BIND 8.x through 8.3.3 allows remote attackers to cause a denial of service (crash) via SIG RR elements with invalid expiry times, which are removed from the internal BIND database and later cause a null dereference.

[Bind version 9, the bind9 package, is not affected by these problems.]

ISS X-Force has discovered several serious vulnerabilities in the Berkeley Internet Name Domain Server (BIND). BIND is the most common implementation of the DNS (Domain Name Service) protocol, which is used on the vast majority of DNS servers on the Internet. DNS is a vital Internet protocol that maintains a database of easy-to-remember domain names (host names) and their corresponding numerical IP addresses.

Circumstantial evidence suggests that the Internet Software Consortium (ISC), maintainers of BIND, was made aware of these issues in mid-October. Distributors of Open Source operating systems, including Debian, were notified of these vulnerabilities via CERT about 12 hours before the release of the advisories on November 12th. This notification did not include any details that allowed us to identify the vulnerable code, much less prepare timely fixes.

Unfortunately ISS and the ISC released their security advisories with only descriptions of the vulnerabilities, without any patches. Even though there were no signs that these exploits are known to the black-hat community, and there were no reports of active attacks, such attacks could have been developed in the meantime - with no fixes available.

We can all express our regret at the inability of the ironically named Internet Software Consortium to work with the Internet community in handling this problem. Hopefully this will not become a model for dealing with security issues in the future.

The Common Vulnerabilities and Exposures (CVE) project identified the following vulnerabilities :

  - CAN-2002-1219: A buffer overflow in BIND 8 versions     8.3.3 and earlier allows a remote attacker to execute     arbitrary code via a certain DNS server response     containing SIG resource records (RR). This buffer     overflow can be exploited to obtain access to the victim     host under the account the named process is running     with, usually root.
  - CAN-2002-1220: BIND 8 versions 8.3.x through 8.3.3     allows a remote attacker to cause a denial of service     (termination due to assertion failure) via a request for     a subdomain that does not exist, with an OPT resource     record with a large UDP payload size.

  - CAN-2002-1221: BIND 8 versions 8.x through 8.3.3 allows     a remote attacker to cause a denial of service (crash)     via SIG RR elements with invalid expiry times, which are     removed from the internal BIND database and later cause     a null dereference.

These problems have been fixed in version 8.3.3-2.0woody1 for the current stable distribution (woody), in version 8.2.3-0.potato.3 for the previous stable distribution (potato) and in version 8.3.3-3 for the unstable distribution (sid). The fixed packages for unstable will enter the archive today.

The remote BIND server is vulnerable to the SIG cached RR overflow vulnerability. An attacker may use this flaw to gain a shell on this system.

The remote BIND server is vulnerable to three different vulnerabilities : 
1) The remote BIND server, based on its version number, if running recursive DNS functionality, is vulnerable to a buffer overflow.
2) The remote BIND server is vulnerable to a denial of service (crash) via SIG RR elements with invalid expiry times.
3) The remote BIND server is vulnerable to a denial of service.
When a DNS lookup is requested on a non-existant sub-domain of a valid domain and an OPT resource record with a large UDP payload is attached, the server may fail.   

The remote host is missing the patch for the advisory SUSE-SA:2002:044 (bind8).


The security research company ISS (Internet Security Services) has discovered several vulnerabilities in the BIND8 name server, including a remotely exploitable buffer overflow.


1.	There is a buffer overflow in the way named handles SIG records. This buffer overflow can be exploited to obtain access to the victim host under the account the named process is running with.

2.	There are several Denial Of Service problems in BIND8 that allow remote attackers to terminate the name server process.

Both vulnerabilities are addressed by this update, using patches originating from ISC.

The remote name server, according to its version number, is affected by the following vulnerabilities :

- When running the recursive DNS functionality, this server is vulnerable to a buffer overflow attack that may let an attacker execute arbitrary code on the remote host. 

- It is vulnerable to a denial of service attack (crash) via SIG RR elements with invalid expiry times. 

- It is vulnerable to a denial of service attack when a DNS lookup is requested on a nonexistent sub-domain of a valid domain and an OPT resource record with a large UDP payload is attached, the server may fail.

ID	Name	Product	Family	Severity
15033	Debian DSA-196-1 : bind - several vulnerabilities	Nessus	Debian Local Security Checks	high
1011	ISC BIND < 4.9.11 Multiple Remote Vulnerabilities (deprecated)	Nessus Network Monitor	DNS Servers	critical
1010	ISC BIND < 8.3.4 Remote Buffer Overflow (deprecated)	Nessus Network Monitor	DNS Servers	critical
1009	ISC BIND < 8.2.7 Multiple Remote Vulnerabilities (deprecated)	Nessus Network Monitor	DNS Servers	critical
1006	ISC BIND < 8.3.4 Multiple Remote Vulnerabilities (deprecated)	Nessus Network Monitor	DNS Servers	high
13765	SUSE-SA:2002:044: bind8	Nessus	SuSE Local Security Checks	high
10886	ISC BIND < 8.3.4 Multiple Remote Vulnerabilities	Nessus	DNS	high

Detections

Analytics

CVE-2002-1221

high

Tenable Plugins

high

critical

critical

critical

high

high

high