ISC BIND RRset denial of service

bind-rrsets-dos (31838)

Low Risk

Description:

ISC BIND is vulnerable to a denial of service, caused by improper validation of responses to type "*" (ANY) queries. A remote attacker could exploit this vulnerability to cause an assertion failure on authoritative servers when more than one SIG RRset is returned, resulting in a denial of service.

Platforms Affected:

• Apple, Mac OS X 10.3.9
• Apple, Mac OS X 10.4.9
• Apple, Mac OS X Server 10.3.9
• Apple, Mac OS X Server 10.4.9
• Canonical, Ubuntu 5.10
• Canonical, Ubuntu 6.06 LTS
• Canonical, Ubuntu 6.10
• Compaq, Tru64 4.0f_pk8
• Compaq, Tru64 4.0g_pk4
• Compaq, Tru64 5.1a_pk6
• Compaq, Tru64 5.1b3
• Compaq, Tru64 5.1b4
• Compaq, Tru64 6.6
• Debian, Debian Linux 3.1
• Gentoo, Linux
• HP, HP-UX 11.11
• HP, HP-UX 11.23
• IBM, AIX 5.3
• ISC, BIND 9.3.0
• ISC, BIND 9.3.1
• ISC, BIND 9.3.2
• ISC, BIND 9.3.3
• ISC, BIND 9.4.0a1
• ISC, BIND 9.4.0a2
• ISC, BIND 9.4.0a3
• ISC, BIND 9.4.0a4
• ISC, BIND 9.4.0a5
• ISC, BIND 9.4.0a6
• ISC, BIND 9.4.0b1
• ISC, BIND 9.4.0b2
• ISC, BIND 9.4.0b3
• ISC, BIND 9.4.0b4
• ISC, BIND 9.5.0a1
• MandrakeSoft, Mandrake Linux 2006 X86_64
• MandrakeSoft, Mandrake Linux 2006
• MandrakeSoft, Mandrake Linux 2007
• MandrakeSoft, Mandrake Linux 2007 X86_64
• MandrakeSoft, Mandrake Linux Corporate Server 3.0
• MandrakeSoft, Mandrake Linux Corporate Server 3.0 X86_64
• MandrakeSoft, Mandrake Linux Corporate Server 4.0
• MandrakeSoft, Mandrake Linux Corporate Server 4.0 X86_64
• MandrakeSoft, Mandrake Multi Network Firewall 2.0
• Novell, Linux Desktop 9
• Novell, Linux POS 9
• Novell, Open Enterprise Server
• Novell, Open Enterprise Server
• Novell, OpenSUSE 10.2
• Novell, UnitedLinux 1.0
• OpenPKG, OpenPKG 2-STABLE
• OpenPKG, OpenPKG CURRENT
• OpenPKG, OpenPKG Enterprise E1.0-SOLID
• RedHat, Enterprise Linux 2.1 WS
• RedHat, Enterprise Linux 2.1 AS
• RedHat, Enterprise Linux 2.1 ES
• RedHat, Enterprise Linux 3 AS
• RedHat, Enterprise Linux 3 ES
• RedHat, Enterprise Linux 3 Desktop
• RedHat, Enterprise Linux 3 WS
• RedHat, Enterprise Linux 4 Desktop
• RedHat, Enterprise Linux 4 AS
• RedHat, Enterprise Linux 4 ES
• RedHat, Enterprise Linux 4 WS
• RedHat, Enterprise Linux 5 Client Workstation
• RedHat, Enterprise Linux 5 Client
• RedHat, Enterprise Linux 5
• RedHat, Enterprise Linux Desktop 5.0
• RedHat, Linux Advanced Workstation 2.1 Itanium
• Sun, Solaris 10 x86
• Sun, Solaris 10 SPARC
• SuSE, Linux Enterprise Server 8
• SuSE, SuSE Linux 10.0
• SuSE, SuSE Linux 10.1
• SuSE, SuSE Linux 9.3
• SuSE, SuSE Linux OpenExchange Server 4
• SuSE, SuSE Linux Retail Solution 8
• SuSE, SuSE Linux School Server
• SuSE, SuSE Linux Standard Server 8
• SuSE, SuSE SLED 10
• SuSE, SuSE SLES 10
• SuSE, SuSE SLES 9
• Turbolinux, Turbolinux 10 Desktop
• Turbolinux, Turbolinux 10 F...
• Turbolinux, Turbolinux 10 Server
• Turbolinux, Turbolinux 10 Server x64 Ed
• Turbolinux, Turbolinux 8 Server
• Turbolinux, Turbolinux FUJI
• Turbolinux, Turbolinux Home
• Turbolinux, Turbolinux Multimedia
• Turbolinux, Turbolinux Personal
• Turbolinux, Turbolinux Appliance Server 1.0 Hosting Ed
• Turbolinux, Turbolinux Appliance Server 1.0 Workgroup Ed
• Turbolinux, Turbolinux Appliance Server 2.0
• VMware, ESX Server 2.0.2
• VMware, ESX Server 2.1.3
• VMware, ESX Server 2.5.3
• VMware, ESX Server 2.5.4
• VMware, ESX Server 3.0.0
• VMware, ESX Server 3.0.1
• VMware, ESX Server 3.0.2

