FreeBSD Security Advisory FreeBSD-SA-09:12.bind



-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

=============================================================================
FreeBSD-SA-09:12.bind Security Advisory
The FreeBSD Project

Topic: BIND named(8) dynamic update message remote DoS

Category: contrib
Module: bind
Announced: 2009-07-29
Credits: Matthias Urlichs
Affects: All supported versions of FreeBSD
Corrected: 2009-07-28 23:59:22 UTC (RELENG_7, 7.2-STABLE)
2009-07-29 00:14:14 UTC (RELENG_7_2, 7.2-RELEASE-p3)
2009-07-29 00:14:14 UTC (RELENG_7_1, 7.1-RELEASE-p7)
2009-07-29 00:13:47 UTC (RELENG_6, 6.4-STABLE)
2009-07-29 00:14:14 UTC (RELENG_6_4, 6.4-RELEASE-p6)
2009-07-29 00:14:14 UTC (RELENG_6_3, 6.3-RELEASE-p12)
CVE Name: CVE-2009-0696

For general information regarding FreeBSD Security Advisories,
including descriptions of the fields above, security branches, and the
following sections, please visit <URL:http://security.FreeBSD.org/>.

NOTE: Due to this issue being accidentally disclosed early, updated
binaries are yet not available via freebsd-update at the time this
advisory is being published. Email will be sent to the freebsd-security
mailing list when the binaries are available via freebsd-update.

I. Background

BIND 9 is an implementation of the Domain Name System (DNS) protocols.
The named(8) daemon is an Internet Domain Name Server.

Dynamic update messages may be used to update records in a master zone
on a nameserver.

II. Problem Description

When named(8) receives a specially crafted dynamic update message an
internal assertion check is triggered which causes named(8) to exit.

To trigger the problem, the dynamic update message must contains a
record of type "ANY" and at least one resource record set (RRset) for
this fully qualified domain name (FQDN) must exist on the server.

III. Impact

An attacker which can send DNS requests to a nameserver can cause it to
exit, thus creating a Denial of Service situation.

IV. Workaround

No generally applicable workaround is available, but some firewalls
may be able to prevent nsupdate DNS packets from reaching the
nameserver.

NOTE WELL: Merely configuring named(8) to ignore dynamic updates is NOT
sufficient to protect it from this vulnerability.

V. Solution

Perform one of the following:

1) Upgrade your vulnerable system to 6-STABLE, or 7-STABLE, or to the
RELENG_7_2, RELENG_7_1, RELENG_6_4, or RELENG_6_3 security branch
dated after the correction date.

2) To patch your present system:

The following patches have been verified to apply to FreeBSD 6.3, 6.4,
7.1, and 7.2 systems.

a) Download the relevant patch from the location below, and verify the
detached PGP signature using your PGP utility.

# fetch http://security.FreeBSD.org/patches/SA-09:12/bind.patch
# fetch http://security.FreeBSD.org/patches/SA-09:12/bind.patch.asc

b) Execute the following commands as root:

# cd /usr/src
# patch < /path/to/patch
# cd /usr/src/lib/bind
# make obj && make depend && make && make install
# cd /usr/src/usr.sbin/named
# make obj && make depend && make && make install
# /etc/rc.d/named restart

VI. Correction details

The following list contains the revision numbers of each file that was
corrected in FreeBSD.

CVS:

Branch Revision
Path
- -------------------------------------------------------------------------
RELENG_6
src/contrib/bind9/bin/named/update.c 1.1.1.2.2.5
RELENG_6_4
src/UPDATING 1.416.2.40.2.10
src/sys/conf/newvers.sh 1.69.2.18.2.12
src/contrib/bind9/bin/named/update.c 1.1.1.2.2.3.2.1
RELENG_6_3
src/UPDATING 1.416.2.37.2.17
src/sys/conf/newvers.sh 1.69.2.15.2.16
src/contrib/bind9/bin/named/update.c 1.1.1.2.2.2.2.1
RELENG_7
src/contrib/bind9/bin/named/update.c 1.1.1.5.2.3
RELENG_7_2
src/UPDATING 1.507.2.23.2.6
src/sys/conf/newvers.sh 1.72.2.11.2.7
src/contrib/bind9/bin/named/update.c 1.1.1.5.2.2.2.1
RELENG_7_1
src/UPDATING 1.507.2.13.2.10
src/sys/conf/newvers.sh 1.72.2.9.2.11
src/contrib/bind9/bin/named/update.c 1.1.1.5.2.1.4.1
HEAD
src/contrib/bind9/bin/named/update.c 1.4
- -------------------------------------------------------------------------

Subversion:

Branch/path Revision
- -------------------------------------------------------------------------
head/ r195936
stable/6/ r195934
releng/6.4/ r195935
releng/6.3/ r195935
stable/7/ r195933
releng/7.2/ r195935
releng/7.1/ r195935
- -------------------------------------------------------------------------

VII. References

https://www.isc.org/node/474
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=538975
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0696

The latest revision of this advisory is available at
http://security.FreeBSD.org/advisories/FreeBSD-SA-09:12.bind.asc
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (FreeBSD)

iD8DBQFKb5koFdaIBMps37IRAglLAKCFGXI+MAsksnK5TZB/8L3UFhPS1gCgl7q5
6fCpOeBcf7f83dVfKRDVF0I=
=akJW
-----END PGP SIGNATURE-----
_______________________________________________
freebsd-security@xxxxxxxxxxx mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-security
To unsubscribe, send any mail to "freebsd-security-unsubscribe@xxxxxxxxxxx"



Relevant Pages

  • RE: FreeBSD Security Advisory FreeBSD-SA-06:23.openssl
    ... The description of CVE-2006-3738 in the advisory from openssl.org ... Subject: FreeBSD Security Advisory FreeBSD-SA-06:23.openssl ... FreeBSD includes software from the OpenSSL Project. ... Applications which perform public key operations using untrusted keys may be ...
    (FreeBSD-Security)
  • [FreeBSD-Announce] FreeBSD Security Advisory FreeBSD-SA-09:12.bind
    ... For general information regarding FreeBSD Security Advisories, ... When namedreceives a specially crafted dynamic update message an ... The latest revision of this advisory is available at ...
    (freebsd-announce)
  • FreeBSD Security Advisory FreeBSD-SA-09:12.bind
    ... For general information regarding FreeBSD Security Advisories, ... When namedreceives a specially crafted dynamic update message an ... The latest revision of this advisory is available at ...
    (Bugtraq)
  • FreeBSD Security Advisory FreeBSD-SA-05:18.zlib
    ... For general information regarding FreeBSD Security Advisories, ... including descriptions of the fields above, security branches, and the ... The issue discussed in this advisory is distinct from the ... A fixed-size buffer is used in the decompression of data streams. ...
    (FreeBSD-Security)
  • [FreeBSD-Announce] FreeBSD Security Advisory FreeBSD-SA-05:18.zlib
    ... For general information regarding FreeBSD Security Advisories, ... including descriptions of the fields above, security branches, and the ... The issue discussed in this advisory is distinct from the ... A fixed-size buffer is used in the decompression of data streams. ...
    (freebsd-announce)