SecurityTracker.com
Keep Track of the Latest Vulnerabilities
with SecurityTracker!
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 
Sign Up
Sign Up for Your FREE Weekly SecurityTracker E-mail Alert Summary
Instant Alerts
Buy our Premium Vulnerability Notification Service to receive customized, instant alerts
Affiliates
Put SecurityTracker Vulnerability Alerts on Your Web Site -- It's Free!
Partners
Become a Partner and License Our Database or Notification Service
Report a Bug
Report a vulnerability that you have found to SecurityTracker
bugs
@
securitytracker.com





Category:   Application (Generic)  >   BIND Vendors:   ISC (Internet Software Consortium)
(NetBSD Issues Fix) BIND DNS Query Port Entropy Weakness Lets Remote Users Spoof the System
SecurityTracker Alert ID:  1020557
SecurityTracker URL:  http://securitytracker.com/id/1020557
CVE Reference:   CVE-2008-1447   (Links to External Site)
Date:  Jul 25 2008
Impact:   Modification of system information
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): 9.x
Description:   A vulnerability was reported in BIND. A remote user can spoof the system.

The domain name system (DNS) service does not use sufficiently random UDP sockets to process queries. A remote user can send specially crafted DNS queries and responses to the target service to spoof responses and insert records into the DNS cache. This may cause traffic to be redirected to arbitrary IP addresses specified by the remote user.

The vendor indicates that the vulnerability exists in the DNS protocol itself, rather than in any particular vendor's implementation.

Systems using BIND as a caching resolver are affected.

Some demonstration exploit code is available at:

http://www.caughq.org/exploits/CAU-EX-2008-0002.txt
http://www.caughq.org/exploits/CAU-EX-2008-0003.txt

Dan Kaminsky of IOActive reported this vulnerability.
Impact:   A remote user can spoof the DNS service, causing traffic to be redirected to arbitrary hosts.
Solution:   NetBSD has released a fix.

The NetBSD advisory is available at:

http://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2008-009.txt.asc
Vendor URL:  www.isc.org/index.pl?/sw/bind/index.php (Links to External Site)
Cause:   Randomization error
Underlying OS:   UNIX (NetBSD)

Message History:   This archive entry is a follow-up to the message listed below.
Jul 8 2008 BIND DNS Query Port Entropy Weakness Lets Remote Users Spoof the System


 Source Message Contents
Date:  Fri, 25 Jul 2008 01:15:30 +0100
Subject:  NetBSD Security Advisory 2008-009: BIND cache poisoning



-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


		 NetBSD Security Advisory 2008-009
		 =================================

Topic:		BIND cache poisoning

Version:	NetBSD-current:		affected
		NetBSD 4.0:		affected
		NetBSD 3.1.*:		affected
		NetBSD 3.1:		affected
		NetBSD 3.0.*:		affected
		NetBSD 3.0:		affected
					bind 8.x packages
					bind 9.4.x packages prior to 9.4.2pl1
					bind 9.5.x packages prior to 9.5.0pl1

Severity:	Remote DNS cache poisoning

Fixed:		NetBSD-current:		July 10, 2008
		NetBSD-4-0 branch:	July 16, 2008
			(4.0.1 will include the fix)
		NetBSD-4 branch:	July 16, 2008
			(4.1 will include the fix)
		NetBSD-3-1 branch:	July 24, 2008
			(3.1.2 will include the fix)
		NetBSD-3-0 branch:	July 24, 2008
			(3.0.4 will include the fix)
		NetBSD-3 branch:	July 24, 2008
			(3.2 will include the fix)
		pkgsrc:			bind-9.4.2pl1 corrects the issue
					bind-9.5.0pl1 corrects the issue

Abstract
========

Deficiencies in the DNS protocol can allow attackers to inject poisoned
responses into a caching nameserver.

This vulnerability has been assigned CVE reference CVE-2008-1447 and CERT
Vulnerability Note VU#800113.


Technical Details
=================

New cache poisoning techniques have been discovered by Dan Kaminsky which
allow an attacker to poison a cache.  This vulnerability can be exploited
by an attacker in a short amount of time.

For further information see:

  http://www.kb.cert.org/vuls/id/800113
  http://www.isc.org/sw/bind/forgery-resilience.php
  http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1447
  http://www.isc.org/sw/bind/docs/FAQ-about-random-query-issue.php


Solutions and Workarounds
=========================

It is recommended that NetBSD users of vulnerable versions update their
binaries.  If you are unable to update BIND in the base operating system
there are fixed versions in pkgsrc that can be used.

The following points should be taken into consideration when assessing
this issue:

  * Do not hard code a query source port using the 'query-source' and/or
    'query-source-v6' options.  This option was set by default in netbsd-4, 
    netbsd-4-0 and HEAD branches.  Please check your named.conf(5) to ensure
    that this option is not used.  This option has already been removed from
    the default configuration in HEAD as of July 23, 2008 and netbsd-4 and 
    netbsd-4-0 as of July 24, 2008.

  * You are only impacted by this issue if you are running BIND as a
    caching resolver.

  * For the fixed versions of BIND, ISC have stated that there is a
    noticeable impact on the performance of BIND caching resolvers with
    high query rates.  See

      http://www.isc.org/index.pl?/sw/bind/bind-security.php 

    for more information.  Later releases of BIND may improve this situation.

