-----BEGIN PGP SIGNED MESSAGE-----

===========================================================================
A  U  S  C  E  R  T                                           A  L  E  R  T

                        AL-2002.13 -- AUSCERT ALERT
            Multiple Remote Vulnerabilities in BIND4 and BIND8
                             13 November 2002
===========================================================================

        AusCERT Alert Summary
        ---------------------

Three vulnerabilities have recently been discovered in BIND, a widely
used DNS (Domain Name Service) server.  The most serious of these
vulnerabilities can allow a remote malicious user to execute arbitrary
code on the server with the privileges of the BIND service, named.

Administrators of DNS servers running BIND 4 up to and including 4.9.10,
BIND 8 up to and including 8.3.3.  

BIND 9 is not affected by any of these vulnerabilities.  

Please note that BIND 4 is officially deprecated and only security fixes
will be released for it.

- --------------------------BEGIN INCLUDED TEXT--------------------

  Internet Security Systems Security Advisory
  November 12, 2002
   
  Multiple Remote Vulnerabilities in BIND4 and BIND8

  Synopsis:
   
  ISS X-Force has discovered several serious vulnerabilities in the Berkeley
  Internet Name Domain Server (BIND). BIND is the most common implementation of
  the DNS (Domain Name Service) protocol, which is used on the vast majority of
  DNS servers on the Internet. DNS is a vital Internet protocol that maintains
  a database of easy-to-remember domain names (host names) and their
  corresponding numerical IP addresses.

  Impact:
   
  The vulnerabilities described in this advisory affect nearly all currently
  deployed recursive DNS servers on the Internet. The DNS network is considered
  a critical component of Internet infrastructure. There is no information
  implying that these exploits are known to the computer underground, and there
  are no reports of active attacks. If exploits for these vulnerabilities are
  developed and made public, they may lead to compromise and DoS attacks against
  vulnerable DNS servers. Since the vulnerability is widespread, an Internet
  worm may be developed to propagate by exploiting the flaws in BIND. Widespread
  attacks against the DNS system may lead to general instability and inaccuracy
  of DNS data.

  Affected Versions:

  BIND SIG Cached RR Overflow Vulnerability       

      BIND 8, versions up to and including 8.3.3-REL
      BIND 4, versions up to and including 4.9.10-REL

  BIND OPT DoS

      BIND 8, versions 8.3.0 up to and including 8.3.3-REL

  BIND SIG Expiry Time DoS

      BIND 8, versions up to and including 8.3.3-REL

  Description:

  BIND SIG Cached RR Overflow Vulnerability

  A buffer overflow exists in BIND 4 and 8 that may lead to remote compromise of
  vulnerable DNS servers. An attacker who controls any authoritative DNS server
  may cause BIND to cache DNS information within its internal database, if
  recursion is enabled. Recursion is enabled by default unless explicitly
  disabled via command line options or in the BIND configuration file. Attackers
  must either create their own name server that is authoritative for any domain,
  or compromise any other authoritative server with the same criteria. Cached
  information is retrieved when requested by a DNS client. There is a flaw in
  the formation of DNS responses containing SIG resource records (RR) that can
  lead to buffer overflow and execution of arbitrary code.

  BIND OPT DoS

  Recursive BIND 8 servers can be caused to abruptly terminate due to an
  assertion failure. A client requesting a DNS lookup on a nonexistent sub-
  domain of a valid domain name may cause BIND 8 to terminate by attaching an
  OPT resource record with a large UDP payload size. This DoS may also be
  triggered for queries on domains whose authoritative DNS servers are
  unreachable. 

  BIND SIG Expiry Time DoS

  Recursive BIND 8 servers can be caused to abruptly terminate due to a null
  pointer dereference. An attacker who controls any authoritative name server
  may cause vulnerable BIND 8 servers to attempt to cache SIG RR elements with
  invalid expiry times. These are removed from the BIND internal database, but
  later improperly referenced, leading to a DoS condition.

  Recommendations:

  ISS X-Force recommends that system administrators immediately take steps to
  protect their networks. ISS has made several product updates available to
  assess vulnerability to this issue as well as protect customers from
  exploitation attempts.

