(IBM Issues Fix for AIX) ISC BIND Invalid Record Caching Flaw Lets Remote Users Deny Service
|
|
SecurityTracker Alert ID: 1026472 |
|
SecurityTracker URL: http://securitytracker.com/id/1026472
|
|
CVE Reference:
CVE-2011-4313
(Links to External Site)
|
Date: Dec 29 2011
|
Impact:
Denial of service via network
|
Fix Available: Yes Vendor Confirmed: Yes
|
Version(s): 9.4-ESV, 9.6-ESV, 9.7.x, 9.8.x
|
Description:
A vulnerability was reported in ISC BIND. A remote user can cause denial of service conditions.
A remote user can send specially crafted data to cause the target BIND service to cache an invalid record. A subsequent query can trigger an error in 'query.c' and cause BIND to crash.
|
Impact:
A remote user can cause the target BIND service to crash.
|
Solution:
IBM has issued a fix for AIX.
The IBM advisory is available at:
http://aix.software.ibm.com/aix/efixes/security/bind9_advisory3.asc
|
Vendor URL: www.isc.org/software/bind/advisories/cve-2011-4313 (Links to External Site)
|
Cause:
State error
|
Underlying OS:
UNIX (AIX)
|
|
Message History:
This archive entry is a follow-up to the message listed below.
|
Source Message Contents
|
Date: Thu, 29 Dec 2011 04:15:30 +0000
Subject: IBM AIX
|
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
IBM SECURITY ADVISORY
First Issued: Wed Dec 28 16:20:43 CST 2011
The most recent version of this document is available here:
http://aix.software.ibm.com/aix/efixes/security/bind9_advisory3.asc
VULNERABILITY SUMMARY
VULNERABILITY: Multiple vulnerabilities in AIX BIND
PLATFORMS: AIX 5.3, 6.1, and 7.1 releases
SOLUTION: Apply the fix or workaround as described below.
THREAT: A remote attacker can cause a denial of service
CVE Numbers: CVE-2011-4313
CVE-2010-0382
CVE-2010-0097
CVE-2009-0025
Reboot required? NO
Workarounds? NO
DETAILED INFORMATION
I. DESCRIPTION
An as-yet unidentified network event caused BIND 9 resolvers to
cache an invalid record, subsequent queries for which could crash
the resolvers with an assertion failure.
Please see the following for more information:
http://www.isc.org/software/bind/advisories/cve-2011-4313
Furthermore, AIX BIND 9.4.1 is affected by the following three
security vulnerabilities:
CVE-2010-0382 - ISC BIND Out-Of-Bailwick Data Handling Error
CVE-2010-0097 - ISC BIND Improper DNSSEC NSEC and NSEC3 Record
CVE-2009-0025 - BIND OpenSSL DSA_do_verify and EVP_VerifyFinal
II. PLATFORM VULNERABILITY ASSESSMENT
Note: To use the following commands on VIOS you must first
execute:
oem_setup_env
To determine if your system is vulnerable, execute the following
command:
lslpp -L bos.net.tcp.client bos.net.tcp.server
The following fileset levels are vulnerable:
AIX Fileset Lower Level Upper Level
------------------------------------------------
bos.net.tcp.client 5.3.12.0 5.3.12.5
bos.net.tcp.server 5.3.12.0 5.3.12.3
bos.net.tcp.client 6.1.5.0 6.1.5.7
bos.net.tcp.server 6.1.5.0 6.1.5.6
bos.net.tcp.client 6.1.6.0 6.1.6.16
bos.net.tcp.server 6.1.6.0 6.1.6.16
bos.net.tcp.client 6.1.7.0 6.1.7.1
bos.net.tcp.server 6.1.7.0 6.1.7.0
bos.net.tcp.client 7.1.0.0 7.1.0.17
bos.net.tcp.server 7.1.0.0 7.1.0.16
bos.net.tcp.client 7.1.1.0 7.1.1.1
bos.net.tcp.server 7.1.1.0 7.1.1.0
III. SOLUTION
A. FIXES
Fixes are now available. The fixes can be downloaded from:
http://aix.software.ibm.com/aix/efixes/security/bind9_ifix3.tar
The links above are to a tar file containing this signed
advisory, fix packages, and PGP signatures for each package.
