BID:11642

Multiple Vendor DNS Response Flooding Denial Of Service Vulnerability

Info

Multiple Vendor DNS Response Flooding Denial Of Service Vulnerability

Bugtraq ID:	11642
Class:	Design Error
CVE:	CVE-2004-0789
Remote:	Yes
Local:	No
Published:	Nov 09 2004 12:00AM
Updated:	Jul 12 2009 08:06AM
Credit:	Roy Arends and Jakob Schlyter are credited on the NISCC advisory. The original discoverer of this vulnerability is unknown at this time.
Vulnerable:	Team JohnLong RaidenDNSD Qbik WinGate 6.0.1 build 995 Qbik WinGate 6.0.1 build 993 Qbik WinGate 6.0 .0 Qbik WinGate 4.1 Beta A - Microsoft Windows 2000 Professional - Microsoft Windows 95 - Microsoft Windows 98 - Microsoft Windows NT 4.0 Qbik WinGate 4.0.1 - Microsoft Windows 2000 Professional - Microsoft Windows 95 - Microsoft Windows 98 - Microsoft Windows NT 4.0 Qbik WinGate 3.0 - Microsoft Windows 95 - Microsoft Windows 98 - Microsoft Windows NT 3.5.1 - Microsoft Windows NT 4.0 Posadis Posadis 0.60.1 Posadis Posadis 0.60 .0 Posadis Posadis 0.50.9 Posadis Posadis 0.50.8 Posadis Posadis 0.50.7 Posadis Posadis 0.50.6 Posadis Posadis 0.50.5 Posadis Posadis 0.50.4 Posadis Posadis m5pre2 Posadis Posadis m5pre1 Pliant Pliant DNS Server MaraDNS MaraDNS 0.8 .05 MaraDNS MaraDNS 0.5.31 MaraDNS MaraDNS 0.5.30 MaraDNS MaraDNS 0.5.29 MaraDNS MaraDNS 0.5.28 Don Moore MyDNS 0.10 .0 Don Moore MyDNS 0.9 ,x Don Moore MyDNS 0.8 ,x Don Moore MyDNS 0.7 ,x Don Moore MyDNS 0.6 ,x dnrd dnrd 2.10 - Debian Linux 2.2 r3 + SmoothWall SmoothWall 0.9.9 SE + SmoothWall SmoothWall 0.9.9 - Sun Solaris 8_sparc - Sun Solaris 7.0 - Sun Solaris 2.6 dnrd dnrd 2.9 - Sun Solaris 8_sparc - Sun Solaris 7.0 - Sun Solaris 2.6 dnrd dnrd 2.8 - Sun Solaris 8_sparc - Sun Solaris 7.0 - Sun Solaris 2.6 dnrd dnrd 2.7 dnrd dnrd 2.6 dnrd dnrd 2.5 dnrd dnrd 2.4 dnrd dnrd 2.3 dnrd dnrd 2.2 dnrd dnrd 2.1 dnrd dnrd 2.0 dnrd dnrd 1.4 dnrd dnrd 1.3 dnrd dnrd 1.2 dnrd dnrd 1.1 dnrd dnrd 1.0 DeleGate DeleGate 8.9.5 DeleGate DeleGate 8.9.4 DeleGate DeleGate 8.9.3 DeleGate DeleGate 8.9.2 DeleGate DeleGate 8.9.1 DeleGate DeleGate 8.9 DeleGate DeleGate 8.5 .0 DeleGate DeleGate 8.4 .0 DeleGate DeleGate 8.3.4 DeleGate DeleGate 8.3.3 DeleGate DeleGate 7.9.11 DeleGate DeleGate 7.8.2 DeleGate DeleGate 7.8.1 DeleGate DeleGate 7.8 .0 - FreeBSD FreeBSD 5.0 - HP HP-UX 11.20 - IBM AIX 4.3.3 - Microsoft Windows 2000 Professional SP3 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 95 - Microsoft Windows 98 - Microsoft Windows 98SE - Microsoft Windows ME - Microsoft Windows NT 4.0 SP6a - Microsoft Windows NT 4.0 SP5 - Microsoft Windows NT 4.0 SP4 - Microsoft Windows NT 4.0 SP3 - Microsoft Windows NT 4.0 SP2 - Microsoft Windows NT 4.0 SP1 - Microsoft Windows NT 4.0 - OpenBSD OpenBSD 2.9 - OpenBSD OpenBSD 3.0 - Sun Solaris 8_sparc - Sun Solaris 7.0 - Sun Solaris 2.6 DeleGate DeleGate 7.7.1 - FreeBSD FreeBSD 5.0 - HP HP-UX 11.20 - IBM AIX 4.3.3 - Microsoft Windows 2000 Professional SP3 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 95 - Microsoft Windows 98 - Microsoft Windows 98SE - Microsoft Windows ME - Microsoft Windows NT 4.0 SP6a - Microsoft Windows NT 4.0 SP5 - Microsoft Windows NT 4.0 SP4 - Microsoft Windows NT 4.0 SP3 - Microsoft Windows NT 4.0 SP2 - Microsoft Windows NT 4.0 SP1 - Microsoft Windows NT 4.0 - OpenBSD OpenBSD 2.9 - OpenBSD OpenBSD 3.0 - Sun Solaris 8_sparc - Sun Solaris 7.0 - Sun Solaris 2.6 DeleGate DeleGate 7.7 .0 Axis Communications 2460 Digital Video Recorder 3.12 Axis Communications 2420 Network Camera 2.41 Axis Communications 2420 Network Camera 2.40 Axis Communications 2420 Network Camera 2.34 Axis Communications 2420 Network Camera 2.33 Axis Communications 2420 Network Camera 2.32 Axis Communications 2420 Network Camera 2.31 Axis Communications 2420 Network Camera 2.30 Axis Communications 2420 Network Camera 2.12 Axis Communications 2401+ Video Server 3.12 Axis Communications 2400+ Video Server 3.12 Axis Communications 2400+ Video Server 3.11 Axis Communications 2120 Network Camera 2.41 Axis Communications 2120 Network Camera 2.40 Axis Communications 2120 Network Camera 2.34 Axis Communications 2120 Network Camera 2.32 Axis Communications 2120 Network Camera 2.31 Axis Communications 2120 Network Camera 2.30 Axis Communications 2120 Network Camera 2.12 Axis Communications 2110 Network Camera 2.41 Axis Communications 2110 Network Camera 2.40 Axis Communications 2110 Network Camera 2.34 Axis Communications 2110 Network Camera 2.32 Axis Communications 2110 Network Camera 2.31 Axis Communications 2110 Network Camera 2.30 Axis Communications 2110 Network Camera 2.12 Axis Communications 2100 Network Camera 2.41 Axis Communications 2100 Network Camera 2.40 Axis Communications 2100 Network Camera 2.34 Axis Communications 2100 Network Camera 2.33 Axis Communications 2100 Network Camera 2.32 Axis Communications 2100 Network Camera 2.31 Axis Communications 2100 Network Camera 2.30 Axis Communications 2100 Network Camera 2.12 Axis Communications 2100 Network Camera 2.0 3 Axis Communications 2100 Network Camera 2.0 2 Axis Communications 2100 Network Camera 2.0 1 Axis Communications 2100 Network Camera 2.0

