Roundup on BIND Denial of Service
Short description (from Incidents.org Handler’s Diary):
There is a Denial of Service vulnerability in ISC Bind (versions 9 up to 9.2.1) When this is exploited by a remote attacker, the BIND server will abort and shut down. After this, you must manually restart BIND. By disabling BIND, other services which depend on BIND may also fail.
More detailed description (from CERT Advisory CA-2002-15):
A vulnerability exists in version 9 of BIND that allows remote attackers to shut down BIND servers. An attacker can cause the shutdown by sending a specific DNS packet designed to trigger an internal consistency check. However, this vulnerability will not allow an attacker to execute arbitrary code or write data to arbitrary locations in memory.
The internal consistency check that triggers the shutdown occurs when the rdataset parameter to the dns_message_findtype() function in message.c is not NULL as expected. The condition causes the code to
assert an error message and call abort() to shut down the BIND server. It is also possible to accidentally trigger this vulnerability using common queries found in routine operation, especially queries originating from SMTP servers.
Full CERT advisory on this subject can be found over here:
Vendor (Internet Software Consortium) response:
As provided on BIND Security page:
Name: “DoS internal consistancy check”
Versions affected: All BIND 9 version prior to 9.2.1
Severity: SERIOUS
Exploitable: Remotely
Type: Denial of Service
Description: When chasing additional data chains in a response it is possible to trigger an internal consistancy check.
Workarounds / fix: Upgrade to 9.2.1.
BIND 9.2.1 – ftp://ftp.isc.org/isc/bind9/9.2.1/bind-9.2.1.tar.gz
PGP Signature for the file – ftp://ftp.isc.org/isc/bind9/9.2.1/bind-9.2.1.tar.gz.asc
Linux vendor responses:
Vendor: Caldera
Vulnerable systems: Open UNIX 8.0.0
Full advisory:
Vendor: Conectiva
Vulnerable systems: Conectiva Linux 7.0 and Conectiva Linux 8
Full advisory:
Vendor: SuSE
Vulnerable systems: SuSE Linux 7.0, SuSE Linux 7.1, SuSE Linux 7.2, SuSE Linux 7.3 and SuSE Linux 8.0
Full advisory:
Vendor: Red Hat
Vulnerable systems:Red Hat Linux 7.1 (alpha, i386 and ia64), Red Hat Linux 7.2 (i386 and ia64), Red Hat Linux 7.3 (i386)
Full advisory:
Mandrake Linux 8.x ships with BIND9 and as such updated packages will be available as early as possible.