Executive Summary
Summary | |
---|---|
Title | New BIND packages fix several vulnerabilities |
Informations | |||
---|---|---|---|
Name | DSA-196 | First vendor Publication | 2002-11-14 |
Vendor | Debian | Last vendor Modification | 2002-11-14 |
Severity (Vendor) | N/A | Revision | 1 |
Security-Database Scoring CVSS v3
Cvss vector : N/A | |||
---|---|---|---|
Overall CVSS Score | NA | ||
Base Score | NA | Environmental Score | NA |
impact SubScore | NA | Temporal Score | NA |
Exploitabality Sub Score | NA | ||
Calculate full CVSS 3.0 Vectors scores |
Security-Database Scoring CVSS v2
Cvss vector : (AV:N/AC:L/Au:N/C:P/I:P/A:P) | |||
---|---|---|---|
Cvss Base Score | 7.5 | Attack Range | Network |
Cvss Impact Score | 6.4 | Attack Complexity | Low |
Cvss Expoit Score | 10 | Authentication | None Required |
Calculate full CVSS 2.0 Vectors scores |
Detail
[Bind version 9, the bind9 package, is not affected by these problems.] ISS X-Force has discovered several serious vulnerabilities in the Berkeley Internet Name Domain Server (BIND). BIND is the most common implementation of the DNS (Domain Name Service) protocol, which is used on the vast majority of DNS servers on the Internet. DNS is a vital Internet protocol that maintains a database of easy-to-remember domain names (host names) and their corresponding numerical IP addresses. Circumstancial evidence suggests that the Internet Software Consortium (ISC), maintainers of BIND, was made aware of these issues in mid-October. Distributors of Open Source operating systems, including Debian, were notified of these vulnerabilities via CERT about 12 hours before the release of the advisories on November 12th. This notification did not include any details that allowed us to identify the vulnerable code, much less prepare timely fixes. Unfortunately ISS and the ISC released their security advisories with only descriptions of the vulnerabilities, without any patches. Even though there were no signs that these exploits are known to the black-hat community, and there were no reports of active attacks, such attacks could have been developed in the meantime - with no fixes available. We can all express our regret at the inability of the ironically named Internet Software Consortium to work with the Internet community in handling this problem. Hopefully this will not become a model for dealing with security issues in the future. The Common Vulnerabilities and Exposures (CVE) project identified the following vulnerabilities: 1. CAN-2002-1219: A buffer overflow in BIND 8 versions 8.3.3 and earlier allows a remote attacker to execute arbitrary code via a certain DNS server response containing SIG resource records (RR). This buffer overflow can be exploited to obtain access to the victim host under the account the named process is running with, usually root. 2. CAN-2002-1220: BIND 8 versions 8.3.x through 8.3.3 allows a remote attacker to cause a denial of service (termination due to assertion failure) via a request for a subdomain that does not exist, with an OPT resource record with a large UDP payload size. 3. CAN-2002-1221: BIND 8 versions 8.x through 8.3.3 allows a remote attacker to cause a denial of service (crash) via SIG RR elements with invalid expiry times, which are removed from the internal BIND database and later cause a null dereference. These problems have been fixed in version 8.3.3-2.0woody1 for the current stable distribution (woody), in 8.2.3-0.potato.3 for the previous stable distribution (potato) and in version 8.3.3-3 for the unstable distribution (sid). The fixed packages for unstable will enter the archive today. We recommend that you upgrade your bind package immediately, update to bind9, or switch to another DNS server implementation. wget url will fetch the file for you dpkg -i file.deb will install the referenced file. If you are using the apt-get package manager, use the line for sources.list as given below: apt-get update will update the internal database apt-get upgrade will install corrected packages You may use an automated update by adding the resources from the footer to the proper configuration. Debian 2.2 (oldstable) |
Original Source
Url : http://www.debian.org/security/2002/dsa-196 |
OVAL Definitions
Definition Id: oval:org.mitre.oval:def:2094 | |||
Oval ID: | oval:org.mitre.oval:def:2094 | ||
Title: | BIND DoS via SIG RR Elements | ||
Description: | BIND 8.x through 8.3.3 allows remote attackers to cause a denial of service (crash) via SIG RR elements with invalid expiry times, which are removed from the internal BIND database and later cause a null dereference. | ||
Family: | unix | Class: | vulnerability |
Reference(s): | CVE-2002-1221 | Version: | 1 |
Platform(s): | Sun Solaris 7 | Product(s): | Bind |
Definition Synopsis: | |||
|
Definition Id: oval:org.mitre.oval:def:2539 | |||
Oval ID: | oval:org.mitre.oval:def:2539 | ||
Title: | BIND SIG Resource Records Buffer Overflow | ||
Description: | Buffer overflow in named in BIND 4 versions 4.9.10 and earlier, and 8 versions 8.3.3 and earlier, allows remote attackers to execute arbitrary code via a certain DNS server response containing SIG resource records (RR). | ||
Family: | unix | Class: | vulnerability |
Reference(s): | CVE-2002-1219 | Version: | 1 |
Platform(s): | Sun Solaris 7 | Product(s): | Bind |
Definition Synopsis: | |||
|
Definition Id: oval:org.mitre.oval:def:449 | |||
Oval ID: | oval:org.mitre.oval:def:449 | ||
Title: | Bind OPT Resource Record DoS Vulnerability | ||
Description: | BIND 8.3.x through 8.3.3 allows remote attackers to cause a denial of service (termination due to assertion failure) via a request for a subdomain that does not exist, with an OPT resource record with a large UDP payload size. | ||
Family: | unix | Class: | vulnerability |
Reference(s): | CVE-2002-1220 | Version: | 1 |
Platform(s): | Sun Solaris 9 | Product(s): | Bind |
Definition Synopsis: | |||
|
CPE : Common Platform Enumeration
OpenVAS Exploits
Date | Description |
---|---|
2009-05-05 | Name : HP-UX Update for BIND HPSBUX00233 File : nvt/gb_hp_ux_HPSBUX00233.nasl |
2008-01-17 | Name : Debian Security Advisory DSA 196-1 (bind) File : nvt/deb_196_1.nasl |
Open Source Vulnerability Database (OSVDB)
Id | Description |
---|---|
9725 | ISC BIND SIG RR Elements Invalid Expirty Times DoS |
9724 | ISC BIND OPT Resource Record Large UDP Payload DoS |
869 | ISC BIND named SIG Resource Server Response RR Overflow This system appears to be running a version of BIND that is vulnerable to a remote buffer overflow in the code that creates response messages for SIG record requests. This vulnerability affects BIND versions 4.9.5 to 4.9.10, as well versions 8.1 to 8.3.3. |
Nessus® Vulnerability Scanner
Date | Description |
---|---|
2004-09-29 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-196.nasl - Type : ACT_GATHER_INFO |
2004-07-25 | Name : The remote host is missing a vendor-supplied security patch File : suse_SA_2002_044.nasl - Type : ACT_GATHER_INFO |
2002-11-12 | Name : It is possible to use the remote name server to execute arbitrary code on the... File : bind_sig_cached_rr_overflow.nasl - Type : ACT_GATHER_INFO |
2002-03-08 | Name : It is possible to use the remote name server to break into the remote host. File : bind_dnsstorm.nasl - Type : ACT_GATHER_INFO |
Alert History
Date | Informations |
---|---|
2014-02-17 11:29:06 |
|