VU#418861

Executive Summary

Summary
Title	BIND DNS Nameserver, DNSSEC validation Vulnerability

Informations
Name	VU#418861	First vendor Publication	2009-12-01
Vendor	VU-CERT	Last vendor Modification	2010-01-19
Severity (Vendor)	N/A	Revision	M

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:H/Au:N/C:N/I:P/A:N)
Cvss Base Score	2.6	Attack Range	Network
Cvss Impact Score	2.9	Attack Complexity	High
Cvss Expoit Score	4.9	Authentification	None Required
Calculate full CVSS 2.0 Vectors scores

Detail

Vulnerability Note VU#418861

BIND DNS Nameserver, DNSSEC validation Vulnerability

Overview

A vulnerability exists in the way BIND 9 handles recursive client queries that may cause additional records to be added to its cache.

I. Description

BIND 9 contains a vulnerability in the way recursive client queries are handled. According to ISC:

A nameserver with DNSSEC validation enabled may incorrectly add unauthenticated records to its cache that are received during the resolution of a recursive client query with checking disabled (CD), or when the nameserver internally triggers a query for missing records for recursive name resolution. Cached records can be returned in response to subsequent client queries with or without requesting DNSSEC records (DO). In addition, some of them can be returned to queries with or without checking disabled (CD).

This issue affects BIND versions 9.0.x, 9.1.x, 9.2.x, 9.3.x, 9.4.0 -> 9.4.3-P3, 9.5.0, 9.5.1, 9.5.2, 9.6.0, 9.6.1-P1.

II. Impact

An attacker may be able to manipulate cache data and perform DNS Cache Poisoning.

III. Solution

Upgrade

BIND should be upgraded to version 9.4.3-P5, 9.5.2-P2 or 9.6.1-P3.
Disable DNSSEC Validation

According to ISC:
Disabling DNSSEC validation will also prevent incorrect caching of additional records due to this defect. However, this removes DNSSEC validation protection and the ability of the nameserver to deliver authenticated data in query responses.

Systems Affected

Vendor	Status	Date Notified	Date Updated
Alcatel-Lucent	Unknown	2009-12-02	2009-12-02
Apple Inc.	Unknown	2009-12-02	2009-12-02
BlueCat Networks, Inc.	Unknown	2009-12-02	2009-12-02
Check Point Software Technologies	Unknown	2009-12-02	2009-12-02
Conectiva Inc.	Unknown	2009-12-02	2009-12-02
Cray Inc.	Unknown	2009-12-02	2009-12-02
Debian GNU/Linux	Unknown	2009-12-02	2009-12-02
DragonFly BSD Project	Unknown	2009-12-02	2009-12-02
EMC Corporation	Unknown	2009-12-02	2009-12-02
Engarde Secure Linux	Unknown	2009-12-02	2009-12-02
Ericsson	Unknown	2009-12-02	2009-12-02
F5 Networks, Inc.	Unknown	2009-12-02	2009-12-02
Fedora Project	Unknown	2009-12-02	2009-12-02
FreeBSD Project	Unknown	2009-12-02	2009-12-02
Fujitsu	Unknown	2009-12-02	2009-12-02
Gentoo Linux	Unknown	2009-12-02	2009-12-02
Gnu ADNS	Unknown	2009-12-02	2009-12-02
GNU glibc	Unknown	2009-12-02	2009-12-02
Hewlett-Packard Company	Unknown	2009-12-02	2009-12-02
Hitachi	Unknown	2009-12-02	2009-12-02
IBM Corporation	Unknown	2009-12-02	2009-12-02
IBM Corporation (zseries)	Unknown	2009-12-02	2009-12-02
IBM eServer	Unknown	2009-12-02	2009-12-02
Infoblox	Unknown	2009-12-02	2009-12-02
Internet Systems Consortium	Vulnerable	2009-12-02	2009-12-02
Juniper Networks, Inc.	Unknown	2009-12-02	2009-12-02
Mandriva S. A.	Unknown	2009-12-02	2009-12-02
McAfee	Unknown	2009-12-02	2009-12-02
Men & Mice	Unknown	2009-12-02	2009-12-02
Metasolv Software, Inc.	Unknown	2009-12-02	2009-12-02
Microsoft Corporation	Unknown	2009-12-02	2009-12-02
MontaVista Software, Inc.	Unknown	2009-12-02	2009-12-02
NEC Corporation	Unknown	2009-12-02	2009-12-02
NetBSD	Unknown	2009-12-02	2009-12-02
Nixu	Unknown	2009-12-02	2009-12-02
Nokia	Unknown	2009-12-02	2009-12-02
Nominum	Unknown	2009-12-02	2009-12-02
Nortel Networks, Inc.	Unknown	2009-12-02	2009-12-02
Novell, Inc.	Unknown	2009-12-02	2009-12-02
OpenBSD	Unknown	2009-12-02	2009-12-02
Openwall GNU/*/Linux	Unknown	2009-12-02	2009-12-02
QNX Software Systems Inc.	Unknown	2009-12-02	2009-12-02
Red Hat, Inc.	Unknown	2009-12-02	2009-12-02
SafeNet	Unknown	2009-12-02	2009-12-02
Shadowsupport	Unknown	2009-12-02	2009-12-02
Silicon Graphics, Inc.	Unknown	2009-12-02	2009-12-02
Slackware Linux Inc.	Unknown	2009-12-02	2009-12-02
Sony Corporation	Unknown	2009-12-02	2009-12-02
Sun Microsystems, Inc.	Unknown	2009-12-02	2009-12-02
SUSE Linux	Unknown	2009-12-02	2009-12-02
The SCO Group	Unknown	2009-12-02	2009-12-02
Turbolinux	Unknown	2009-12-02	2009-12-02
Ubuntu	Unknown	2009-12-02	2009-12-02
Unisys	Unknown	2009-12-02	2009-12-02
Wind River Systems, Inc.	Unknown	2009-12-02	2009-12-02

References

https://www.isc.org/node/504

Credit

ISC credits Michael Sinatra, UC Berkeley with finding this issue.

This document was written by Chris Taschner.

Other Information

Date Public:	2009-11-19
Date First Published:	2009-12-01
Date Last Updated:	2010-01-19
CERT Advisory:
CVE-ID(s):	CVE-2009-4022
NVD-ID(s):	CVE-2009-4022
US-CERT Technical Alerts:
Metric:	0.00
Document Revision:	14

Original Source

Url : http://www.kb.cert.org/vuls/id/418861

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:7459

Oval ID:	oval:org.mitre.oval:def:7459
Title:	Security Vulnerability in BIND DNS Software Shipped With Solaris May Allow DNS Cache Poisoning
Description:	Unspecified vulnerability in ISC BIND 9.0.x through 9.3.x, 9.4 before 9.4.3-P4, 9.5 before 9.5.2-P1, 9.6 before 9.6.1-P2, and 9.7 beta before 9.7.0b3, with DNSSEC validation enabled and checking disabled (CD), allows remote attackers to conduct DNS cache poisoning attacks by receiving a recursive client query and sending a response that contains an Additional section with crafted data, which is not properly handled when the response is processed "at the same time as requesting DNSSEC records (DO)," aka Bug 20438.
Family:	unix	Class:	vulnerability
Reference(s):	CVE-2009-4022	Version:	3
Platform(s):	Sun Solaris 9 Sun Solaris 10	Product(s):
Definition Synopsis:
Software Section Solaris 9 (SPARC) meets Sun Alert 273169 Solaris 9 (SPARC) is installed AND NOT Patch 112837-21 or later installed OR Solaris 10 (SPARC) meets Sun Alert 273169 Solaris 10 (SPARC) is installed AND NOT Patch 119783-14 or later installed OR Solaris 9 (x86) meets Sun Alert 273169 Solaris 9 (x86) is installed AND NOT Patch 114265-20 or later installed OR Solaris 10 (x86) meets Sun Alert 273169 Solaris 10 (x86) is installed AND NOT Patch 119784-14 or later installed AND in.named running

Definition Id: oval:org.mitre.oval:def:7261

Oval ID:	oval:org.mitre.oval:def:7261
Title:	HP-UX Running BIND, Remote Denial of Service (DoS), Unauthorized Disclosure of Information
Description:	Unspecified vulnerability in ISC BIND 9.0.x through 9.3.x, 9.4 before 9.4.3-P4, 9.5 before 9.5.2-P1, 9.6 before 9.6.1-P2, and 9.7 beta before 9.7.0b3, with DNSSEC validation enabled and checking disabled (CD), allows remote attackers to conduct DNS cache poisoning attacks by receiving a recursive client query and sending a response that contains an Additional section with crafted data, which is not properly handled when the response is processed "at the same time as requesting DNSSEC records (DO)," aka Bug 20438.
Family:	unix	Class:	vulnerability
Reference(s):	CVE-2009-4022	Version:	3
Platform(s):	HP-UX 11	Product(s):
Definition Synopsis:
Criteria meets HP Security Bulletin HPSBUX02546 HP Release B.11.23 AND filesets tests BindUpgrade.BIND-UPGRADE version is less than C.9.3.2.7.0 AND BindUpgrade.BIND2-UPGRADE version is less than C.9.3.2.7.0 OR Criteria meets HP Security Bulletin HPSBUX02546 HP Release B.11.23 AND filesets tests InternetSrvcs.INETSVCS-INETD is installed AND InternetSrvcs.INETSVCS-RUN is installed AND InternetSrvcs.INETSVCS2-RUN is installed AND NOT Patch PHNE_40339 is installed OR Criteria meets HP Security Bulletin HPSBUX02546 HP Release B.11.11 AND BindUpgrade.BIND-UPGRADE version is less than C.9.3.2.7.0 OR Criteria meets HP Security Bulletin HPSBUX02546 HP Release B.11.11 AND BINDv920.INETSVCS-BIND version is less than B.11.11.01.015

Definition Id: oval:org.mitre.oval:def:11745

Oval ID:	oval:org.mitre.oval:def:11745
Title:	Vulnerability with DNSSEC validation enabled in BIND.
Description:	Unspecified vulnerability in ISC BIND 9.0.x through 9.3.x, 9.4 before 9.4.3-P4, 9.5 before 9.5.2-P1, 9.6 before 9.6.1-P2, and 9.7 beta before 9.7.0b3, with DNSSEC validation enabled and checking disabled (CD), allows remote attackers to conduct DNS cache poisoning attacks by receiving a recursive client query and sending a response that contains an Additional section with crafted data, which is not properly handled when the response is processed "at the same time as requesting DNSSEC records (DO)," aka Bug 20438.
Family:	unix	Class:	vulnerability
Reference(s):	CVE-2009-4022	Version:	3
Platform(s):	IBM AIX 6.1	Product(s):
Definition Synopsis:
IBM AIX 6100-02 meets CVE-2009-4022 IBM AIX 6100-02 is installed AND NOT All filesets for APAR IZ71774 are installed AND Fileset Check. Fileset bos.net.tcp.client check. Fileset bos.net.tcp.client is greater than or equal 6.1.2.0 AND Fileset bos.net.tcp.client is less than or equal 6.1.2.6 OR Fileset bos.net.tcp.server check. Fileset bos.net.tcp.server is greater than or equal 6.1.2.0 AND Fileset bos.net.tcp.server is less than or equal 6.1.2.4 OR IBM AIX 6100-03 meets CVE-2009-4022 IBM AIX 6100-03 is installed AND NOT All filesets for APAR IZ71667 are installed AND Fileset Check. Fileset bos.net.tcp.server check. Fileset bos.net.tcp.server is greater than or equal 6.1.3.0 AND Fileset bos.net.tcp.server is less than or equal 6.1.3.2 OR Fileset bos.net.tcp.client check. Fileset bos.net.tcp.client is greater than or equal 6.1.3.0 AND Fileset bos.net.tcp.client is less than or equal 6.1.3.3 OR IBM AIX 6100-04 meets CVE-2009-4022 IBM AIX 6100-04 is installed AND NOT All filesets for APAR IZ68597 are installed AND Fileset Check Fileset bos.net.tcp.client check. Fileset bos.net.tcp.client is greater than or equal 6.1.4.0 AND Fileset bos.net.tcp.client is less than or equal 6.1.4.2 OR Fileset bos.net.tcp.server check. Fileset bos.net.tcp.server is greater than or equal 6.1.4.0 AND Fileset bos.net.tcp.server is less than or equal 6.1.4.1

Definition Id: oval:org.mitre.oval:def:10821

Oval ID:	oval:org.mitre.oval:def:10821
Title:	Unspecified vulnerability in ISC BIND 9.0.x through 9.3.x, 9.4 before 9.4.3-P4, 9.5 before 9.5.2-P1, 9.6 before 9.6.1-P2, and 9.7 beta before 9.7.0b3, with DNSSEC validation enabled and checking disabled (CD), allows remote attackers to conduct DNS cache poisoning attacks by receiving a recursive client query and sending a response that contains an Additional section with crafted data, which is not properly handled when the response is processed "at the same time as requesting DNSSEC records (DO)," aka Bug 20438.
Description:	Unspecified vulnerability in ISC BIND 9.0.x through 9.3.x, 9.4 before 9.4.3-P4, 9.5 before 9.5.2-P1, 9.6 before 9.6.1-P2, and 9.7 beta before 9.7.0b3, with DNSSEC validation enabled and checking disabled (CD), allows remote attackers to conduct DNS cache poisoning attacks by receiving a recursive client query and sending a response that contains an Additional section with crafted data, which is not properly handled when the response is processed "at the same time as requesting DNSSEC records (DO)," aka Bug 20438.
Family:	unix	Class:	vulnerability
Reference(s):	CVE-2009-4022	Version:	5
Platform(s):	Red Hat Enterprise Linux 5 CentOS Linux 5 Oracle Linux 5	Product(s):
Definition Synopsis:
RHEL5, CentOS5 or Oracle Linux 5 The operating system installed on the system is Red Hat Enterprise Linux 5 AND CentOS Linux 5.x AND Oracle Linux 5.x AND Configuration section bind-utils is earlier than 30:9.3.6-4.P1.el5_4.1 AND bind-libbind-devel is earlier than 30:9.3.6-4.P1.el5_4.1 AND bind-devel is earlier than 30:9.3.6-4.P1.el5_4.1 AND bind-chroot is earlier than 30:9.3.6-4.P1.el5_4.1 AND caching-nameserver is earlier than 30:9.3.6-4.P1.el5_4.1 AND bind-sdb is earlier than 30:9.3.6-4.P1.el5_4.1 AND bind is earlier than 30:9.3.6-4.P1.el5_4.1 AND bind-libs is earlier than 30:9.3.6-4.P1.el5_4.1

CPE : Common Platform Enumeration

Type	Description	Count
Application	Isc Bind cpe:/a:isc:bind:9.6.1 cpe:/a:isc:bind:9.6.1:p1 cpe:/a:isc:bind:9.6.0b1 cpe:/a:isc:bind:9.6.0a1 cpe:/a:isc:bind:9.6.0 cpe:/a:isc:bind:9.6.0:p1 cpe:/a:isc:bind:9.6.0:rc1 cpe:/a:isc:bind:9.6.0:rc2 cpe:/a:isc:bind:9.5.1b3 cpe:/a:isc:bind:9.5.1b2 cpe:/a:isc:bind:9.5.1b1 cpe:/a:isc:bind:9.5.1 cpe:/a:isc:bind:9.5.1:rc1 cpe:/a:isc:bind:9.5.1:rc2 cpe:/a:isc:bind:9.5.0b3 cpe:/a:isc:bind:9.5.0b2 cpe:/a:isc:bind:9.5.0b1 cpe:/a:isc:bind:9.5.0a7 cpe:/a:isc:bind:9.5.0a6 cpe:/a:isc:bind:9.5.0a5 cpe:/a:isc:bind:9.5.0a4 cpe:/a:isc:bind:9.5.0a3 cpe:/a:isc:bind:9.5.0a2 cpe:/a:isc:bind:9.5.0a1 cpe:/a:isc:bind:9.5.0-p2-w2 cpe:/a:isc:bind:9.5.0-p2-w1 cpe:/a:isc:bind:9.5.0-p2 cpe:/a:isc:bind:9.5.0-p1 cpe:/a:isc:bind:9.5.0 cpe:/a:isc:bind:9.5.0:rc1 cpe:/a:isc:bind:9.5 cpe:/a:isc:bind:9.4.3b3 cpe:/a:isc:bind:9.4.3b2 cpe:/a:isc:bind:9.4.3b1 cpe:/a:isc:bind:9.4.3:p2 cpe:/a:isc:bind:9.4.3 cpe:/a:isc:bind:9.4.3:rc1 cpe:/a:isc:bind:9.4.2 cpe:/a:isc:bind:9.4.1 cpe:/a:isc:bind:9.4.0b4 cpe:/a:isc:bind:9.4.0b3 cpe:/a:isc:bind:9.4.0b2 cpe:/a:isc:bind:9.4.0b1 cpe:/a:isc:bind:9.4.0a6 cpe:/a:isc:bind:9.4.0a5 cpe:/a:isc:bind:9.4.0a4 cpe:/a:isc:bind:9.4.0a3 cpe:/a:isc:bind:9.4.0a2 cpe:/a:isc:bind:9.4.0a1 cpe:/a:isc:bind:9.4.0 cpe:/a:isc:bind:9.4.0:rc1 cpe:/a:isc:bind:9.3.6p1 cpe:/a:isc:bind:9.3.6b1 cpe:/a:isc:bind:9.3.6:rc1 cpe:/a:isc:bind:9.3.6 cpe:/a:isc:bind:9.3.5b1 cpe:/a:isc:bind:9.3.5-p2-w2 cpe:/a:isc:bind:9.3.5-p2-w1 cpe:/a:isc:bind:9.3.5-p2 cpe:/a:isc:bind:9.3.5 cpe:/a:isc:bind:9.3.5:rc1 cpe:/a:isc:bind:9.3.5:rc2 cpe:/a:isc:bind:9.3.4p1 cpe:/a:isc:bind:9.3.4 cpe:/a:isc:bind:9.3.3b1 cpe:/a:isc:bind:9.3.3:rc3 cpe:/a:isc:bind:9.3.3:rc2 cpe:/a:isc:bind:9.3.3 cpe:/a:isc:bind:9.3.3:rc1 cpe:/a:isc:bind:9.3.2p2 cpe:/a:isc:bind:9.3.2p1 cpe:/a:isc:bind:9.3.2b2 cpe:/a:isc:bind:9.3.2b1 cpe:/a:isc:bind:9.3.2:rc1 cpe:/a:isc:bind:9.3.2 cpe:/a:isc:bind:9.3.1:beta2 cpe:/a:isc:bind:9.3.1:rc1 cpe:/a:isc:bind:9.3.1 cpe:/a:isc:bind:9.3.0:rc1 cpe:/a:isc:bind:9.3.0 cpe:/a:isc:bind:9.3.0:rc2 cpe:/a:isc:bind:9.3.0:beta4 cpe:/a:isc:bind:9.3.0:rc3 cpe:/a:isc:bind:9.3.0:beta3 cpe:/a:isc:bind:9.3.0:beta2 cpe:/a:isc:bind:9.3.0:rc4 cpe:/a:isc:bind:9.3 cpe:/a:isc:bind:9.2.9b1 cpe:/a:isc:bind:9.2.9:rc1 cpe:/a:isc:bind:9.2.9 cpe:/a:isc:bind:9.2.8p1 cpe:/a:isc:bind:9.2.8 cpe:/a:isc:bind:9.2.7b1 cpe:/a:isc:bind:9.2.7 cpe:/a:isc:bind:9.2.7:rc1 cpe:/a:isc:bind:9.2.7:rc3 cpe:/a:isc:bind:9.2.7:rc2 cpe:/a:isc:bind:9.2.6p2 cpe:/a:isc:bind:9.2.6p1 cpe:/a:isc:bind:9.2.6b2 cpe:/a:isc:bind:9.2.6b1 cpe:/a:isc:bind:9.2.6:rc1 cpe:/a:isc:bind:9.2.6 cpe:/a:isc:bind:9.2.5:beta2 cpe:/a:isc:bind:9.2.5:rc1 cpe:/a:isc:bind:9.2.5 cpe:/a:isc:bind:9.2.4:rc4 cpe:/a:isc:bind:9.2.4 cpe:/a:isc:bind:9.2.4:rc5 cpe:/a:isc:bind:9.2.4:rc2 cpe:/a:isc:bind:9.2.4:rc3 cpe:/a:isc:bind:9.2.4:rc8 cpe:/a:isc:bind:9.2.4:rc6 cpe:/a:isc:bind:9.2.4:rc7 cpe:/a:isc:bind:9.2.3:rc4 cpe:/a:isc:bind:9.2.3:rc2 cpe:/a:isc:bind:9.2.3:rc1 cpe:/a:isc:bind:9.2.3 cpe:/a:isc:bind:9.2.3:rc3 cpe:/a:isc:bind:9.2.2 cpe:/a:isc:bind:9.2.2:p3 cpe:/a:isc:bind:9.2.2:rc1 cpe:/a:isc:bind:9.2.2:p2 cpe:/a:isc:bind:9.2.1:rc2 cpe:/a:isc:bind:9.2.1:rc1 cpe:/a:isc:bind:9.2.1 cpe:/a:isc:bind:9.2.0b2 cpe:/a:isc:bind:9.2.0b1 cpe:/a:isc:bind:9.2.0a3 cpe:/a:isc:bind:9.2.0a2 cpe:/a:isc:bind:9.2.0a1 cpe:/a:isc:bind:9.2.0:rc8 cpe:/a:isc:bind:9.2.0:rc6 cpe:/a:isc:bind:9.2.0:rc2 cpe:/a:isc:bind:9.2.0 cpe:/a:isc:bind:9.2.0:rc7 cpe:/a:isc:bind:9.2.0:rc1 cpe:/a:isc:bind:9.2.0:rc10 cpe:/a:isc:bind:9.2.0:rc5 cpe:/a:isc:bind:9.2.0:rc9 cpe:/a:isc:bind:9.2.0:rc3 cpe:/a:isc:bind:9.2.0:rc4 cpe:/a:isc:bind:9.2 cpe:/a:isc:bind:9.1.3p3 cpe:/a:isc:bind:9.1.3p2 cpe:/a:isc:bind:9.1.3:rc3 cpe:/a:isc:bind:9.1.3 cpe:/a:isc:bind:9.1.3:rc2 cpe:/a:isc:bind:9.1.3:rc1 cpe:/a:isc:bind:9.1.2 cpe:/a:isc:bind:9.1.2:rc1 cpe:/a:isc:bind:9.1.1 cpe:/a:isc:bind:9.1.1:rc5 cpe:/a:isc:bind:9.1.1:rc1 cpe:/a:isc:bind:9.1.1:rc4 cpe:/a:isc:bind:9.1.1:rc7 cpe:/a:isc:bind:9.1.1:rc6 cpe:/a:isc:bind:9.1.1:rc2 cpe:/a:isc:bind:9.1.1:rc3 cpe:/a:isc:bind:9.1.0b3 cpe:/a:isc:bind:9.1.0b2 cpe:/a:isc:bind:9.1.0b1 cpe:/a:isc:bind:9.1.0:rc1 cpe:/a:isc:bind:9.1 cpe:/a:isc:bind:9.0.1 cpe:/a:isc:bind:9.0.1:rc2 cpe:/a:isc:bind:9.0.1:rc1 cpe:/a:isc:bind:9.0.0b5 cpe:/a:isc:bind:9.0.0b4 cpe:/a:isc:bind:9.0.0b3 cpe:/a:isc:bind:9.0.0b2 cpe:/a:isc:bind:9.0.0b1 cpe:/a:isc:bind:9.0.0:rc4 cpe:/a:isc:bind:9.0.0:rc3 cpe:/a:isc:bind:9.0.0:rc6 cpe:/a:isc:bind:9.0.0:rc2 cpe:/a:isc:bind:9.0.0:rc1 cpe:/a:isc:bind:9.0.0:rc5	178

Open Source Vulnerability Database (OSVDB)

id	Description
60493	ISC BIND DNSSEC Recursive Query Additional Section Cache Poisoning

Type	Count
Oval ID(s)	4
CPE ID(s)	178
osvdb(s)	1

Related	Severity
SUN-275890	(Medium)
SUN-273169	(Low)
DSA-1961	(Low)
CVE-2009-4022	(Low)

Same Subject	Severity
Login to view 14 more Alert(s)