(Red Hat Issues Fix) BIND NULL rdata Field Processing Flaw Lets Remote Users Deny Service and Obtain Potentially Sensitive Information
SecurityTracker Alert ID: 1027288|
SecurityTracker URL: http://securitytracker.com/id/1027288
(Links to External Site)
Date: Jul 23 2012
Denial of service via network, Disclosure of system information|
Fix Available: Yes Vendor Confirmed: Yes |
Version(s): 9.0.x - 9.6.x, 9.4-ESV - 9.4-ESV-R5-P1, 9.6-ESV - 9.6-ESV-R7, 9.7.0 - 9.7.6, 9.8.0 - 9.8.3, 9.9.0 - 9.9.1|
A vulnerability was reported in BIND. A remote user can cause denial of service conditions. A remote user can obtain potentially sensitive information.|
When a DNS resource record rdata field is zero length, the server may crash or disclose potentially sensitive information.
On recursive servers, the server may crash or disclose some portion of memory.
On secondary servers, the server may crash on restart after transferring a zone containing affected records.
On master servers, the server may corrupt zone data if the zone option "auto-dnssec" is set to "maintain".
Dan Luther, Level3 Communications, reported this vulnerability.
A remote user can cause denial of service conditions.|
A remote user can obtain potentially sensitive information.
Red Hat has issued a fix.|
The Red Hat advisory is available at:
Vendor URL: www.isc.org/software/bind/advisories/cve-2012-1667 (Links to External Site)
Access control error, State error|
Linux (Red Hat Enterprise)|
This archive entry is a follow-up to the message listed below.|
Source Message Contents
Date: Mon, 23 Jul 2012 17:59:46 +0000|
Subject: [RHSA-2012:1110-01] Important: bind security update
-----BEGIN PGP SIGNED MESSAGE-----
Red Hat Security Advisory
Synopsis: Important: bind security update
Advisory ID: RHSA-2012:1110-01
Product: Red Hat Enterprise Linux
Advisory URL: https://rhn.redhat.com/errata/RHSA-2012-1110.html
Issue date: 2012-07-23
CVE Names: CVE-2012-1667
Updated bind packages that fix one security issue are now available for
Red Hat Enterprise Linux 4 Extended Life Cycle Support.
The Red Hat Security Response Team has rated this update as having
important security impact. A Common Vulnerability Scoring System (CVSS)
base score, which gives a detailed severity rating, is available from the
CVE link in the References section.
2. Relevant releases/architectures:
Red Hat Enterprise Linux AS (v. 4 ELS) - i386, ia64, x86_64
Red Hat Enterprise Linux ES (v. 4 ELS) - i386, x86_64
The Berkeley Internet Name Domain (BIND) is an implementation of the Domain
Name System (DNS) protocols. BIND includes a DNS server (named); a resolver
library (routines for applications to use when interfacing with DNS); and
tools for verifying that the DNS server is operating correctly.
A flaw was found in the way BIND handled zero length resource data records.
A malicious owner of a DNS domain could use this flaw to create
specially-crafted DNS resource records that would cause a recursive
resolver or secondary server to crash or, possibly, disclose portions of
its memory. (CVE-2012-1667)
Users of bind are advised to upgrade to these updated packages, which
correct this issue. After installing the update, the BIND daemon (named)
will be restarted automatically.
Before applying this update, make sure all previously-released errata
relevant to your system have been applied.
This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
5. Bugs fixed (http://bugzilla.redhat.com/):
828078 - CVE-2012-1667 bind: handling of zero length rdata can cause named to terminate unexpectedly
6. Package List:
Red Hat Enterprise Linux AS (v. 4 ELS):
Red Hat Enterprise Linux ES (v. 4 ELS):
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
The Red Hat security contact is <email@example.com>. More contact
details at https://access.redhat.com/security/team/contact/
Copyright 2012 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.4 (GNU/Linux)
-----END PGP SIGNATURE-----
RHSA-announce mailing list