SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (Generic)  >   BIND Vendors:   ISC (Internet Software Consortium)
(NetBSD Issues Fix) BIND DNS Query Port Entropy Weakness Lets Remote Users Spoof the System
SecurityTracker Alert ID:  1020557
SecurityTracker URL:  http://securitytracker.com/id/1020557
CVE Reference:   CVE-2008-1447   (Links to External Site)
Date:  Jul 25 2008
Impact:   Modification of system information
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): 9.x
Description:   A vulnerability was reported in BIND. A remote user can spoof the system.

The domain name system (DNS) service does not use sufficiently random UDP sockets to process queries. A remote user can send specially crafted DNS queries and responses to the target service to spoof responses and insert records into the DNS cache. This may cause traffic to be redirected to arbitrary IP addresses specified by the remote user.

The vendor indicates that the vulnerability exists in the DNS protocol itself, rather than in any particular vendor's implementation.

Systems using BIND as a caching resolver are affected.

Some demonstration exploit code is available at:

http://www.caughq.org/exploits/CAU-EX-2008-0002.txt
http://www.caughq.org/exploits/CAU-EX-2008-0003.txt

Dan Kaminsky of IOActive reported this vulnerability.

Impact:   A remote user can spoof the DNS service, causing traffic to be redirected to arbitrary hosts.
Solution:   NetBSD has released a fix.

The NetBSD advisory is available at:

http://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2008-009.txt.asc

Vendor URL:  www.isc.org/index.pl?/sw/bind/index.php (Links to External Site)
Cause:   Randomization error
Underlying OS:  UNIX (NetBSD)
Underlying OS Comments:  3.0, 3.1, 4.0

Message History:   This archive entry is a follow-up to the message listed below.
Jul 8 2008 BIND DNS Query Port Entropy Weakness Lets Remote Users Spoof the System



 Source Message Contents

Subject:  NetBSD Security Advisory 2008-009: BIND cache poisoning



-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


		 NetBSD Security Advisory 2008-009
		 =================================

Topic:		BIND cache poisoning

Version:	NetBSD-current:		affected
		NetBSD 4.0:		affected
		NetBSD 3.1.*:		affected
		NetBSD 3.1:		affected
		NetBSD 3.0.*:		affected
		NetBSD 3.0:		affected
					bind 8.x packages
					bind 9.4.x packages prior to 9.4.2pl1
					bind 9.5.x packages prior to 9.5.0pl1

Severity:	Remote DNS cache poisoning

Fixed:		NetBSD-current:		July 10, 2008
		NetBSD-4-0 branch:	July 16, 2008
			(4.0.1 will include the fix)
		NetBSD-4 branch:	July 16, 2008
			(4.1 will include the fix)
		NetBSD-3-1 branch:	July 24, 2008
			(3.1.2 will include the fix)
		NetBSD-3-0 branch:	July 24, 2008
			(3.0.4 will include the fix)
		NetBSD-3 branch:	July 24, 2008
			(3.2 will include the fix)
		pkgsrc:			bind-9.4.2pl1 corrects the issue
					bind-9.5.0pl1 corrects the issue

Abstract
========

Deficiencies in the DNS protocol can allow attackers to inject poisoned
responses into a caching nameserver.

This vulnerability has been assigned CVE reference CVE-2008-1447 and CERT
Vulnerability Note VU#800113.


Technical Details
=================

New cache poisoning techniques have been discovered by Dan Kaminsky which
allow an attacker to poison a cache.  This vulnerability can be exploited
by an attacker in a short amount of time.

For further information see:

  http://www.kb.cert.org/vuls/id/800113
  http://www.isc.org/sw/bind/forgery-resilience.php
  http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1447
  http://www.isc.org/sw/bind/docs/FAQ-about-random-query-issue.php


Solutions and Workarounds
=========================

It is recommended that NetBSD users of vulnerable versions update their
binaries.  If you are unable to update BIND in the base operating system
there are fixed versions in pkgsrc that can be used.

The following points should be taken into consideration when assessing
this issue:

  * Do not hard code a query source port using the 'query-source' and/or
    'query-source-v6' options.  This option was set by default in netbsd-4, 
    netbsd-4-0 and HEAD branches.  Please check your named.conf(5) to ensure
    that this option is not used.  This option has already been removed from
    the default configuration in HEAD as of July 23, 2008 and netbsd-4 and 
    netbsd-4-0 as of July 24, 2008.

  * You are only impacted by this issue if you are running BIND as a
    caching resolver.

  * For the fixed versions of BIND, ISC have stated that there is a
    noticeable impact on the performance of BIND caching resolvers with
    high query rates.  See

      http://www.isc.org/index.pl?/sw/bind/bind-security.php 

    for more information.  Later releases of BIND may improve this situation.

