NetBSD Security Advisory 2011-006: BIND DoS via packet with rrtype zero

[NetBSD Security Officer <security-officer%NetBSD.org@localhost>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

                 NetBSD Security Advisory 2011-006
                 =================================

Topic:          BIND DoS via packet with rrtype zero


Version:        NetBSD-current:         affected prior to 20110706
                NetBSD 5.1:             affected prior to 20110708
                NetBSD 5.0:             affected prior to 20110708
                NetBSD 4.0.*:           affected prior to 20110716
                NetBSD 4.0:             affected prior to 20110716
                pkgsrc:                 net/bind96, net/bind97 and net/bind98
                                        packages prior to 20110706


Severity:       Denial of Service


Fixed:          NetBSD-current:         Jul 6th, 2011
                NetBSD-5-1 branch:      Jul 8th, 2011
                NetBSD-5-0 branch:      Jul 8th, 2011
                NetBSD-5 branch:        Jul 8th, 2011
                NetBSD-4-0 branch:      Jul 16th, 2011
                NetBSD-4 branch:        Jul 16th, 2011
                pkgsrc net/bind96:      bind-9.6.3.1.ESV4pl3 corrects this issue
                pkgsrc net/bind97:      bind-9.7.3pl3 corrects this issue
                pkgsrc net/bind98:      bind-9.8.0pl4 corrects this issue

Please note that NetBSD releases prior to 4.0 are no longer supported.
It is recommended that all users upgrade to a supported release.


Abstract
========

Packets with rrtype zero can cause named to crash.

This vulnerability has been assigned CVE-2011-2464.


Technical Details
=================

A defect in the affected BIND 9 versions allows an attacker to remotely
cause the "named" process to exit by sending a specially crafted packet.
This defect affects both recursive and authoritative servers.
The code location of the defect makes it impossible to protect BIND
using ACLs configured within named.conf or by disabling any features
at compile-time or run-time.

A remote attacker would need to be able to send a specially crafted packet
directly to a server running a vulnerable version of BIND.
There is also the potential for an indirect attack via malware that is
inadvertently installed and run, where infected machines have direct
access to an organization's nameservers.

Note: CVE-2011-2465 is also fixed with this update, CVE-2011-0414,
CVE-2011-1907 and  CVE-2011-1910 have been fixed previously but weren't
of sufficient impact to warrant an advisory.


Solutions and Workarounds
=========================

We suggest fixing this vulnerability by using the current net/bind98 or
net/bind97 pkgsrc package instead of the in-system bind until the entire
system can be updated (eg to the next security/critical release, or a
binary snapshot from http://nyftp.netbsd.org/pub/NetBSD-daily/ from past
the fix date).


Thanks To
=========

Thanks to the Internet Systems Consortium for reporting this
vulnerability and providing fixed versions.


Revision History
================

        2011-07-26      Initial release


More Information
================

Advisories may be updated as new information becomes available.
The most recent version of this advisory (PGP signed) can be found at 
  http://ftp.NetBSD.org/pub/NetBSD/security/advisories/NetBSD-SA2011-006.txt.asc

Information about NetBSD and NetBSD security can be found at
http://www.NetBSD.org/ and http://www.NetBSD.org/Security/ .

Copyright 2011, The NetBSD Foundation, Inc.  All Rights Reserved.
Redistribution permitted only in full, unmodified form.

$NetBSD: NetBSD-SA2011-006.txt,v 1.2 2011/07/25 22:17:18 tonnerre Exp $

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)

iQIcBAEBAgAGBQJOLet2AAoJEAZJc6xMSnBuJBsP/iQvcXDI1wbb8uYSqTd46G9v
07a4y11v0EP0VFP66qezOUrVGVmoll7UgJyNgC8U5iyWWh5qnTgf0VMZzNxCvG1w
zZZcP//OD6NC0CVQwGQdZ9P50gvYjdzrGBbBNVUQswrvCZ6AV5296cy+tOGwO3Qe
2j9OlD+y8l1BgbnFFYLtKpn0eQMV9T/39QRFi0iYyeJAZTIS46ozVztjCshh65uA
pzSsMBf0axrhRDupph72jl29f1VxVkxc9jSAa+9s63WU8ZCSk+4dHh1eUK3al7Ic
1Jithd6KvTl9T8d2IcViNkqW8JHRuiDm9dAIowr4F6wb5+pek8XQqV22o/ZKYVoR
8Kq7KqdxvUySmEHG8giNlA4LSkPy+jPrWtfgLfdpBPxp9w8ctBW8x3JQ7/i8/rPV
mrfM9c3uciMaQlRstXL5FFTeOs8ql4yOBiXZvKN7ptWLcNg++q4DXTIdf8dXrmT0
05qj1N44iCm4bPaIc3W17VotGxcmhbHGhWN+1e6ajna395FtM0ICdGiKGMGh1L8+
6HJJz+oKZtQpLFt1XJbwPg3XI3I9/mwpQZL+724SRnaIZD30UCuqd324QioYNGhD
BGzJOOUdc/nnpfBlyw8+fV7DFQuarJr1dFsxtZ6PrCt41wwycZdczpdM+50Xnsab
OPtLtO9aXqUly209AaEm
=GKjT
-----END PGP SIGNATURE-----