104 Apr 2001
IBMAffected25 Jan 200105 Apr 2001
ISCAffected24 Jan 200104 Apr 2001
NetBSDAffected25 Jan 200105 Apr 2001
Sun Microsystems Inc.Affected25 Jan 200107 Aug 2001
SuSE Inc.Affected03 Feb 200105 Apr 2001
The SCO Group (SCO Linux)Affected25 Jan 200129 Jan 2001
The SCO Group (SCO UnixWare)Affected25 Jan 200101 May 2002
Apple Computer Inc.Not Affected25 Jan 200105 Apr 2001
FreeBSDNot Affected25 Jan 200105 Apr 2001
Hewlett-Packard CompanyNot Affected25 Jan 200105 Apr 2001
MandrakeSoftNot Affected03 Feb 200104 Apr 2001
Microsoft CorporationNot Affected25 Jan 200130 Jan 2001
OpenBSDNot Affected25 Jan 200130 Jan 2001
BSDIUnknown25 Jan 200126 Jan 2001
If you are a vendor and your product is affected, let us know.View More »

CVSS Metrics (Learn More)

Group Score Vector
Base N/A N/A
Temporal N/A N/A
Environmental N/A N/A

References

Credit

The CERT/CC thanks the COVERT Labs at PGP Security for discovering and analyzing this vulnerability and the Internet Software Consortium for providing a patch to fix it.

This document was written by Jeffrey P. Lanza.

Other Information

  • CVE IDs: CAN-2001-0013
  • CERT Advisory: CA-2001-02
  • Date Public: 29 Jan 2001
  • Date First Published: 29 Jan 2001
  • Date Last Updated: 06 Dec 2002
  • Severity Metric: 33.92
  • Document Revision: 25

Feedback

If you have feedback, comments, or additional information about this vulnerability, please send us email.