Not Vulnerable:	Qbik WinGate 6.0.3 build 1005 Qbik WinGate 6.0.2 build 1001 Qbik WinGate 6.0.2 build 1000 Posadis Posadis 0.60.5 Posadis Posadis 0.60.4 Posadis Posadis 0.60.3 Posadis Posadis 0.60.2 Men&Mice QuickDNS Server 3.5.2 Men&Mice QuickDNS Server 2.2.3 MaraDNS MaraDNS 1.0.23 MaraDNS MaraDNS 0.9 .01 MaraDNS MaraDNS 0.9 .00 MaraDNS MaraDNS 0.8.99 ISC BIND 9.2.3 ISC BIND 9.2.2 ISC BIND 9.2.1 + Caldera OpenUnix 8.0 + MandrakeSoft Single Network Firewall 7.2 + Mandriva Linux Mandrake 7.2 + SCO Unixware 7.1.3 ISC BIND 9.2 + HP HP-UX 11.11 + HP HP-UX 11.11 + HP HP-UX 11.0 + HP HP-UX 11.0 + Mandriva Linux Mandrake 8.2 + Mandriva Linux Mandrake 8.2 + Mandriva Linux Mandrake 8.1 ia64 + Mandriva Linux Mandrake 8.1 ia64 + Mandriva Linux Mandrake 8.1 + Mandriva Linux Mandrake 8.1 + Redhat Linux 7.3 i386 + Redhat Linux 7.3 + Redhat Linux 7.3 ISC BIND 9.1.3 + Redhat Linux 7.2 ia64 + Redhat Linux 7.2 i686 + Redhat Linux 7.2 i586 + Redhat Linux 7.2 i386 + Redhat Linux 7.2 + SuSE Linux 8.0 i386 + SuSE Linux 8.0 + SuSE Linux 7.3 sparc + SuSE Linux 7.3 ppc + SuSE Linux 7.3 i386 + SuSE Linux 7.3 ISC BIND 9.1.2 + SuSE Linux 7.2 i386 + SuSE Linux 7.2 ISC BIND 9.1.1 + Mandriva Linux Mandrake 8.0 ppc + Mandriva Linux Mandrake 8.0 ISC BIND 9.1 + Caldera OpenUnix 8.0 + HP Secure OS software for Linux 1.0 + Redhat Linux 7.1 ia64 + Redhat Linux 7.1 i386 + Redhat Linux 7.1 alpha + Redhat Linux 7.1 + SuSE Linux 7.1 x86 + SuSE Linux 7.1 sparc + SuSE Linux 7.1 ppc + SuSE Linux 7.1 alpha + SuSE Linux 7.1 ISC BIND 9.0.1 ISC BIND 9.0 + SuSE Linux 7.0 sparc + SuSE Linux 7.0 ppc + SuSE Linux 7.0 i386 + SuSE Linux 7.0 alpha + SuSE Linux 7.0 ISC BIND 8.4.3 ISC BIND 8.4.2 ISC BIND 8.4.1 ISC BIND 8.4 ISC BIND 8.3.7 ISC BIND 8.3.6 ISC BIND 8.3.5 ISC BIND 8.3.4 + Apple Mac OS X 10.2.4 + Apple Mac OS X 10.2.3 + Apple Mac OS X Server 10.2.4 + Apple Mac OS X Server 10.2.3 + S.u.S.E. Linux Personal 8.2 ISC BIND 8.3.3 ISC BIND 8.3.2 + FreeBSD FreeBSD 4.6 -RELEASE + FreeBSD FreeBSD 4.6 ISC BIND 8.3.1 ISC BIND 8.3 .0 ISC BIND 8.2.7 ISC BIND 8.2.6 + OpenPKG OpenPKG 1.0 + Trustix Secure Linux 1.5 + Trustix Secure Linux 1.2 ISC BIND 8.2.5 + OpenPKG OpenPKG 1.0 + Trustix Secure Linux 1.5 ISC BIND 8.2.4 + SuSE Linux 8.1 + SuSE Linux 8.0 + SuSE Linux 7.3 sparc + SuSE Linux 7.3 ppc + SuSE Linux 7.3 + Trustix Secure Linux 1.2 ISC BIND 8.2.3 Beta ISC BIND 8.2.3 + Caldera OpenLinux Server 3.1.1 + Caldera OpenLinux Server 3.1 + Caldera OpenLinux Workstation 3.1.1 + Caldera OpenLinux Workstation 3.1 + Debian Linux 2.2 + EnGarde Secure Linux 1.0.1 + Immunix Immunix OS 7+ ISC BIND 8.2.2 p7 ISC BIND 8.2.2 p6 ISC BIND 8.2.2 p5 + Caldera OpenLinux Desktop 2.3 + Caldera UnixWare 7.1.1 + Debian Linux 2.3 sparc + Debian Linux 2.3 powerpc + Debian Linux 2.3 arm + Debian Linux 2.3 