Off-by-one error in the inet_network function in libbind in ISC BIND 9.4.2 and earlier, as used in libc in FreeBSD 6.2 through 7.0-PRERELEASE, allows context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via crafted input that triggers memory corruption.

The remote NewStart CGSL host, running version MAIN 6.02, has bind packages installed that are affected by multiple vulnerabilities:

  - ISC BIND 9 through 9.5.0a5 uses a weak random number generator during generation of DNS query ids when     answering resolver questions or sending NOTIFY messages to slave name servers, which makes it easier for     remote attackers to guess the next query id and perform DNS cache poisoning. (CVE-2007-2926)

  - Red Hat Enterprise Linux 5 and Fedora install the Bind /etc/rndc.key file with world-readable permissions,     which allows local users to perform unauthorized named commands, such as causing a denial of service by     stopping named. (CVE-2007-6283)

  - Off-by-one error in the inet_network function in libbind in ISC BIND 9.4.2 and earlier, as used in libc in     FreeBSD 6.2 through 7.0-PRERELEASE, allows context-dependent attackers to cause a denial of service     (crash) and possibly execute arbitrary code via crafted input that triggers memory corruption.
    (CVE-2008-0122)

  - The DNS protocol, as implemented in (1) BIND 8 and 9 before 9.5.0-P1, 9.4.2-P1, and 9.3.5-P1; (2)     Microsoft DNS in Windows 2000 SP4, XP SP2 and SP3, and Server 2003 SP1 and SP2; and other implementations     allow remote attackers to spoof DNS traffic via a birthday attack that uses in-bailiwick referrals to     conduct cache poisoning against recursive resolvers, related to insufficient randomness of DNS transaction     IDs and source ports, aka DNS Insufficient Socket Entropy Vulnerability or the Kaminsky bug.
    (CVE-2008-1447)

  - BIND 9.6.0, 9.5.1, 9.5.0, 9.4.3, and earlier does not properly check the return value from the OpenSSL     DSA_verify function, which allows remote attackers to bypass validation of the certificate chain via a     malformed SSL/TLS signature, a similar vulnerability to CVE-2008-5077. (CVE-2009-0025)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2008-0300 advisory.

    - CVE-2008-0122 (small buffer overflow in inet_network)
    - CVE-2007-6283 (#419421)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has bind packages installed that are affected by multiple vulnerabilities:

  - In BIND 9.0.0 -> 9.11.21, 9.12.0 -> 9.16.5, 9.17.0 -> 9.17.3, also affects 9.9.3-S1 -> 9.11.21-S1 of the     BIND 9 Supported Preview Edition, An attacker on the network path for a TSIG-signed request, or operating     the server receiving the TSIG-signed request, could send a truncated response to that request, triggering     an assertion failure, causing the server to exit. Alternately, an off-path attacker would have to     correctly guess when a TSIG-signed request was sent, along with other characteristics of the packet and     message, and spoof a truncated response to trigger an assertion failure, causing the server to exit.
    (CVE-2020-8622)

  - In BIND 9.10.0 -> 9.11.21, 9.12.0 -> 9.16.5, 9.17.0 -> 9.17.3, also affects 9.10.5-S1 -> 9.11.21-S1 of the     BIND 9 Supported Preview Edition, An attacker that can reach a vulnerable system with a specially crafted     query packet can trigger a crash. To be vulnerable, the system must: * be running BIND that was built with
    --enable-native-pkcs11 * be signing one or more zones with an RSA key * be able to receive queries from     a possible attacker (CVE-2020-8623)

  - In BIND 9.9.12 -> 9.9.13, 9.10.7 -> 9.10.8, 9.11.3 -> 9.11.21, 9.12.1 -> 9.16.5, 9.17.0 -> 9.17.3, also     affects 9.9.12-S1 -> 9.9.13-S1, 9.11.3-S1 -> 9.11.21-S1 of the BIND 9 Supported Preview Edition, An     attacker who has been granted privileges to change a specific subset of the zone's content could abuse     these unintended additional privileges to update other contents of the zone. (CVE-2020-8624)

