Re: libc flaw: BIND 9 closes most holes but also opens one

From: Andrew McNaughton (andrew@scoop.co.nz)
Date: 06/29/02 

Date: Sat, 29 Jun 2002 14:48:56 +1200 (NZST)
From: Andrew McNaughton <andrew@scoop.co.nz>
To: Brett Glass <brett@lariat.org>

On Fri, 28 Jun 2002, Brett Glass wrote:

> I've installed BIND 9 on our main domain name server to shield systems
> (including Windows boxes, which may be vulnerable) from the libc hole.
> Unfortunately, according to ISC, BIND 9 comes with a version of
> libbind that's vulnerable. (See http://www.cert.org/advisories/CA-2002-19.html.)
> So, if you load up BIND 9 and an app that uses it (such as Sendmail) links
> to the vulnerable libbind, you're still exposed.

You do have an advantage though in tha bind can run with reduced
privileges and in a chroot dir. Much the same sort of protection that
privilege separation in sshd affords.

Given that unsafe privileged code is talking to bind, a compromised bind
could perhaps be made to do evil things, but producing an exploit which
modifies the executing code to that extent is no easy target.

Andrew McNaughton

To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message

Relevant Pages

  • Re: Sol10: Running Bind through SMF as root. Really as safe as told?
    ... privileges for non-priv aware applications using the old rc.d model. ... Should bind be compromised by whatever means and thus allowing ... > Starting as root and removing privs can be done without too much ...
    (comp.unix.solaris)
  • Re: Ports 0-1023?
    ... uid 80 can bind to tcp port 80. ... things root can :-) Don't think of it as giving privileges, ...
    (Vuln-Dev)
  • RE: Who to run sshd as
    ... but when ever someone logs in a child process starts ... privileges than you allow that user. ... Who to run sshd as ... but that user does not have permission to bind the socket. ...
    (SSH)
  • libc flaw: BIND 9 closes most holes but also opens one
    ... I've installed BIND 9 on our main domain name server to shield systems ... from the libc hole. ... to the vulnerable libbind, you're still exposed. ...
    (FreeBSD-Security)