alpha + Debian Linux 2.3 68k + Debian Linux 2.3 + Debian Linux 2.2 sparc + Debian Linux 2.2 powerpc + Debian Linux 2.2 arm + Debian Linux 2.2 alpha + Debian Linux 2.2 68k + Debian Linux 2.2 + IBM AIX 4.3.3 + IBM AIX 4.3.2 + IBM AIX 4.3.1 + IBM AIX 4.3 + MandrakeSoft Corporate Server 1.0.1 + MandrakeSoft Single Network Firewall 7.2 + Mandriva Linux Mandrake 7.2 + Mandriva Linux Mandrake 7.1 + Mandriva Linux Mandrake 7.0 + Mandriva Linux Mandrake 6.1 + Mandriva Linux Mandrake 6.0 + Redhat Linux 7.0 J sparc + Redhat Linux 7.0 J i386 + Redhat Linux 7.0 J alpha + Redhat Linux 7.0 sparc + Redhat Linux 7.0 i386 + Redhat Linux 7.0 alpha + Redhat Linux 6.2 E sparc + Redhat Linux 6.2 E i386 + Redhat Linux 6.2 E alpha + Redhat Linux 6.2 sparc + Redhat Linux 6.2 i386 + Redhat Linux 6.2 alpha + Redhat Linux 6.1 sparc + Redhat Linux 6.1 i386 + Redhat Linux 6.1 alpha + Redhat Linux 6.0 sparc + Redhat Linux 6.0 alpha + Redhat Linux 6.0 + Redhat Linux 5.2 sparc + Redhat Linux 5.2 i386 + Redhat Linux 5.2 alpha + SCO eDesktop 2.4 + SCO eServer 2.3 + SuSE Linux 6.4 ppc + SuSE Linux 6.4 alpha + SuSE Linux 6.4 + SuSE Linux 6.3 alpha + SuSE Linux 6.3 + SuSE Linux 6.2 + SuSE Linux 6.1 alpha + SuSE Linux 6.1 + SuSE Linux 6.0 + Trustix Trustix Secure Linux 1.1 + Trustix Trustix Secure Linux 1.0 ISC BIND 8.2.2 p4 ISC BIND 8.2.2 p3 ISC BIND 8.2.2 p2 ISC BIND 8.2.2 p1 ISC BIND 8.2.2 ISC BIND 8.2.1 ISC BIND 8.2 - Caldera OpenLinux 2.2 - Caldera OpenLinux 1.3 - Caldera UnixWare 7.1.1 - IBM AIX 4.3.3 - IBM AIX 4.3.2 - IBM AIX 4.3.1 - IBM AIX 4.3 - Redhat Linux 6.1 i386 - Redhat Linux 6.0 - Redhat Linux 5.2 i386 - Redhat Linux 5.1 - Redhat Linux 5.0 - Redhat Linux 4.2 - Redhat Linux 4.1 - Redhat Linux 4.0 - Slackware Linux 4.0 ISC BIND 8.1.2 + HP HP-UX 11.11 + HP HP-UX 11.0 ISC BIND 8.1.1 ISC BIND 8.1 ISC BIND 4.9.11 ISC BIND 4.9.10 OW2 ISC BIND 4.9.10 ISC BIND 4.9.9 ISC BIND 4.9.8 ISC BIND 4.9.7 -T1B ISC BIND 4.9.7 + HP HP-UX 11.0 4 + HP HP-UX 11.0 + HP HP-UX 10.24 + HP HP-UX 10.20 + HP HP-UX 10.10 ISC BIND 4.9.6 ISC BIND 4.9.5 P1 ISC BIND 4.9.5 ISC BIND 4.9.4 p1 ISC BIND 4.9.4 ISC BIND 4.9.3 ISC BIND 4.9.2 ISC BIND 4.9 ISC BIND 4.8.3 ISC BIND 4.8.2 .1 ISC BIND 4.8.1 ISC BIND 4.8 Don Moore MyDNS 0.11 .0 Don Moore MyDNS 0.10.4 Don Moore MyDNS 0.10.3 Don Moore MyDNS 0.10.2 Don Moore MyDNS 0.10.1 dnrd dnrd 2.17.1 dnrd dnrd 2.17 dnrd dnrd 2.16 dnrd dnrd 2.15 dnrd dnrd 2.14 dnrd dnrd 2.13 dnrd dnrd 2.12 dnrd dnrd 2.11 DeleGate DeleGate 8.9.6 Axis Communications 2460 Digital Video Recorder 3.13 Axis Communications 2420 Network Camera 2.42 Axis Communications 2401+ Video Server 3.13 Axis Communications 2400+ Video Server 3.13 Axis Communications 2120 Network Camera 2.42 Axis Communications 2110 Network Camera 2.42 Axis Communications 2100 Network Camera 2.42