  * Devices performing Network Address Translation (NAT), more specifically 
    Port Address Translation (PAT) can either decrease or increase the 
    randomness of source ports used for DNS queries. ipfilter(8) currently 
    by design assigns ports in sequence when doing port mapping.  The work 
    around for this is to not do port translation on DNS traffic if that 
    traffic has already been randomised.
    e.g. If you have:

      map foo0 a/b -> c/d portmap tcp/udp 10000:20000

    then you need to do this:

      map foo0 from a/b to any port = 53 -> c/d tcp/udp
      map foo0 a/b -> c/d portmap tcp/udp 10000:20000 

    A patch has been committed to HEAD that makes ipfilter(8) use random
    port numbers by default.  Pullups have also been requested to the
    netbsd-4, netbsd-4-0, netbsd-3, netbsd-3-0 and netbsd-3-1 branches.
    This advisory will be updated with further instructions on how to
    apply this update once it becomes available in all release branches.

The following instructions describe how to upgrade your bind binaries by
updating your source tree and rebuilding and installing a new version of
bind.

* NetBSD-current:

	Systems running NetBSD-current dated from before 2008-07-10
	should be upgraded to NetBSD-current dated 2008-07-11 or later.

	The following directories need to be updated from the
	netbsd-current CVS branch (aka HEAD):

		dist/bind
		usr.sbin/bind
		lib/libbind9
		lib/libdns
		lib/libisc
		lib/libisccc
		lib/libisccfg
		lib/liblwres

	To update from CVS, re-build, and re-install bind:

		# cd src
		# cvs update -d -P dist/bind usr.sbin/bind lib/libbind9 \
			lib/libdns lib/libisc lib/libisccc lib/libisccfg \
			lib/liblwres
		# cd lib/libpthread
		# make USETOOLS=no cleandir dependall
		# cd ../lib/libcrypt
		# make USETOOLS=no cleandir dependall
		# cd ../lib/libcrypto
		# make USETOOLS=no cleandir dependall
		# cd ../libbind9
		# make USETOOLS=no cleandir dependall
		# make USETOOLS=no install
		# cd ../libdns 
		# make USETOOLS=no cleandir dependall
		# make USETOOLS=no install
		# cd ../libisc
		# make USETOOLS=no cleandir dependall
		# make USETOOLS=no install
		# cd ../libisccc
		# make USETOOLS=no cleandir dependall
		# make USETOOLS=no install
		# cd ../libisccfg
		# make USETOOLS=no cleandir dependall
		# make USETOOLS=no install
		# cd ../liblwres
		# make USETOOLS=no cleandir dependall
		# make USETOOLS=no install
		# cd ../../usr.sbin/bind
		# make USETOOLS=no cleandir dependall
		# make USETOOLS=no install

* NetBSD 4.*:

	Systems running NetBSD 4.* sources dated from before
	2008-07-16 should be upgraded from NetBSD 4.* sources dated
	2008-07-17 or later.

	The following directories need to be updated from the
	netbsd-4 or netbsd-4-0 branches:

		dist/bind
		usr.sbin/bind

	To update from CVS, re-build, and re-install bind:

		# cd src
		# cvs update -r <branch_name> -d -P dist/bind 
		# cvs update -r <branch_name> -d -P usr.sbin/bind
		# cd usr.sbin/bind
		# make USETOOLS=no cleandir dependall
		# make USETOOLS=no install

* NetBSD 3.*:

	Systems running NetBSD 3.* sources dated from before
	2008-07-24 should be upgraded from NetBSD 3.* sources dated
	2008-07-25 or later.

	The following directories need to be updated from the
	netbsd-3, netbsd-3-0 or netbsd-3-1 branches:

		dist/bind
		usr.sbin/bind

	To update from CVS, re-build, and re-install bind:

		# cd src
		# cvs update -r <branch_name> -d -P dist/bind 
		# cvs update -r <branch_name> -d -P usr.sbin/bind
		# cd usr.sbin/bind
		# make USETOOLS=no cleandir dependall
		# make USETOOLS=no install


Thanks To
=========

Christos Zoulas, Greg Troxel, Jeremy C. Reed, Havard Eidnes and Manuel Bouyer
for initial patches and testing on various releases.
Dan Kaminsky is credited with discovering this issue.


Revision History
================

	2008-07-25	Initial release


More Information
================

Advisories may be updated as new information becomes available.
The most recent version of this advisory (PGP signed) can be found at 
  ftp://ftp.NetBSD.org/pub/NetBSD/security/advisories/NetBSD-SA2008-009.txt.asc

Information about NetBSD and NetBSD security can be found at
http://www.NetBSD.org/ and http://www.NetBSD.org/Security/.


Copyright 2008, The NetBSD Foundation, Inc.  All Rights Reserved.
Redistribution permitted only in full, unmodified form.

$NetBSD: NetBSD-SA2008-009.txt,v 1.2 2008/07/24 23:58:35 adrianp Exp $

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (NetBSD)

iQCVAwUBSIkXID5Ru2/4N2IFAQJHRwP/VDWSXjntWY85Y9rdDOmO5wIjAgV+IjTd
L9GWzvAfkh3JIJnMPtf1Z3P3N+2omNzcrra1chW5A+9nPaSmKLmq9FhT21sNXCD/
FkW/jt+6UdtkdSUXUI+OcnBj7ngUqLT8E5YGbHxg/Tc02vtYunHSWD0fsX80RbcQ
qU4lbWImAes=
=XDy8
-----END PGP SIGNATURE-----


Go to the Top of This SecurityTracker Archive Page



Home   |    View Topics   |    Search   |    Contact Us

Copyright 2012, SecurityGlobal.net LLC