  - BIND before 9.2.6-P1 and 9.3.x before 9.3.2-P1 allows remote attackers to cause a denial of service     (crash) via certain SIG queries, which cause an assertion failure when multiple RRsets are returned.
    (CVE-2006-4095)

  - Unspecified vulnerability in query.c in ISC BIND 9.4.0, and 9.5.0a1 through 9.5.0a3, when recursion is     enabled, allows remote attackers to cause a denial of service (daemon exit) via a sequence of queries     processed by the query_addsoa function. (CVE-2007-2241)

  - The default access control lists (ACL) in ISC BIND 9.4.0, 9.4.1, and 9.5.0a1 through 9.5.0a5 do not set     the allow-recursion and allow-query-cache ACLs, which allows remote attackers to make recursive queries     and query the cache. (CVE-2007-2925)

  - ISC BIND 9 through 9.5.0a5 uses a weak random number generator during generation of DNS query ids when     answering resolver questions or sending NOTIFY messages to slave name servers, which makes it easier for     remote attackers to guess the next query id and perform DNS cache poisoning. (CVE-2007-2926)

  - Red Hat Enterprise Linux 5 and Fedora install the Bind /etc/rndc.key file with world-readable permissions,     which allows local users to perform unauthorized named commands, such as causing a denial of service by     stopping named. (CVE-2007-6283)

  - Off-by-one error in the inet_network function in libbind in ISC BIND 9.4.2 and earlier, as used in libc in     FreeBSD 6.2 through 7.0-PRERELEASE, allows context-dependent attackers to cause a denial of service     (crash) and possibly execute arbitrary code via crafted input that triggers memory corruption.
    (CVE-2008-0122)

  - The DNS protocol, as implemented in (1) BIND 8 and 9 before 9.5.0-P1, 9.4.2-P1, and 9.3.5-P1; (2)     Microsoft DNS in Windows 2000 SP4, XP SP2 and SP3, and Server 2003 SP1 and SP2; and other implementations     allow remote attackers to spoof DNS traffic via a birthday attack that uses in-bailiwick referrals to     conduct cache poisoning against recursive resolvers, related to insufficient randomness of DNS transaction     IDs and source ports, aka DNS Insufficient Socket Entropy Vulnerability or the Kaminsky bug.
    (CVE-2008-1447)

  - BIND 9.6.0, 9.5.1, 9.5.0, 9.4.3, and earlier does not properly check the return value from the OpenSSL     DSA_verify function, which allows remote attackers to bypass validation of the certificate chain via a     malformed SSL/TLS signature, a similar vulnerability to CVE-2008-5077. (CVE-2009-0025)

  - The dns_db_findrdataset function in db.c in named in ISC BIND 9.4 before 9.4.3-P3, 9.5 before 9.5.1-P3,     and 9.6 before 9.6.1-P1, when configured as a master server, allows remote attackers to cause a denial of     service (assertion failure and daemon exit) via an ANY record in the prerequisite section of a crafted     dynamic update message, as exploited in the wild in July 2009. (CVE-2009-0696)

  - BIND 9.7.1 and 9.7.1-P1, when a recursive validating server has a trust anchor that is configured     statically or via DNSSEC Lookaside Validation (DLV), allows remote attackers to cause a denial of service     (infinite loop) via a query for an RRSIG record whose answer is not in the cache, which causes BIND to     repeatedly send RRSIG queries to the authoritative servers. (CVE-2010-0213)

  - ISC BIND 9.8.x before 9.8.0-P1, when Response Policy Zones (RPZ) RRset replacement is enabled, allows     remote attackers to cause a denial of service (assertion failure and daemon exit) via an RRSIG query.
    (CVE-2011-1907)

