Software Engineering Institute

Updated:  October 16, 2002

Status

Affected

Vendor Statement

Internet Software Consortium Security Advisary.
LIBBIND/LIBRESOLV: Denial of Service.
8 August 2002

Versions affected:
BIND 4 prior to 4.9.10
BIND 8 prior to 8.2.5
Severity: SERIOUS
Exploitable: Remotely
Type: Denial of service

Description:

When looking up address (gethostbyname(), gethostbyaddr()
etc.) a less than maximum sized buffer is passed to
res_search() / res_query().  If the answer is too large
to fit in the buffer the size of buffer required is
returned along with the part of the message that will fit.
This value is not checked and is passed to getanswer which
then may read past the end of the buffer depending up the
contents in the answer section.

THIS DOES NOT AFFECT THE NAMESERVER.

THIS CAN BE TRANSMITTED THROUGH CACHES.

BIND 9 is NOT affected.
BIND 8.3.x is NOT affected.

This bug may exist in other applications that call the
DNS directly.

Workarounds:

None.  Upgrade and re-linking required.

Impact:

Applications linked against vulnerable versions of the
libraries may die with segmentation violations /
bus errors.

Fix:

Upgrade to BIND 4.9.10 or preferably BIND 8.3.3.

BIND 4 is officially deprecated.  Only security
fixes will be issued for BIND 4.

http://www.isc.org/products/BIND

For application writers.  Use a maximum sized buffer (64k),
be prepared to redo the calls res_search(), res_query(),
res_send(), res_nsearch(), res_nquery() and res_send()
with a bigger buffer or take the minimum of the answer
buffer size and the value returned by these calls and
be aware that the answer is truncated.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Notified:  August 15, 2002 Updated: October 16, 2002

Status

Affected

Vendor Statement

Juniper Networks has determined that its JUNOS Internet Software, used on the M- and T-series of router products, is susceptible to this vulnerability in versions 5.2R1.4, 5.2R2.3, 5.2R3.4, 5.2R4.4, 5.3R1.2, 5.3R2.4, 5.3R3.3, and 5.4R1.4. Customers should contact Juniper or their Juniper reseller to obtain an updated version of JUNOS software.

Juniper Networks has determined that the operating software used on the ERX router products is not susceptible to this vulnerability. No software upgrade is required. However, the SDX-300 Service Deployment system may be susceptible if it is installed on a susceptible host platform. Users of SDX-300 should contact their host operating system vendor regarding this advisory.

The Juniper Networks G10 CMTS product is not susceptible to this vulnerability. No upgrade is required.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Updated:  October 01, 2002

Status

Affected

Vendor Statement

The problem was fixed in the KAME tree on August 27, 2002.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Notified:  August 23, 2002 Updated: October 16, 2002

Status

Affected

Vendor Statement

We don't ship a resolver implementation as part of MIT krb5. Our code does call res_search() in a potentially unsafe manner, but seems to only result in a read overrun. Also, it is primarily client-side code that calls res_search(), so denial of service attacks against servers are unlikely.

This will be fixed in an upcoming release of MIT krb5. The MIT Kerberos Team is not issuing a patch at this time, as we believe that the vulnerability is limited to a client-side denial of service.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Notified:  August 15, 2002 Updated: November 08, 2002

Status

Affected

Vendor Statement

Mandrake Linux 7.1 and 7.2, which ship with BIND 8.x, already have been updated to BIND version 8.3.3, which is not vulnerable to this problem. Mandrake Linux 8.0 and higher ship with BIND 9.x which is also not vulnerable.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

Most Linux distributions include the GNU glibc library that contains vulnerable DNS resolver functions. MandrakeSoft has also released MDKSA-2002:063 (fetchmail) and MDKSA-2002:075 (nss_ldap).

