Advisories

CERT-In Advisory CIAD-2011-0068

ISC BIND "query.c" Remote Denial of Service Vulnerability

Original Issue Date: December 07, 2011

Severity Rating: High

Systems Affected

ISC BIND 9.0.x upto 9.6.x
ISC BIND 9.4-ESV upto 9.4-ESV-R5
ISC BIND 9.6-ESV upto 9.6-ESV-R5
ISC BIND 9.7.0 upto 9.7.4
ISC BIND 9.8.0 upto 9.8.1
ISC BIND 9.9.0a1 upto 9.9.0b1

Overview

A vulnerability was reported in BIND which could be exploited by remote unauthenticated attacker to cause denial of service (Service crash) on the systems having affected versions of software.

Description

This vulnerability occurs due to an operational error while handling certain DNS queries, which causes BIND 9 resolvers to cache an invalid record. If a client subsequently queries for the cached invalid record BIND resolver crashes with an assertion failure. An unauthenticated remote attacker could exploit this vulnerability to crash the BIND resolver (DoS).

Note: Servers configures as Authoritative-only are not affected with this issue.

Solution

Apply appropriate patches as mentioned in ISC BIND Advisory
http://www.isc.org/software/bind/advisories/cve-2011-4313

Workaround

Organisations unable to migrate immediately to a patched version of BIND a workaround may configure their DNS server with following configuration option:

minimal-responses yes;

Note: This workaround avoids the execution of affected code path for the servers configured as recursing-only. However for the servers running in "mixed-mode" i.e. which perform both authoritative and recursing functions this workaround only reduces but does not eliminate the exposure to the issue.

A detailed description on this workaround is available at:
https://deepthought.isc.org/article/AA-00549

It is strongly recommend to migrate to a patched version of ISC BIND.

Vendor Information

Internet Systems Consortium
http://www.isc.org/software/bind/advisories/cve-2011-4313

References

US-CERT
http://www.kb.cert.org/vuls/id/606539

ISS X-Force
http://xforce.iss.net/xforce/xfdb/71332

SecurityFocus
http://www.securityfocus.com/bid/50690

SecurityTracker
http://www.securitytracker.com/id?1026335

CVE Name
CVE-2011-4313

Disclaimer

The information provided herein is on "as is" basis, without warranty of any kind.

Contact Information

Email: info@cert-in.org.in
Phone: +91-11-24368572

Postal address

Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India