ISC BIND 9 before 9.2.1 allows remote attackers to cause a denial of service (shutdown) via a malformed DNS packet that triggers an error condition that is not properly handled when the rdataset parameter to the dns_message_findtype() function in message.c is not NULL, aka DoS_findtype.

The remote BIND 9 server is vulnerable to a denial of service attack.

A vulnerability was discovered in the BIND9 DNS server in versions prior to 9.2.1. An error condition will trigger the shutdown of the server when the rdataset parameter to the dns_message_findtype() function in message.c is not NULL as expected. This condition causes the server to assert an error message and shutdown the BIND server.
The error condition can be remotely exploited by a special DNS packet.
This can only be used to create a Denial of Service on the server; the error condition is correctly detected, so it will not allow an attacker to execute arbitrary code on the server.

Update :

Sascha Kettler noticed that the version of BIND9 supplied originally was in fact 9.2.1RC1 and mis-labelled as 9.2.1. The packages provided in this update are BIND 9.2.1 final. Likewise, the buffer overflow in the DNS resolver libraries, as noted in MDKSA-2002:043, has also been fixed. Thanks to Bernhard Rosenkraenzer at Red Hat for backporting the patches from 8.3.3 to 9.2.1.

Version 9 of ISC BIND, prior to version 9.2.1, contained a denial of service (DoS) attack vulnerability. Various versions of the ISC BIND resolver libraries are vulnerable to a buffer overflow attack.

ISC BIND (Berkeley Internet Name Domain) is an implementation of the DNS (Domain Name System) protocols. BIND includes a DNS server (named)
-- which resolves hostnames to IP addresses, a resolver library (routines for applications to use when interfacing with DNS), and various tools.

Versions of BIND 9 prior to 9.2.1 have a bug that causes certain requests to the BIND name server to fail an internal consistency check, causing the name server to stop responding to requests. This can be used by a remote attacker to cause a denial of service (DoS) attack against name servers. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2002-0400 to this issue.

A buffer overflow vulnerability exists in multiple implementations of DNS resolver libraries. Applications that utilize vulnerable DNS resolver libraries may be affected. A remote attacker who is able to send malicious DNS responses could potentially exploit this vulnerability to execute arbitrary code or cause a denial of service (DoS) attack on a vulnerable system. Red Hat Linux does not ship with any applications or libraries that link against the BIND resolver libraries; however, third party code may be affected. (CVE-2002-0651)

Red Hat Linux Advanced Server shipped with a version of ISC BIND vulnerable to both of these issues. All users of BIND are advised to upgrade to the errata packages containing BIND 9.2.1 which contains backported patches that correct these issues.

The remote BIND server, according to its version number, is vulnerable to a remote denial of service attack.

An attacker may use this flaw to prevent this service from working properly.

ID	Name	Product	Family	Severity
1001	ISC BIND 9 'rdataset' Parameter Malformed DNS Packet DoS	Nessus Network Monitor	DNS Servers	high
13943	Mandrake Linux Security Advisory : bind (MDKSA-2002:038-1)	Nessus	Mandriva Local Security Checks	high
12635	RHEL 2.1 : bind (RHSA-2002:119)	Nessus	Red Hat Local Security Checks	high
11051	ISC BIND < 9.2.1 rdataset Parameter Malformed DNS Packet DoS	Nessus	DNS	high

Detections

Analytics

CVE-2002-0400

high

Tenable Plugins

high

high

high

high