  - Off-by-one error in named in ISC BIND 9.x before 9.7.3-P1, 9.8.x before 9.8.0-P2, 9.4-ESV before     9.4-ESV-R4-P1, and 9.6-ESV before 9.6-ESV-R4-P1 allows remote DNS servers to cause a denial of service     (assertion failure and daemon exit) via a negative response containing large RRSIG RRsets. (CVE-2011-1910)

  - query.c in ISC BIND 9.0.x through 9.6.x, 9.4-ESV through 9.4-ESV-R5, 9.6-ESV through 9.6-ESV-R5, 9.7.0     through 9.7.4, 9.8.0 through 9.8.1, and 9.9.0a1 through 9.9.0b1 allows remote attackers to cause a denial     of service (assertion failure and named exit) via unknown vectors related to recursive DNS queries, error     logging, and the caching of an invalid record by the resolver. (CVE-2011-4313)

  - ISC BIND 9.x before 9.7.6-P1, 9.8.x before 9.8.3-P1, 9.9.x before 9.9.1-P1, and 9.4-ESV and 9.6-ESV before     9.6-ESV-R7-P1 does not properly handle resource records with a zero-length RDATA section, which allows     remote DNS servers to cause a denial of service (daemon crash or data corruption) or obtain sensitive     information from process memory via a crafted record. (CVE-2012-1667)

  - libdns in ISC BIND 9.7.x and 9.8.x before 9.8.4-P2, 9.8.5 before 9.8.5b2, 9.9.x before 9.9.2-P2, and 9.9.3     before 9.9.3b2 on UNIX platforms allows remote attackers to cause a denial of service (memory consumption)     via a crafted regular expression, as demonstrated by a memory-exhaustion attack against a machine running     a named process. (CVE-2013-2266)

  - resolver.c in ISC BIND 9.8.5 before 9.8.5-P1, 9.9.3 before 9.9.3-P1, and 9.6-ESV-R9 before 9.6-ESV-R9-P1,     when a recursive resolver is configured, allows remote attackers to cause a denial of service (assertion     failure and named daemon exit) via a query for a record in a malformed zone. (CVE-2013-3919)

  - The RFC 5011 implementation in rdata.c in ISC BIND 9.7.x and 9.8.x before 9.8.5-P2, 9.8.6b1, 9.9.x before     9.9.3-P2, and 9.9.4b1, and DNSco BIND 9.9.3-S1 before 9.9.3-S1-P1 and 9.9.4-S1b1, allows remote attackers     to cause a denial of service (assertion failure and named daemon exit) via a query with a malformed RDATA     section that is not properly handled during construction of a log message, as exploited in the wild in     July 2013. (CVE-2013-4854)

  - The query_findclosestnsec3 function in query.c in named in ISC BIND 9.6, 9.7, and 9.8 before 9.8.6-P2 and     9.9 before 9.9.4-P2, and 9.6-ESV before 9.6-ESV-R10-P2, allows remote attackers to cause a denial of     service (INSIST assertion failure and daemon exit) via a crafted DNS query to an authoritative nameserver     that uses the NSEC3 signing feature. (CVE-2014-0591)

  - A race condition which may occur when discarding malformed packets can result in BIND exiting due to a     REQUIRE assertion failure in dispatch.c. Versions affected: BIND 9.11.0 -> 9.11.7, 9.12.0 -> 9.12.4-P1,     9.14.0 -> 9.14.2. Also all releases of the BIND 9.13 development branch and version 9.15.0 of the BIND     9.15 development branch and BIND Supported Preview Edition versions 9.11.3-S1 -> 9.11.7-S1.
    (CVE-2019-6471)

  - A malicious actor who intentionally exploits this lack of effective limitation on the number of fetches     performed when processing referrals can, through the use of specially crafted referrals, cause a recursing     server to issue a very large number of fetches in an attempt to process the referral. This has at least     two potential effects: The performance of the recursing server can potentially be degraded by the     additional work required to perform these fetches, and The attacker can exploit this behavior to use the     recursing server as a reflector in a reflection attack with a high amplification factor. (CVE-2020-8616)

