CERT-In Vulnerability Note
CIVN-2003-0015
ISC BIND Negative Cache Poisoning Denial of Service Vulnerability.
Original Issue Date:December 15, 2003
Severity Rating: MEDIUM
Systems Affected
ISC BIND 8.2.3 ISC BIND 8.2.4 ISC BIND 8.2.5 ISC BIND 8.2.6 ISC BIND 8.2.7 ISC BIND 8.3.0 ISC BIND 8.3.1 ISC BIND 8.3.2 ISC BIND 8.3.3 ISC BIND 8.3.4 ISC BIND 8.3.5 ISC BIND 8.3.6 ISC BIND 8.4 ISC BIND 8.4.1
Software Affected
AIX 4.3.3 AIX 5.1 AIX 5.2 Caldera UnixWare 7.1.1 EnGarde Secure Linux 1.0.1 EnGarde Secure Linux Community Edition 2 EnGarde Secure Linux Professional 1.1 EnGarde Secure Linux Professional 1.2 EnGarde Secure Linux Professional Ed 1.5 FreeBSD 4.9-RELEASE- earlier FreeBSD 5.1-RELEASE FreeBSD-stable prior to 2003-11-28 Immunix OS 7+-beta Solaris 7 Solaris 8 Solaris 9 SuSE Linux 7.3 SuSE Linux 8.0 SuSE Linux 8.1 SuSE Linux 8.2 Trustix Secure Linux 1.2 Trustix Secure Linux 1.5
Overview
ISC BIND versions 8.2.3 till 8.3.6, and 8.4 & 8.4.1 allows remote attackers to poison the cache via a malicious name server that returns negative responses with a large TTL time-to-live value.
Impact
Attackers may conduct denial-of-service attacks on specific target domains by enticing users to query a malicious name server.
Description
ISC BIND (Berkeley Internet Name Daemon) is the most popular implementation of the DNS (Domain Name Server) protocol for Unix and Linux DNS servers. ISC BIND has been reported to be prone to a negative response cache poisoning vulnerability. This issue may be exploited to trigger a denial of service affect in the vulnerable service. It has been reported that the denial of service affect will last until the bad DNS record expires from the cache.
Workaround
Do not click on URLs from untrusted sources such as unsolicited email or instant messages. Type URLs or use trusted bookmarks for sensitive sites. Users are also advised to check the credentials of the website they are accessing and verify authenticity of the website before disclosing any sensitive information like credit card details, personal information, etc.
Solution
A DNS cache should only be accessible from specified IP addresses. A proper firewall filter will limit the possibilities of sending spoofed or fake answers to the DNS cache. Latest version of BIND is available at
http://www.isc.org/products/BIND
References
Vulnerability Note VU#734644
http://www.kb.cert.org/vuls/id/734644
ISC BIND
http://www.isc.org/products/BIND
Disclaimer
The information provided herein is on "as is" basis, without warranty of any kind.
Contact Information
Email: info@cert-in.org.in Phone: +91-11-2436857
Postal address
Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India
|