Remote BIND 9 DoS Vulnerability Patched

A new, remotely exploitable denial-of-service (DoS) vulnerability affecting BIND Version 9 was reported by ISC on July 28. It’s also reported that exploits have been seen in the wild.  Because BIND is widely used, these attacks can affect many critical infrastructures. Here’s a little description of the problem.

The vulnerability exists in the DNS dynamic-update request message. Dynamic update (RFC 2136) was implemented in DNS to deal with constantly updating DNS records in various DNS servers. The individual DNS servers can send update messages back to the DNS zone master so that the master record can remain current. Each update message should contain at least a zone record, a prerequisite record, and an update record. The zone record specifies which zone the update message is for. Only the zone master can update the record for itself. The prerequisite record specifies the condition in which the server should check before updating, and the update record contains the updated record.

The vulnerability that was reported yesterday exists due to the improper handling of a specially crafted DNS dynamic-update query. There are two conditions in the update query that need to be met for this packet to trigger the vulnerability: The victim’s DNS server must be the master of the zone specified in the update query packet; and the update query packet consists of a prerequisite record with the type “ANY.” ANY is not expected in any resource record because it’s defined only as a question type. The victim’s DNS server cannot handle this condition and shuts itself down. The attacker can cause a denial-of-service on the vulnerable DNS server with just one UDP packet. In fact, the attack will succeed even if dynamic update is disabled on the victim’s DNS server.

Patches are available from ISC for BIND Versions 9.4.3-P3, 9.5.1-P3, and 9.6.1-P1. Users and administrators should apply these patches immediately because the exploit is public.

McAfee Network Security Platform detects this attack using the signature set released on July 30 with the signature “DNS: ISC BIND 9 Dynamic Update Denial-of-Service Vulnerability.”

(No Ratings Yet)

 Loading ...

Sorry, the comment form is closed at this time.