  - Using a specially-crafted message, an attacker may potentially cause a BIND server to reach an     inconsistent state if the attacker knows (or successfully guesses) the name of a TSIG key used by the     server. Since BIND, by default, configures a local session key even on servers whose configuration does     not otherwise make use of it, almost all current BIND servers are vulnerable. In releases of BIND dating     from March 2018 and after, an assertion check in tsig.c detects this inconsistent state and deliberately     exits. Prior to the introduction of the check the server would continue operating in an inconsistent     state, with potentially harmful results. (CVE-2020-8617)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote OracleVM system is missing necessary patches to address critical security updates : please see Oracle VM Security Advisory OVMSA-2020-0021 for details.

SunOS 5.10: libc.so.1.9 patch.
Date this patch was last updated by Sun : Jun/06/08

The remote OracleVM system is missing necessary patches to address critical security updates :

  - Fix CVE-2017-3136 (ISC change 4575)

  - Fix CVE-2017-3137 (ISC change 4578)

  - Fix and test caching CNAME before DNAME (ISC change     4558)

  - Fix CVE-2016-9147 (ISC change 4510)

  - Fix regression introduced by CVE-2016-8864 (ISC change     4530)

  - Restore SELinux contexts before named restart

  - Use /lib or /lib64 only if directory in chroot already     exists

  - Tighten NSS library pattern, escape chroot mount path

  - Fix (CVE-2016-8864)

  - Do not change lib permissions in chroot (#1321239)

  - Support WKS records in chroot (#1297562)

  - Do not include patch backup in docs (fixes #1325081     patch)

  - Backported relevant parts of [RT #39567] (#1259923)

  - Increase ISC_SOCKET_MAXEVENTS to 2048 (#1326283)

  - Fix multiple realms in nsupdate script like upstream     (#1313286)

  - Fix multiple realm in nsupdate script (#1313286)

  - Use resolver-query-timeout high enough to recover all     forwarders (#1325081)

  - Fix (CVE-2016-2848)

  - Fix infinite loop in start_lookup (#1306504)

  - Fix (CVE-2016-2776)

It was discovered that the bind packages created the 'rndc.key' file with insecure file permissions. This allowed any local user to read the content of this file. A local user could use this flaw to control some aspects of the named daemon by using the rndc utility, for example, stopping the named daemon. This problem did not affect systems with the bind-chroot package installed. (CVE-2007-6283)

A buffer overflow flaw was discovered in the 'inet_network()' function, as implemented by libbind. An attacker could use this flaw to crash an application calling this function, with an argument provided from an untrusted source. (CVE-2008-0122)

As well, these updated packages fix the following bugs :

  - when using an LDAP backend, missing function     declarations caused segmentation faults, due to stripped     pointers on machines where pointers are longer than     integers.

  - starting named may have resulted in named crashing, due     to a race condition during D-BUS connection     initialization. This has been resolved in these updated     packages.

  - the named init script returned incorrect error codes,     causing the 'status' command to return an incorrect     status. In these updated packages, the named init script     is Linux Standard Base (LSB) compliant.

  - in these updated packages, the 'rndc [command] [zone]'     command, where [command] is an rndc command, and [zone]     is the specified zone, will find the [zone] if the zone     is unique to all views.

  - the default named log rotation script did not work     correctly when using the bind-chroot package. In these     updated packages, installing bind-chroot creates the     symbolic link '/var/log/named.log', which points to     '/var/named/chroot/var/log/named.log', which resolves     this issue.

  - a previous bind update incorrectly changed the     permissions on the '/etc/openldap/schema/dnszone.schema'     file to mode 640, instead of mode 644, which resulted in     OpenLDAP not being able to start. In these updated     packages, the permissions are correctly set to mode 644.