  The following ISS updates and product releases address the issues described
  in this advisory. These updates are available from the ISS Download Center
  (http://www.iss.net/download):

  RealSecure Network Sensor XPU 20.7 and XPU 5.6
  Internet Scanner XPU 6.20
  RealSecure Guard 3.1 ebs
  RealSecure Sentry 3.1 ebs
  RealSecure Server Sensor 6.5 SR 3.3
  System Scanner SR 3.08

  As a workaround for DNS servers that do not need recursive DNS functionality,
  it is recommended to disable recursion within the BIND configuration file:

  BIND 8, named.conf

  options {
          recursion no;
  };

  BIND 4, named.boot

  options no-recursion

  Where disabling recursion is not possible, a temporary workaround exists that
  may protect perimeter DNS servers from the remote compromise vulnerability.
  Due to the nature and organization of stack variables, exploitation is much
  easier if the attack is embedded within TCP DNS traffic. It is unclear at this
  time if this attack is possible with UDP traffic on certain architectures. The
  UDP protocol is used for most DNS related queries and responses, except large
  responses and zone transfers between primary and secondary DNS servers.
  Therefore, perimeter DNS servers should be protected by filtering TCP port 53.
  This workaround will block the exploit technique demonstrated by X-Force, but
  this solution should be examined carefully to determine if it would not affect
  normal DNS functionality. This workaround is meant as a temporary solution to
  offer some level of protection before a patch can be applied.

  ISC has made software patches available. ISC recommends that BIND
  installations should be upgraded to BIND version 4.9.11, 8.2.7, 8.3.4 or to
  BIND version 9. BIND 9 was not affected by any of the vulnerabilities
  described in this advisory. These versions will be available soon at the following
  address: http://www.isc.org/products/BIND/bind-security.html. ISC recommends that
  all users requesting the security patches should contact lynda@isc.org for
  assistance.

  Additional Information:

  The Common Vulnerabilities and Exposures (CVE) project has assigned the
  following names to these issues. These are candidates for inclusion in the CVE
  list (http://cve.mitre.org), which standardizes names for security problems.

  CAN-2002-1219 BIND SIG Cached RR Overflow Vulnerability 
  CAN-2002-1220 BIND OPT DoS 
  CAN-2002-1221 BIND SIG Expiry Time DoS

  ISC BIND
  http://www.isc.org/products/BIND

  Credits:

  These vulnerabilities were discovered and researched by Neel Mehta of the ISS
  X-Force.

  ______

  About Internet Security Systems (ISS) Founded in 1994, Internet Security
  Systems (ISS) (Nasdaq: ISSX) is a pioneer and world leader in software
  and services that protect critical online resources from an ever-
  changing spectrum of threats and misuse. Internet Security Systems is
  headquartered in Atlanta, GA, with additional operations throughout the
  Americas, Asia, Australia, Europe and the Middle East.

  Copyright (c) 2002 Internet Security Systems, Inc. All rights reserved
  worldwide.

  Permission is hereby granted for the electronic redistribution of this
  document. It is not to be edited or altered in any way without the
  express written consent of the Internet Security Systems X-Force. If you
  wish to reprint the whole or any part of this document in any other
  medium excluding electronic media, please email xforce@iss.net for
  permission.

  Disclaimer: The information within this paper may change without notice.
  Use of this information constitutes acceptance for use in an AS IS
  condition. There are NO warranties, implied or otherwise, with regard to
  this information or its use. Any use of this information is at the
  user's risk. In no event shall the author/distributor (Internet Security
  Systems X-Force) be held liable for any damages whatsoever arising out
  of or in connection with the use or spread of this information.

  X-Force PGP Key available on MIT's PGP key server and PGP.com's key
  server, as well as at http://www.iss.net/security_center/sensitive.php

  Please send suggestions, updates, and comments to: X-Force

  xforce@iss.net of Internet Security Systems, Inc.

- --------------------------END INCLUDED TEXT--------------------

This alert is provided as a service to AusCERT's members.  As AusCERT did
not write the document quoted above, AusCERT has had no control over its   
content.  The decision to use any or all of this information is the
responsibility of each user or organisation, and should be done so in
accordance with site policies and procedures.

NOTE: This is only the original release of the alert.  It may not be
updated when updates to the original are made.  If downloading at a later
date, it is recommended that the alert is retrieved directly from the
original authors to ensure that the information is still current.

Contact information for the authors of the original document is included
in the alert above.  If you have any questions or need further information,
please contact them directly.

Previous advisories, alerts and external security bulletins can be 
retrieved from:

        http://www.auscert.org.au/Information/advisories.html

If you believe that your system has been compromised, contact AusCERT or
your representative in FIRST (Forum of Incident Response and Security
Teams).

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business
                hours which are GMT+10:00 (AEST).  On call after hours
                for member emergencies only.

-----BEGIN PGP SIGNATURE-----
Version: 2.6.3i
Charset: noconv
Comment: ftp://ftp.auscert.org.au/pub/auscert/AUSCERT_PGP.key

iQCVAwUBPdJSTih9+71yA2DNAQHslAP+IqL/3EPpaj31tzadXlGQnFs4rTFnZrZv
ZnrLSVqmh5MuApnEERaP+3uma0Ja/7lIISktMahN271kUJ/Zb5H6/ll4vD/mzKzZ
ILXquGOlCG9AtxgrN9YhgZC3WoPk1nQ9anFiDbdp8+huBpIjxS8mR7mEcER1l0JV
au3wnkmv924=
=241+
-----END PGP SIGNATURE-----