Vulnerability Note VU#938617

BIND 9.3.0 vulnerable to denial of service in validator code

Overview

A vulnerability in the BIND name server could allow a remote attacker to cause a denial of service against an affected system.

I. Description

The Berkeley Internet Name Domain (BIND) is a popular Domain Name System (DNS) implementation from Internet Systems Consortium (ISC). BIND supports the DNS Security Extensions (DNSSEC), including the NextSECure (NSEC) RDATA Format defined by RFC3845. An incorrect assumption in the validator function authvalidated()can result in an internal consistancy test failing and named exiting. An attacker with the ability to craft specific DNS packets could exploit this vulnerability to cause a denial of service. This vulnerability only affects BIND version 9.3.0.

II. Impact

A remote attacker may be able to cause the name server daemon to exit prematurely, thereby causing a denial of service for DNS operations.

III. Solution

Apply a patch from the vendor

Patches have been released in response to this issue. Please see the Systems Affected section of this document.

Upgrade

Users who compile their own versions of BIND from the original ISC source code are encouraged to upgrade to BIND version 9.3.1, which includes a patch for this issue.

Workarounds

ISC recommends that users that are unable to apply the patch ensure that dnssec validation is turned off (it is off by default) at the options/view level. The relevant BIND configuration directive is:

dnssec-enable no;

Systems Affected

Vendor	Status	Date Notified
Adns	Unknown	17-Jan-2005
Apple Computer Inc.	Not Vulnerable	18-Mar-2005
BlueCat Networks	Unknown	17-Jan-2005
Check Point	Not Vulnerable	24-Jan-2005
Conectiva	Unknown	17-Jan-2005
Cray Inc.	Unknown	17-Jan-2005
Debian	Not Vulnerable	25-Jan-2005
EMC Corporation	Unknown	17-Jan-2005
Engarde	Unknown	17-Jan-2005
F5 Networks	Unknown	17-Jan-2005
FreeBSD	Vulnerable	21-Jun-2005
Fujitsu	Unknown	17-Jan-2005
GNU glibc	Unknown	17-Jan-2005
Hewlett-Packard Company	Unknown	17-Jan-2005
Hitachi	Not Vulnerable	20-Jan-2005
IBM	Not Vulnerable	24-Jan-2005
IBM-zSeries	Unknown	17-Jan-2005
IBM eServer	Unknown	1-Feb-2005
Immunix	Unknown	17-Jan-2005
InfoBlox	Not Vulnerable	18-Mar-2005
Ingrian Networks	Unknown	17-Jan-2005
ISC	Vulnerable	25-Jan-2005
Juniper Networks	Not Vulnerable	24-Jan-2005
Lucent Technologies	Unknown	17-Jan-2005
MandrakeSoft	Vulnerable	31-Jan-2005
Men&Mice	Unknown	17-Jan-2005
MetaSolv Software Inc.	Unknown	17-Jan-2005
Microsoft Corporation	Unknown	17-Jan-2005
MontaVista Software	Unknown	17-Jan-2005
NEC Corporation	Not Vulnerable	18-Mar-2005
NetBSD	Unknown	17-Jan-2005
Nokia	Unknown	17-Jan-2005
Nortel Networks	Unknown	17-Jan-2005
Novell	Unknown	17-Jan-2005
OpenBSD	Unknown	17-Jan-2005
Openwall GNU/*/Linux	Unknown	17-Jan-2005
Red Hat Inc.	Not Vulnerable	18-Jan-2005
SCO-LINUX	Unknown	17-Jan-2005
SCO-UNIX	Unknown	17-Jan-2005
Sequent	Unknown	17-Jan-2005
SGI	Unknown	17-Jan-2005
Sony Corporation	Unknown	17-Jan-2005
Sun Microsystems Inc.	Not Vulnerable	24-Jan-2005
SuSE Inc.	Unknown	17-Jan-2005
Trustix Secure Linux	Vulnerable	16-Feb-2005
TurboLinux	Unknown	17-Jan-2005
Unisys	Unknown	17-Jan-2005
Wind River Systems Inc.	Unknown	17-Jan-2005

References

http://www.isc.org/sw/bind/bind-security.php
http://www.niscc.gov.uk/niscc/docs/al-20050125-00060.html?lang=en

Credit

Thanks to Joao Damas of the Internet Systems Consortium for reporting this vulnerability.

This document was written by Chad Dougherty based on information provided by ISC.

Other Information

Date Public:	2005-01-25
Date First Published:	2005-01-25
Date Last Updated:	2005-06-21
CERT Advisory:
CVE-ID(s):	CAN-2005-0034
NVD-ID(s):	CAN-2005-0034
US-CERT Technical Alerts:
Metric:	1.91
Document Revision:	20

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Get Adobe Reader