  - the 'checkconfig' parameter was missing in the named     usage report. For example, running the 'service named'     command did not return 'checkconfig' in the list of     available options.

  - due to a bug in the named init script not handling the     rndc return value correctly, the 'service named stop'     and 'service named restart' commands failed on certain     systems.

  - the bind-chroot spec file printed errors when running     the '%pre' and '%post' sections. Errors such as the     following occurred :

Locating //etc/named.conf failed: [FAILED]

This has been resolved in these updated packages.

  - installing the bind-chroot package creates a     '/dev/random' file in the chroot environment; however,     the '/dev/random' file had an incorrect SELinux label.
    Starting named resulted in an 'avc: denied { getattr }     for pid=[pid] comm='named' path='/dev/random'' error     being logged. The '/dev/random' file has the correct     SELinux label in these updated packages.

  - in certain situations, running the 'bind +trace' command     resulted in random segmentation faults.

As well, these updated packages add the following enhancements :

  - support has been added for GSS-TSIG (RFC 3645).

  - the 'named.root' file has been updated to reflect the     new address for L.ROOT-SERVERS.NET.

  - updates BIND to the latest 9.3 maintenance release.

Certain input data could trigger a buffer overflow in the 'inet_network' function of libbind. Applications that use this function could therefore potentially be crashed or exploited to execute arbitrary code. Bind itself is not affected though.
(CVE-2008-0122)

9.5.0-P1 release which contains fix for CVE-2008-1447. This update also fixes parsing of inner ACLs.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

SunOS 5.8_x86: libsocket patch.
Date this patch was last updated by Sun : Jun/06/08

SunOS 5.8: libsocket patch.
Date this patch was last updated by Sun : Jun/06/08

Updated bind packages that fix two security issues, several bugs, and add enhancements are now available for Red Hat Enterprise Linux 5.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating correctly.

It was discovered that the bind packages created the 'rndc.key' file with insecure file permissions. This allowed any local user to read the content of this file. A local user could use this flaw to control some aspects of the named daemon by using the rndc utility, for example, stopping the named daemon. This problem did not affect systems with the bind-chroot package installed. (CVE-2007-6283)

A buffer overflow flaw was discovered in the 'inet_network()' function, as implemented by libbind. An attacker could use this flaw to crash an application calling this function, with an argument provided from an untrusted source. (CVE-2008-0122)

As well, these updated packages fix the following bugs :

* when using an LDAP backend, missing function declarations caused segmentation faults, due to stripped pointers on machines where pointers are longer than integers.

* starting named may have resulted in named crashing, due to a race condition during D-BUS connection initialization. This has been resolved in these updated packages.

* the named init script returned incorrect error codes, causing the 'status' command to return an incorrect status. In these updated packages, the named init script is Linux Standard Base (LSB) compliant.

* in these updated packages, the 'rndc [command] [zone]' command, where [command] is an rndc command, and [zone] is the specified zone, will find the [zone] if the zone is unique to all views.

* the default named log rotation script did not work correctly when using the bind-chroot package. In these updated packages, installing bind-chroot creates the symbolic link '/var/log/named.log', which points to '/var/named/chroot/var/log/named.log', which resolves this issue.

* a previous bind update incorrectly changed the permissions on the '/etc/openldap/schema/dnszone.schema' file to mode 640, instead of mode 644, which resulted in OpenLDAP not being able to start. In these updated packages, the permissions are correctly set to mode 644.

* the 'checkconfig' parameter was missing in the named usage report.
For example, running the 'service named' command did not return 'checkconfig' in the list of available options.

* due to a bug in the named init script not handling the rndc return value correctly, the 'service named stop' and 'service named restart' commands failed on certain systems.

* the bind-chroot spec file printed errors when running the '%pre' and '%post' sections. Errors such as the following occurred :

Locating //etc/named.conf failed: [FAILED]

This has been resolved in these updated packages.