AIX Level Fix
------------------------------------------------------
5.3.12.5 IV09491m05.111226.epkg.Z
6.1.5.7 IV11742m07.111206.epkg.Z
6.1.6.16 IV11743m06.111216.epkg.Z
6.1.7.1 IV09978m01.111207.epkg.Z
7.1.0.17 IV11744m04.111207.epkg.Z
7.1.1.1 IV10049m01.111208.epkg.Z
NOTE: For 6.1 TL07 and 7.1 TL01, following ifixes may be required
to install prior to installing BIND ifix due to emgr script issue:
ftp://aix.software.ibm.com/aix/efixes/iv12335/IV12335s01.epkg.Z
ftp://aix.software.ibm.com/aix/efixes/iv12342/IV12342s01.epkg.Z
To extract the fixes from the tar file:
tar xvf bind9_ifix3.tar
cd bind9_ifix3
Verify you have retrieved the fixes intact:
The checksums below were generated using the "csum -h SHA1"
(sha1sum) commands and are as follows:
csum -h SHA1 (sha1sum) filename
------------------------------------------------------------------
25b3efc2050a355389e54ecfa1c75112f2f3a9c1 IV09491m05.111226.epkg.Z
915fefd318654e37cb30462c64e2d03badf20b2f IV09978m01.111207.epkg.Z
03401f6d52899602959f3f21b04b83bf1f9590e4 IV10049m01.111208.epkg.Z
28e81ddcf600dedcfd28b046b8e6799045513f0e IV11742m07.111206.epkg.Z
666c4c66bda95c3fb030928afea897cff0f51b43 IV11743m06.111216.epkg.Z
7327c22ff990879d62977634c2ae2babf713bff1 IV11744m04.111207.epkg.Z
To verify the sums, use the text of this advisory as input to
csum or sha1sum. For example:
csum -h SHA1 -i bind9_advisory3.asc
sha1sum -c bind9_advisory3.asc
These sums should match exactly. The PGP signatures in the tar
file and on this advisory can also be used to verify the
integrity of the fixes. If the sums or signatures cannot be
confirmed, contact IBM AIX Security and describe the
discrepancy at the following addresses:
security-alert@austin.ibm.com
B. FIX INSTALLATION
IMPORTANT: If possible, it is recommended that a mksysb backup
of the system be created. Verify it is both bootable and
readable before proceeding.
Fix management documentation can be found at:
http://www14.software.ibm.com/webapp/set2/sas/f/aix.efixmgmt/home.html
To preview fix installation:
emgr -e fix_name -p # where fix_name is the name of the
# fix being previewed.
To install fix package:
emgr -e fix_name -X # where fix_name is the name of the
# fix being installed.
C. APARS
IBM has assigned the following APARs to this problem:
AIX Level APAR number Service pack date
--------------------------------------------------------
5.3.12 IV09491 tbd
6.1.5 IV11742 tbd
6.1.6 IV11743 tbd
6.1.7 IV09978 02/17/12 sp3
7.1.0 IV11744 tbd
7.1.1 IV10049 tbd
Subscribe to the APARs here:
http://www.ibm.com/support/docview.wss?uid=isg1IV09491
http://www.ibm.com/support/docview.wss?uid=isg1IV11742
http://www.ibm.com/support/docview.wss?uid=isg1IV11743
http://www.ibm.com/support/docview.wss?uid=isg1IV09978
http://www.ibm.com/support/docview.wss?uid=isg1IV11744
http://www.ibm.com/support/docview.wss?uid=isg1IV10049
By subscribing, you will receive periodic email alerting you
to the status of the APAR, and a link to download the service
pack when it becomes available.
IV. WORKAROUND
There are no workarounds available other than disabling the named service.
V. CONTACT INFORMATION
If you would like to receive AIX Security Advisories via email,
please visit:
http://www.ibm.com/systems/support
and click on the "My notifications" link.
To view previously issued advisories, please visit:
http://www14.software.ibm.com/webapp/set2/subscriptions/pqvcmjd
Comments regarding the content of this announcement can be
directed to:
security-alert@austin.ibm.com
To obtain the PGP public key that can be used to communicate
securely with the AIX Security Team you can either:
A. Send an email with "get key" in the subject line to:
security-alert@austin.ibm.com
B. Download the key from our web page:
http://www.ibm.com/systems/resources/systems_p_os_aix_security_pgpkey.txt
C. Download the key from a PGP Public Key Server. The key ID is:
0x28BFAA12
Please contact your local IBM AIX support center for any
assistance.
eServer is a trademark of International Business Machines
Corporation. IBM, AIX and pSeries are registered trademarks of
International Business Machines Corporation. All other trademarks
are property of their respective holders.
VI. REFERENCES:
Complete CVSS Guide: http://www.first.org/cvss/cvss-guide.html
On-line Calculator V2:
http://nvd.nist.gov/cvss.cfm?calculator&adv&version=2
X-Force Vulnerability Database: n/a
CVE-2011-4313: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4313
CVE-2010-0382: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0382
CVE-2010-0097: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0097
CVE-2009-0025: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0025
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.7 (AIX)
iD8DBQFO+2Cy4fmd+Ci/qhIRAmSFAJwJ4knHG1upERg2Ia1Ku74DvZlBGgCbBmPo
RW3JZFPi5uQ/5UOiUi4sT2E=
=BtcF
-----END PGP SIGNATURE-----
|
|