  * Devices performing Network Address Translation (NAT), more specifically 
    Port Address Translation (PAT) can either decrease or increase the 
    randomness of source ports used for DNS queries. ipfilter(8) currently 
    by design assigns ports in sequence when doing port mapping.  The work 
    around for this is to not do port translation on DNS traffic if that 
    traffic has already been randomised.
    e.g. If you have:

      map foo0 a/b -> c/d portmap tcp/udp 10000:20000

    then you need to do this:

      map foo0 from a/b to any port = 53 -> c/d tcp/udp
      map foo0 a/b -> c/d portmap tcp/udp 10000:20000 

    A patch has been committed to HEAD that makes ipfilter(8) use random
    port numbers by default.  Pullups have also been requested to the
    netbsd-4, netbsd-4-0, netbsd-3, netbsd-3-0 and netbsd-3-1 branches.
    This advisory will be updated with further instructions on how to
    apply this update once it becomes available in all release branches.

The following instructions describe how to upgrade your bind binaries by
updating your source tree and rebuilding and installing a new version of
bind.

* NetBSD-current:

	Systems running NetBSD-current dated from before 2008-07-10
	should be upgraded to NetBSD-current dated 2008-07-11 or later.

	The following directories need to be updated from the
	netbsd-current CVS branch (aka HEAD):

		dist/bind
		usr.sbin/bind
		lib/libbind9
		lib/libdns
		lib/libisc
		lib/libisccc
		lib/libisccfg
		lib/liblwres

	To update from CVS, re-build, and re-install bind:

		# cd src
		# cvs update -d -P dist/bind usr.sbin/bind lib/libbind9 \
			lib/libdns lib/libisc lib/libisccc lib/libisccfg \
			lib/liblwres
		# cd lib/libpthread
		# make USETOOLS=no cleandir dependall
		# cd ../lib/libcrypt
		# make USETOOLS=no cleandir dependall
		# cd ../lib/libcrypto
		# make USETOOLS=no cleandir dependall
		# cd ../libbind9
		# make USETOOLS=no cleandir dependall
		# make USETOOLS=no install
		# cd ../libdns 
		# make USETOOLS=no cleandir dependall
		# make USETOOLS=no install
		# cd ../libisc
		# make USETOOLS=no cleandir dependall
		# make USETOOLS=no install
		# cd ../libisccc
		# make USETOOLS=no cleandir dependall
		# make USETOOLS=no install
		# cd ../libisccfg
		# make USETOOLS=no cleandir dependall
		# make USETOOLS=no install
		# cd ../liblwres
		# make USETOOLS=no cleandir dependall
		# make USETOOLS=no install
		# cd ../../usr.sbin/bind
		# make USETOOLS=no cleandir dependall
		# make USETOOLS=no install

* NetBSD 4.*:

	Systems running NetBSD 4.* sources dated from before
	2008-07-16 should be upgraded from NetBSD 4.* sources dated
	2008-07-17 or later.

	The following directories need to be updated from the
	netbsd-4 or netbsd-4-0 branches:

		dist/bind
		usr.sbin/bind

	To update from CVS, re-build, and re-install bind:

		# cd src
		# cvs update -r <branch_name> -d -P dist/bind 
		# cvs update -r <branch_name> -d -P usr.sbin/bind
		# cd usr.sbin/bind
		# make USETOOLS=no cleandir dependall
		# make USETOOLS=no install

* NetBSD 3.*:

	Systems running NetBSD 3.* sources dated from before
	2008-07-24 should be upgraded from NetBSD 3.* sources dated
	2008-07-25 or later.

	The following directories need to be updated from the
	netbsd-3, netbsd-3-0 or netbsd-3-1 branches:

		dist/bind
		usr.sbin/bind

	To update from CVS, re-build, and re-install bind:

		# cd src
		# cvs update -r <branch_name> -d -P dist/bind 
		# cvs update -r <branch_name> -d -P usr.sbin/bind
		# cd usr.sbin/bind
		# make USETOOLS=no cleandir dependall
		# make USETOOLS=no install


Thanks To
=========

Christos Zoulas, Greg Troxel, Jeremy C. Reed, Havard Eidnes and Manuel Bouyer
for initial patches and testing on various releases.
Dan Kaminsky is credited with discovering this issue.


Revision History
================

	2008-07-25	Initial release


More Information
================

Advisories may be updated as new information becomes available.
The most recent version of this advisory (PGP signed) can be found at 
  ftp://ftp.NetBSD.org/pub/NetBSD/security/advisories/NetBSD-SA2008-009.txt.asc

Information about NetBSD and NetBSD security can be found at
http://www.NetBSD.org/ and http://www.NetBSD.org/Security/.


Copyright 2008, The NetBSD Foundation, Inc.  All Rights Reserved.
Redistribution permitted only in full, unmodified form.

$NetBSD: NetBSD-SA2008-009.txt,v 1.2 2008/07/24 23:58:35 adrianp Exp $

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (NetBSD)

iQCVAwUBSIkXID5Ru2/4N2IFAQJHRwP/VDWSXjntWY85Y9rdDOmO5wIjAgV+IjTd
L9GWzvAfkh3JIJnMPtf1Z3P3N+2omNzcrra1chW5A+9nPaSmKLmq9FhT21sNXCD/
FkW/jt+6UdtkdSUXUI+OcnBj7ngUqLT8E5YGbHxg/Tc02vtYunHSWD0fsX80RbcQ
qU4lbWImAes=
=XDy8
-----END PGP SIGNATURE-----

 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2019, SecurityGlobal.net LLC