Bind 9.2.1 vulnerability

[Fabio Longo]

Hi All,

I'm going to implement a DNS infrastructure based on DNS BIND 9.2.1 on HP-UX 11.0 o.s.

Customer states versione 9.2.1 has the following problem:
a) OpenSSL buffer overflow
b) libbind buffer overflow

that potentially permits to run programs on the DNS machine.

My questions are:

1. Is it true ?
2. Is there any patch available.

Thanks in advance

[Stefan Farrelly]

Check this out;

http://forums.itrc.hp.com/cm/QuestionAnswer/1,,0x9f0931ec5e34d711abdc0090277a778c,00.html

[U.SivaKumar_2]

Hi,

Hope this Reference from my collection will be useful for you too.

Name: "OpenSSL buffer overflow"
Versions affected: BIND 9.1.
BIND 9.2 if built with OpenSSL (configure --with-openssl).
Severity: Medium
Exploitable: Remotely
Type: Potential execution of arbitrary code via buffer overflow.

Description:
BIND 9.1.x ship with a copy of the vulnerable sections of OpenSSL crypto library (obj_dat.c and asn1_lib.c).
Vendors shipping product based on BIND 9.1 should contact bind9-bugs@isc.org.


BIND 9.2.x is vulnerable if linked against a vulnerable library. By default BIND 9.2 does not link against OpenSSL.

Workarounds:
Disable DNSSEC validation of responses by commenting out any trusted keys in named.conf.

Fix:
Upgrade BIND 9.1.x to BIND 9.2.1 and/or link with fixed OpenSSL library
e.g. configure --with-openssl=/path/to/fixed/openssl
Link BIND 9.2.x with a fixed OpenSSL library.

Active Exploits:
None known



Name: "libbind buffer overflow"
Versions affected: All versions of the stub resolver library from BIND 4 prior to 4.9.9.
All versions of the stub resolver library from BIND 8 prior to 8.2.6.
The stub resolver library from BIND version 8.3.0, 8.3.1, 8.3.2.
The BIND 8 compatibility stub resolver library (NOT the lwres library) from BIND versions 9.2.0, 9.2.1.
(Disabled by default in BIND 9, enabled if you added --enable-libbind to the configure statement)
Severity: SERIOUS
Exploitable: Remotely
Type: Potential for execution of arbitrary code via buffer overflow.

Description:
It is possible to construct a response to a DNS query issued by an application linked to vulnerable versions of the stub resolver library included in the BIND distributions mentioned above that may potentially result in a buffer overflow of a few bytes. This bug does NOT affect the name server (named) itself, but rather applications linked to the resolver library.

NOTE: Upgrading the name server DOES NOT remove this vulnerability. To remove this vulnerability, ALL applications linked to a vulnerable version of the stub resolver library must be re-linked with a non-vulnerable version. Note that if static libraries were used, the the static library must be updated and all applications must be relinked. If shared libraries were used, then upgrading the shared library will suffice.

Workarounds:
None.

Fix:
Update libbind to a version that is not affected and relink all applications that use it.

Active Exploits:
None known

regards,

U.SivaKumar

[Steven E. Protter]

DNS/BIND is an inherently difficult process to keep secure.

The best way to do so is to have a user other than root owning and starting the named/Bind process(s)

The easiest way to do that is to install this tool, and run it.

Bastille Security Hardening free tool.
https://payment.ecommerce.hp.com/cgi-bin/swdepot_parser.cgi/cgi/try.pl?productNumber=B6849AA&date=

It has a step that lets you have non-root user doing BIND/DNS. This means that if there is a hack on DNS, it won't get root priviledges, so the damage will be minimal if noticeable other than on lookup performance.

Here is a way to get notified of patches that relate to system security, BIND included.

Security Patch Check, also free.

https://payment.ecommerce.hp.com/cgi-bin/swdepot_parser.cgi/cgi/try.pl?productNumber=B6834AA&date=

Good luck, these two tools will make you sleep better, if this kind of stuff keeps you up at night.

SEP