Remedy:

Upgrade to the latest version of BIND (9.2.8 or later, 9.3.4 or later, or 9.4.0rc2), available from the Internet Software Consortium (ISC) Web site. See References.

For VMware ESX 3.0.1:
Apply Patch Bundle ESX-1001691, available from the VMware Web site. See References.

For VMware ESX 3.0.0:
Apply Patch Bundle ESX-1001206, available from the VMware Web site. See References.

For VMware ESX 3.0.2:
Apply Patch Bundle ESX-1001725, available from the VMware Web site. See References.

For VMware ESX 2.5.4:
Upgrade to the latest version of VMware ESX (patch 10 Build 53326 or later), available from the VMware Web site. See References.

For VMware ESX 2.5.3:
Upgrade to the latest version of VMware ESX (patch 13 Build 52488 or later), available from the VMware Web site. See References.

For VMware ESX 2.1.3:
Upgrade to the latest version of VMware ESX (patch 8 Build 53228 or later), available from the VMware Web site. See References.

For VMware ESX 2.0.2:
Upgrade to the latest version of VMware ESX (patch 8 Build 52650 or later), available from the VMware Web site. See References.

For Apple Mac OS X:
Apply Apple Security Update 2007-005, available from the Apple Web site. See References.

For Mandriva Linux:
Refer to MDKSA-2007:030 for patch, upgrade, or suggested workaround information. See References.

For SUSE Linux:
Refer to SUSE Security Announcement SUSE-SA:2007:014 for patch, upgrade or suggested workaround information. See References.

For Debian GNU/Linux:
Refer to DSA-1254-1 for patch, upgrade, or suggested workaround information. See References.

For Ubuntu Linux:
Refer to USN-418-1 for patch, upgrade, or suggested workaround information. See References.

For Gentoo Linux:
Refer to Gentoo Linux Security Announcement GLSA 200702-06 for patch, upgrade, or suggested workaround information. See References.

For Turbolinux:
Refer to TLSA-2007-9 for patch, upgrade, or suggested workaround information. See References.

For OpenPKG:
Refer to OpenPKG-SA-2007.007 for patch, upgrade, or suggested workaround information. See References.

For Red Hat Linux:
Refer to RHSA-2007:0057-3 or RHSA-2007:0044 for patch, upgrade, or suggested workaround information. See References.

For IBM AIX:
Refer to IBM APAR IY95618, IBM APAR IY95619, IBM APAR IY96144, or IBM APAR IY96324 for patch, upgrade, or suggested workaround information. See References.

For HP-UX (bind):
Refer to HPSBUX02219 SSRT061273 for patch, upgrade, or suggested workaround information. See References.

For Sun Solaris (BIND DNSSEC):
Refer to Sun Alert ID: 102969 for patch, upgrade, or suggested workaround information. See References.

For HP Tru64 UNIX (BIND):
Refer to HPSBTU02207 SSRT061239 rev.2 for patch, upgrade, or suggested workaround information. See References.

For other distributions:
Contact your vendor for upgrade or patch information.

Consequences:

Denial of Service

References:

• Apple Security Update 2007-005, About Security Update 2007-005 at http://docs.info.apple.com/article.html?artnum=305530.
• Apple Web site, Apple security updates at http://docs.info.apple.com/article.html?artnum=61798.
• Full-Disclosure Mailing List, Wed Sep 19 2007 - 21:15:23 CDT, VMSA-2007-0006 Critical security updates for all supported versions of VMware ESX Server, VMware Server, VMware Workstation, VMware ACE, and VMware Player at http://archives.neohapsis.com/archives/fulldisclosure/2007-09/0356.html.
• HPSBTU02207 SSRT061239 rev.2 , HP Tru64 UNIX OpenSSL and BIND Remote Arbitrary Code Execution or Denial of Service (DoS) at http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c00967144.
• HPSBUX02219 SSRT061273, HP-UX Running BIND, Remote Denial of Service (DoS) at http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c01070495.
• IBM APAR IY95618, POTENTIAL SECURITY ISSUE IN BOS.NET.TCP.SERVER at http://www-1.ibm.com/support/docview.wss?uid=isg1IY95618.
• IBM APAR IY95619, POTENTIAL SECURITY ISSUE IN BOS.NET.TCP.SERVER at http://www-1.ibm.com/support/docview.wss?uid=isg1IY95619.
• IBM APAR IY96144, POTENTIAL SECURITY ISSUE IN BOS.NET.TCP.SERVER at http://www-1.ibm.com/support/docview.wss?uid=isg1IY96144.
• IBM APAR IY96324, POTENTIAL SECURITY ISSUE IN BOS.NET.TCP.SERVER at http://www-1.ibm.com/support/docview.wss?uid=isg1IY96324.
• Internet Software Consortium (ISC) Web site, BIND (Berkeley Internet Name Domain) page at http://www.isc.org/products/BIND/.
• Internet Systems Consortium Security Advisory, BIND 9: DNSSEC Validation at http://marc.theaimsgroup.com/?l=bind-announce&m=116968519300764&w=2.
• rPSA-2007-0021-1 bind bind-utils, bind: various security flaws CVE-2007-0493 CVE-2007-0494 at https://issues.rpath.com/browse/RPL-989.
• Sun Alert ID: 102969, Security Vulnerability in Solaris 10 BIND DNSSEC May Cause a Denial of Service at http://sunsolve.sun.com/search/document.do?assetkey=1-26-102969-1.
• VMware Security-announce Mailing list, Wed Sep 19 19:15:23 PDT 2007, VMSA-2007-0006 Critical security updates for all supported versions of VMware ESX Server, VMware Server, VMware Workstation, VMware ACE, and VMware Player at http://lists.vmware.com/pipermail/security-announce/2007/000001.html.
• VMware, Inc. Web site, Download Patch ESX-1001725 for VMware ESX Server 3.0.2 at http://www.vmware.com/support/vi3/doc/esx-1001725-patch.html.
• VMware, Inc. Web site, Download Patch ESX-1001691 for VMware ESX Server 3.0.1 at http://www.vmware.com/support/vi3/doc/esx-1001691-patch.html.
• VMware, Inc. Web site, VMware ESX Server Download Archive at http://www.vmware.com/download/.
• VMware, Inc. Web site, Download Patch ESX-1001206 for VMware ESX Server 3.0.0 at http://www.vmware.com/support/vi3/doc/esx-1001206-patch.html.
• ASA-2007-125: bind security update (RHSA-2007-0044)
• ASA-2007-240: HP-UX Running BIND Remote Denial of Service (DoS) (HPSBUX02219)
• ASA-2007-280: Security Vulnerability in Solaris 10 BIND DNSSEC May Cause a Denial of Service (Sun 102969)
• BID-22231: ISC BIND Remote DNSSEC Validation Denial of Service Vulnerability
• CVE-2007-0494: ISC BIND 9.0.x, 9.1.x, 9.2.0 up to 9.2.7, 9.3.0 up to 9.3.3, 9.4.0a1 up to 9.4.0a6, 9.4.0b1 up to 9.4.0b4, 9.4.0rc1, and 9.5.0a1 (Bind Forum only) allows remote attackers to cause a denial of service (exit) via a type * (ANY) DNS query response that contains multiple RRsets, which triggers an assertion error, aka the DNSSEC Validation vulnerability.
• DSA-1254: bind9 -- insufficient input sanitising
• MDKSA-2007:030: Updated bind packages fix DoS vulnerabilities
• OpenPKG-SA-2007.007: bind
• RHSA-2007-0044: Moderate: bind security update
• RHSA-2007-0057: Moderate: bind security update
• SA23904: ISC BIND Denial of Service Vulnerabilities
• SA24648: Avaya Products bind Denial of Service
• SA24930: HP Tru64 UNIX Multiple SSL and BIND Vulnerabilities
• SA24950: HP Insight Management Agents SSL Vulnerabilities
• SA25482: IBM AIX BIND Denial of Service Vulnerability
• SA25715: Sun Solaris 10 BIND DNSSEC Denial of Service
• SA26909: VMware ESX Server Multiple Security Updates
• SECTRACK ID: 1017573: BIND DNSSEC Validation Bug Lets Remote Users Deny Service
• SUSE-SA:2007:014: bind remote denial of service problem

Reported:

Jan 25, 2007

The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.

For corrections or additions please email xforce@iss.net

Return to the main page