BIND before 9.2.6-P1 and 9.3.x before 9.3.2-P1 allows remote attackers to cause a denial of service (crash) via a flood of recursive queries, which cause an INSIST failure when the response is received after the recursion queue is empty.

The remote host is missing AIX PTF U809482, which is related to the security of the package bos.net.tcp.client.

The remote host is missing AIX PTF U808275, which is related to the security of the package bos.net.tcp.client.

New bind packages are available for Slackware 9.0, 9.1, 10.0, 10.1, 10.2, and -current to fix a Denial of Service issue.

This update fixes two vulnerabilities in bind that allow a remote attacker to trigger a denial-of-service attack. (VU#697164 - BIND INSIST failure due to excessive recursive queries, VU#915404 - BIND assertion failure during SIG query processing)

bind did not sufficiently verify particular requests and responses from other name servers and users. By sending a specially crafted packet, a remote attacker could exploit this to crash the name server.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is running a version of Mac OS X 10.4 or 10.3 that does not have Security Update 2007-005 applied. 

This update fixes security flaws in the following applications :

Alias Manager BIND CoreGraphics crontabs fetchmail file iChat mDNSResponder PPP ruby screen texinfo VPN

Problem Description For a recursive DNS server, a remote attacker sending enough recursive queries for the replies to arrive after all the interested clients have left the recursion queue will trigger an INSIST failure in the named(8) daemon. Also for a recursive DNS server, an assertion failure can occur when processing a query whose reply will contain more than one SIG(covered) RRset.

For an authoritative DNS server serving a RFC 2535 DNSSEC zone which is queried for the SIG records where there are multiple SIG(covered) RRsets (e.g. a zone apex), named(8) will trigger an assertion failure when it tries to construct the response. Impact An attacker who can perform recursive lookups on a DNS server and is able to send a sufficiently large number of recursive queries, or is able to get the DNS server to return more than one SIG(covered) RRsets can stop the functionality of the DNS service.

An attacker querying an authoritative DNS server serving a RFC 2535 DNSSEC zone may be able to crash the DNS server. Workaround A possible workaround is to only allow trusted clients to perform recursive queries.

A vulnerability in BIND was discovered where it did not sufficiently verify particular requests and responses from other name servers and users. This could be exploited by sending a specially crafted packet to crash the name server.

Updated packages have been patched to address these issues.

Two vulnerabilities have been discovered in BIND9, the Berkeley Internet Name Domain server. The first relates to SIG query processing and the second relates to a condition that can trigger an INSIST failure, both lead to a denial of service.

The remote host is affected by the vulnerability described in GLSA-200609-11 (BIND: Denial of Service)

    Queries for SIG records will cause an assertion error if more than one     SIG RRset is returned. Additionally, an INSIST failure can be triggered     by sending multiple recursive queries if the response to the query     arrives after all the clients looking for the response have left the     recursion queue.
  Impact :

    An attacker having access to a recursive server can crash the server by     querying the SIG records where there are multiple SIG RRsets, or by     sending many recursive queries in a short time. The exposure can be     lowered by restricting the clients that can ask for recursion. An     attacker can also crash an authoritative server serving a DNSSEC zone     in which there are multiple SIG RRsets.
  Workaround :

    There are no known workarounds at this time.

The version of BIND installed on the remote host suggests that it suffers from multiple denial of service vulnerabilities that could be triggered by either by sending a large volume of recursive queries or queries for SIG records where there are multiple SIG(covered) RRsets. 

Note that Nessus obtained the version by sending a special DNS request for the text 'version.bind' in the domain 'chaos', the value of which can be and sometimes is tweaked by DNS administrators.

ID	Name	Product	Family	Severity
65309	AIX 5.3 TL 5 / 5.3 TL 6 : bos.net.tcp.client (U809482)	Nessus	AIX Local Security Checks	medium
65306	AIX 5.2 TL 9 / 5.2 TL 10 : bos.net.tcp.client (U808275)	Nessus	AIX Local Security Checks	medium
54866	Slackware 10.0 / 10.1 / 10.2 / 9.0 / 9.1 / current : bind DoS (SSA:2006-257-01)	Nessus	Slackware Local Security Checks	medium
29384	SuSE 10 Security Update : bind (ZYPP Patch Number 2041)	Nessus	SuSE Local Security Checks	medium
27922	Ubuntu 5.04 / 5.10 / 6.06 LTS : bind9 vulnerabilities (USN-343-1)	Nessus	Ubuntu Local Security Checks	medium
25297	Mac OS X Multiple Vulnerabilities (Security Update 2007-005)	Nessus	MacOS X Local Security Checks	critical
23953	FreeBSD : bind9 -- Denial of Service in named(8) (ef3306fc-8f9b-11db-ab33-000e0c2e438a)	Nessus	FreeBSD Local Security Checks	medium
23907	Mandrake Linux Security Advisory : bind (MDKSA-2006:163)	Nessus	Mandriva Local Security Checks	medium
22714	Debian DSA-1172-1 : bind9 - programming error	Nessus	Debian Local Security Checks	medium
22356	GLSA-200609-11 : BIND: Denial of Service	Nessus	Gentoo Local Security Checks	medium
22311	ISC BIND 9 Multiple Remote DoS	Nessus	DNS	medium

Detections

Analytics

CVE-2006-4096

high

Tenable Plugins

medium

medium

medium

medium

medium

critical

medium

medium

medium

medium

medium