Discussion

Multiple Vendor DNS Response Flooding Denial Of Service Vulnerability

Multiple DNS vendors are reported susceptible to a denial of service vulnerability.

This vulnerability results in vulnerable DNS servers entering into an infinite query and response message loop, leading to the consumption of network and CPU resources, and denying DNS service to legitimate users.

Exploit / POC

Multiple Vendor DNS Response Flooding Denial Of Service Vulnerability

Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Solution / Fix

Multiple Vendor DNS Response Flooding Denial Of Service Vulnerability

Solution:
Axis Communications has released versions of firmware resolving this issue for various video server and network camera products. Please contact the vendor for further information on obtaining fixed firmware versions for affected products.

DNRD has stated that versions 2.11 and above are not susceptible to this vulnerability.

Mice & Men has released versions 3.5.2 and 2.2.3 of QuickDNS Server for Mac OS 8 and 9 to address this issue. Please contact the vendor for further information on obtaining fixes.

MyDNS has stated that versions 0.10.1 and above are not susceptible to this vulnerability.

MaraDNS is reportedly vulnerable in versions up to, and including 0.8.05. Versions after 0.9.05 are reported fixed.

DeleGate has released version 8.9.6 of its proxy application to address this issue.

Qbik WinGate is reported susceptible to this issue in verions up to and including 6.0.1. Versions after 6.0.1 are reported fixed.

Posadis Posadis m5pre2