An "incorrect assumption" in the authvalidated validator function in BIND 9.3.0, when DNSSEC is enabled, allows remote attackers to cause a denial of service (named server exit) via crafted DNS packets that cause an internal consistency test (self-check) to fail.

The remote BIG-IP device is missing a patch required by a security advisory.

Problem description

A DNSSEC-related validator function in BIND 9.3.0 contains an inappropriate internal consistency test. When this test is triggered, named(8) will exit.

Impact

On systems with DNSSEC enabled, a remote attacker may be able to inject a specially crafted packet that will cause the internal consistency test to trigger, and named(8) to terminate. As a result, the name server will no longer be available to service requests.

Workaround

DNSSEC is not enabled by default, and the 'dnssec-enable' directive is not normally present. If DNSSEC has been enabled, disable it by changing the 'dnssec-enable' directive to 'dnssec-enable no;' in the named.conf(5) configuration file.

A vulnerability was discovered in BIND version 9.3.0 where a remote attacker may be able to cause named to exit prematurely, causing a Denial of Service due to an incorrect assumption in the validator function authvalidated().

The updated packages have been patched to prevent this problem.

The remote BIND server, according to its version number, has a flaw in the way 'authvalidator()' is implemented.  An attacker may be able to launch a denial of service attack against the remote service. 

The remote BIND server, according to its version number, has a flaw in the way 'authvalidator()' is implemented. 

Provided DNSSEC has been enabled in the remote name server, an attacker may be able to launch a denial of service attack against the remote service.

ID	Name	Product	Family	Severity
78201	F5 Networks BIG-IP : BIND 9.3.0 denial of service vulnerability (SOL4351)	Nessus	F5 Networks Local Security Checks	medium
21410	FreeBSD : bind9 -- denial of service (30e4ed7b-1ca6-11da-bc01-000e0c2e438a)	Nessus	FreeBSD Local Security Checks	medium
16269	Mandrake Linux Security Advisory : bind (MDKSA-2005:023)	Nessus	Mandriva Local Security Checks	medium
2557	ISC BIND < 8.4.6 dnssec authvalidated Crafted Packet Remote DoS (deprecated)	Nessus Network Monitor	DNS Servers	low
16261	ISC BIND < 9.3.1 Validator Self Checking Remote DoS	Nessus	DNS	medium

Detections

Analytics

CVE-2005-0034

high

Tenable Plugins

medium

medium

medium

low

medium