Multiple Vendor DNS Cache Corruption Vulnerability
BID:136
Info
Multiple Vendor DNS Cache Corruption Vulnerability
| Bugtraq ID: | 136 |
| Class: | Origin Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | Unknown |
| Published: | Apr 23 1997 12:00AM |
| Updated: | Apr 23 1997 12:00AM |
| Credit: | Cache corruption theory and attacks are not by any stretch of the imagination 'new'. This technique and particular attack was discovered and publicised by Johannes Erdfelt <[email protected]> Wed, 23/1997. This post was spurred by a post from Secure |
| Vulnerable: |
Sun SunOS 4.1.4 Sun SunOS 4.1.3 _U1 Sun SunOS 4.1.3 Sun Solaris 2.5.1 _x86 Sun Solaris 2.5.1 _ppc Sun Solaris 2.5.1 Sun Solaris 2.6_x86 Sun Solaris 2.6 Sun Solaris 2.5_x86 Sun Solaris 2.5 Sun Solaris 2.4_x86 Sun Solaris 2.4 Sun Solaris 2.3 SGI IRIX 6.4 SGI IRIX 6.3 SGI IRIX 6.2 SGI IRIX 6.1 SGI IRIX 6.0.1 SGI IRIX 6.0 SGI IRIX 5.3 XFS SGI IRIX 5.3 SGI IRIX 5.2 SGI IRIX 5.1 SGI IRIX 5.0.1 SGI IRIX 5.0 SGI IRIX 4.0.5 IPR SGI IRIX 4.0.5 H SGI IRIX 4.0.5 G SGI IRIX 4.0.5 F SGI IRIX 4.0.5 E SGI IRIX 4.0.5 D SGI IRIX 4.0.5 A SGI IRIX 4.0.5 (IOP) SGI IRIX 4.0.5 SGI IRIX 4.0.4 T SGI IRIX 4.0.4 B SGI IRIX 4.0.4 SGI IRIX 4.0.3 SGI IRIX 4.0.2 SCO Open Server 5.0 NEC UX/4800 (64) HP HP-UX (VVOS) 10.24 HP HP-UX 10.20 Data General DG/UX 5.4 4.11 BSDI BSD/OS 2.0.1 |
| Not Vulnerable: |
ISC BIND 8.1.1 ISC BIND 8.1 ISC BIND 4.9.7 -T1B ISC BIND 4.9.7 ISC BIND 4.9.6 |
Discussion
Multiple Vendor DNS Cache Corruption Vulnerability
BIND (Berkeley Internet Name Daemon) is the software packge most widely deployed on the Internet to facilitate DNS (Domain Name Service). BIND has a series of utilities that come with it in order to deploy DNS both client (resolver libraries etc.) and server end (named). In this instance we are discussing a bug in the Name Server or named(8) which ships with BIND 4.9.5-P1 or below.
This particular vulnerability is that a name daemon from these distributions will blindly recieve records from other DNS servers and cache them without verifification. Therefore, intruders who control a nameserver on the global internet can force your nameserver to look up data from them and then feed it back additional and corrupt records. These records are typically designed to live in your cache and divert traffic from legitimate sites.
In the referance section to this vulnerability is a message from Johannes Erdfelt ([email protected]) detailing this problem, it is suggested reading. it also important to note that while this is the most recent cache corruption attack it is not the only such one. BIND has a long history of security vulnerabilties.
BIND (Berkeley Internet Name Daemon) is the software packge most widely deployed on the Internet to facilitate DNS (Domain Name Service). BIND has a series of utilities that come with it in order to deploy DNS both client (resolver libraries etc.) and server end (named). In this instance we are discussing a bug in the Name Server or named(8) which ships with BIND 4.9.5-P1 or below.
This particular vulnerability is that a name daemon from these distributions will blindly recieve records from other DNS servers and cache them without verifification. Therefore, intruders who control a nameserver on the global internet can force your nameserver to look up data from them and then feed it back additional and corrupt records. These records are typically designed to live in your cache and divert traffic from legitimate sites.
In the referance section to this vulnerability is a message from Johannes Erdfelt ([email protected]) detailing this problem, it is suggested reading. it also important to note that while this is the most recent cache corruption attack it is not the only such one. BIND has a long history of security vulnerabilties.
Exploit / POC
Multiple Vendor DNS Cache Corruption Vulnerability
Currently the SecurityFocus staff are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].
Currently the SecurityFocus staff are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].
Solution / Fix
Multiple Vendor DNS Cache Corruption Vulnerability
Solution:
If your Name Daemon pre-dates or is equal to BIND 4.9.5 it is suggested that you update to the most recent version of BIND available from it's maintainers the ISC (Internet Software Consortium).
BIND can be downloaded from:
ftp://ftp.isc.org/isc/bind/
Vendor update information is included in the advisories attached this vulnerability entry in the referance section.
Solution:
If your Name Daemon pre-dates or is equal to BIND 4.9.5 it is suggested that you update to the most recent version of BIND available from it's maintainers the ISC (Internet Software Consortium).
BIND can be downloaded from:
ftp://ftp.isc.org/isc/bind/
Vendor update information is included in the advisories attached this vulnerability entry in the referance section.
References
Multiple Vendor DNS Cache Corruption Vulnerability
References:
References:
- Addressing Weaknesses in the Domain Name System (Cristoff Schuba)
- Addressing Weaknesses in the Domain Name System" Short Technical report with Gen (Gene Spafford/Christoph Schuba)
- Common DNS Implementation Errors and Suggested Fixes (Kumar A., Postel J., Neuman C., Danzig P. , Miller S.)