* installing the bind-chroot package creates a '/dev/random' file in the chroot environment; however, the '/dev/random' file had an incorrect SELinux label. Starting named resulted in an 'avc: denied { getattr } for pid=[pid] comm='named' path='/dev/random'' error being logged. The '/dev/random' file has the correct SELinux label in these updated packages.

* in certain situations, running the 'bind +trace' command resulted in random segmentation faults.

As well, these updated packages add the following enhancements :

* support has been added for GSS-TSIG (RFC 3645).

* the 'named.root' file has been updated to reflect the new address for L.ROOT-SERVERS.NET.

* updates BIND to the latest 9.3 maintenance release.

All users of bind are advised to upgrade to these updated packages, which resolve these issues and add these enhancements.

Certain input data could trigger a buffer overflow in the 'inet_network' function of libbind. Applications that use this function could therefore potentially be crashed or exploited to execute arbitrary code. Bind itself is not affected though (CVE-2008-0122).

- CVE-2008-0122, libbind.so off-by-one buffer overflow,     very low severity

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

SunOS 5.8_x86: libresolv.so.2, in.named an.
Date this patch was last updated by Sun : Mar/09/09

SunOS 5.8: libresolv.so.2, in.named and BI.
Date this patch was last updated by Sun : Mar/09/09

SunOS 5.8: /usr/4lib/libc.so.x.9 and libdb.
Date this patch was last updated by Sun : Jun/04/08

ID	Name	Product	Family	Severity
206846	NewStart CGSL MAIN 6.02 : bind Multiple Vulnerabilities (NS-SA-2024-0060)	Nessus	NewStart CGSL Local Security Checks	medium
180600	Oracle Linux 5 : bind (ELSA-2008-0300)	Nessus	Oracle Linux Local Security Checks	high
147379	NewStart CGSL CORE 5.04 / MAIN 5.04 : bind Multiple Vulnerabilities (NS-SA-2021-0017)	Nessus	NewStart CGSL Local Security Checks	medium
137170	OracleVM 3.3 / 3.4 : bind (OVMSA-2020-0021)	Nessus	OracleVM Local Security Checks	medium
107478	Solaris 10 (sparc) : 136892-01	Nessus	Solaris Local Security Checks	critical
99569	OracleVM 3.3 / 3.4 : bind (OVMSA-2017-0066)	Nessus	OracleVM Local Security Checks	high
60402	Scientific Linux Security Update : bind on SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	critical
41191	SuSE9 Security Update : bind (YOU Patch Number 12060)	Nessus	SuSE Local Security Checks	critical
33470	Fedora 8 : bind-9.5.0-28.P1.fc8 (2008-6281)	Nessus	Fedora Local Security Checks	critical
33212	Solaris 8 (x86) : 111328-05	Nessus	Solaris Local Security Checks	critical
33211	Solaris 8 (sparc) : 111327-06	Nessus	Solaris Local Security Checks	critical
32424	RHEL 5 : bind (RHSA-2008:0300)	Nessus	Red Hat Local Security Checks	critical
31450	SuSE 10 Security Update : bind (ZYPP Patch Number 4932)	Nessus	SuSE Local Security Checks	critical
31449	openSUSE 10 Security Update : bind (bind-4931)	Nessus	SuSE Local Security Checks	critical
30081	Fedora 7 : bind-9.4.2-3.fc7 (2008-0904)	Nessus	Fedora Local Security Checks	critical
30080	Fedora 8 : bind-9.5.0-23.b1.fc8 (2008-0903)	Nessus	Fedora Local Security Checks	critical
13429	Solaris 8 (x86) : 109327-24	Nessus	Solaris Local Security Checks	critical
13321	Solaris 8 (sparc) : 109326-24	Nessus	Solaris Local Security Checks	critical
13315	Solaris 8 (sparc) : 109152-03	Nessus	Solaris Local Security Checks	critical

Detections

Analytics

CVE-2008-0122

high

Tenable Plugins

medium

high

medium

medium

critical

high

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical