Vulnerability Note VU#142646

ISC BIND 9 named denial of service vulnerability

Overview

ISC BIND 9 contains a remote packet denial of service vulnerability when running as an authoritative or recursive server.

I. Description

According to ISC:

A defect in the affected BIND 9 versions allows an attacker to remotely cause the "named" process to exit using a specially crafted packet. This defect affects both recursive and authoritative servers. The code location of the defect makes it impossible to protect BIND using ACLs configured within named.conf or by disabling any features at compile-time or run-time.

A remote attacker would need to be able to send a specially crafted packet directly to a server running a vulnerable version of BIND. There is also the potential for an indirect attack via malware that is inadvertently installed and run, where infected machines have direct access to an organization's nameservers.

II. Impact

A remote, unauthenticated attacker can cause the named daemon to crash creating a denial of service condition.

III. Solution

Apply an update

Users who obtain BIND from a third-party vendor, such as their operating system vendor, should see the vendor information portion of this document for a partial list of affected vendors.

This vulnerability is addressed in ISC BIND versions 9.6-ESV-R4-P3, 9.7.3-P3 and 9.8.0-P4. Users of BIND from the original source distribution should upgrade to this version.

See also http://www.isc.org/software/bind/advisories/cve-2011-2464

Vendor Information

Vendor	Status	Date Notified	Date Updated
Debian GNU/Linux	Affected		2011-07-07
Internet Systems Consortium	Affected	2011-06-16	2011-07-05
Mandriva S. A.	Affected		2011-07-20
Red Hat, Inc.	Affected		2011-07-07

References

http://www.isc.org/software/bind/advisories/cve-2011-2464

Credit

Thanks to Internet Systems Consortium for reporting this vulnerability.

This document was written by Michael Orlando.

Other Information

Date Public:	2011-07-05
Date First Published:	2011-07-05
Date Last Updated:	2011-07-20
CERT Advisory:
CVE-ID(s):	CVE-2011-2464
NVD-ID(s):	CVE-2011-2464
US-CERT Technical Alerts:
Severity Metric:	17.85
Document Revision:	14