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Notified:  August 15, 2002 Updated: October 01, 2002

Status

Affected

Vendor Statement

The resolver code embedded in the DNS Server (Based on ISC BIND 8.2.3) on both MetaSolv Policy Services 4.1 and 4.2 are open to Vulnerability Note VU#738331. This issue is being tracked by MetaSolv under Case #28230. An upgrade to ISC BIND 8.2.6 and the ISC Sanctioned Patches to 8.2.6 for this advisory have been compiled and applied, and will be available in Policy Services 4.2 Service Pack 1 efix 1. Please contact MetaSolv Global Customer Care (supporthd@metasolv.com) for availability and assistance.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Notified:  August 15, 2002 Updated: October 10, 2002

Status

Affected

Vendor Statement

See NetBSD Security Advisory SA2002-015 for details.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Notified:  August 15, 2002 Updated: November 08, 2002

Status

Affected

Vendor Statement

Nortel Networks has determined that NetID version 4.3.1 and later is potentially affected by the vulnerability identified in CERT/CC Vulnerability Note VU#738331; a bulletin and patch are available from the following Nortel Networks support contacts:

North America: 1-8004NORTEL or 1-800-466-7835
Europe, Middle East and Africa: 00800 8008 9009, or +44 (0) 870 907 9009

Contacts for other regions are available at

www.nortelnetworks.com/help/contact/global/

Optivity NMS is not affected.

The former Nortel Networks product Preside Policy Server divested to MetaSolv Software, Inc. in February 2002 uses BIND 8 and may be potentially affected. Please refer to MetaSolv Software Inc.'s Vendor Statement.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Notified:  August 15, 2002 Updated: October 16, 2002

Status

Affected

Vendor Statement

Openwall GNU/*/Linux's glibc package was affected. As a workaround, we have applied the patch by Olaf Kirch of SuSE which limits the return value from res_send(3) to be no greater than the provided answer buffer size. This approach has the advantage of reducing the problem for poorly written third-party applications, including those which aren't a part of our distribution. At the same time, checks have also been added to avoid some potential reads beyond end of undersized DNS responses as pointed out by Dmitry V. Levin of ALT Linux. This change will be documented in the system-wide change log:

http://www.openwall.com/Owl/CHANGES.shtml

The BIND 4.9.x Openwall patch (which adds a number of security-related features) has been updated to the upcoming 4.9.10 release and will be made available at:

http://www.openwall.com/bind/

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Notified:  August 15, 2002 Updated: November 08, 2002

Status

Affected

Vendor Statement

All supported versions of Red Hat Linux which shipped with vulnerable versions of BIND were updated to BIND 9.x by a previous security errata issued in August 2002 and are therefore not vulnerable to this issue. Users of the Red Hat Network can make sure their systems are updated to this release using the 'up2date' tool.

http://rhn.redhat.com/errata/RHSA-2002-133.html

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

Red Hat has also released RHSA-2002:197 (glibc), RHSA-2002:215 (fetchmail), and RHSA-2002:175 (nss_ldap).

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Notified:  August 15, 2002 Updated: October 25, 2002

Status

Affected

Vendor Statement

All SuSE versions of bind8 are affected by the bug in res_search/res_query. Fixed packages will be provided at 2002-10-01.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

SuSE Security Announcement SuSE-SA:2002:034 addresses this issue in Heimdal Kerberos.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Notified:  August 15, 2002 Updated: November 08, 2002

Status

Affected

Vendor Statement

The Solaris DNS resolver library (libresolv.so) is affected by this issue in the following versions of Solaris:

Solaris 2.5.1, 2.6, 7, and 8
Patches have been generated for all of the above releases. Sun has published Sun Alert 45463 for this issue which is available from:

http://sunsolve.sun.com/pub-cgi/retrieve.pl?doc=fsalert%2F45463
The patches for this issue are available from:

http://sunsolve.sun.com/securitypatch

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Notified:  August 15, 2002 Updated: April 15, 2003

Status

Affected

Vendor Statement

A response to this vulnerability is available from our web site:

http://www.xerox.com/security/

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us email.