ISC BIND 8 Remote Cache Poisoning Vulnerability

Bugtraq ID:	25459
Class:	Design Error
CVE:	CVE-2007-2930
Remote:	Yes
Local:	No
Published:	Aug 27 2007 12:00AM
Updated:	May 05 2008 11:26PM
Credit:	Amit Klein discovered this vulnerability.
Vulnerable:	Sun Solaris 9_x86 Sun Solaris 9 Sun Solaris 8_x86 Sun Solaris 8_sparc Nortel Networks Self-Service Speech Server 0 Nortel Networks Self-Service Peri Application 0 Nortel Networks Self-Service MPS 500 0 Nortel Networks Self-Service MPS 1000 0 Nortel Networks Self-Service MPS 100 0 Nortel Networks Self-Service - CCSS7 0 Nortel Networks Enterprise NMS 0 Nortel Networks Business Communications Manager 3.0 Nortel Networks Business Communications Manager 2.0 Nortel Networks BCM 400 Nortel Networks BCM 200 Nortel Networks BCM 1000 ISC BIND 8.4.7 ISC BIND 8.4.6 ISC BIND 8.4.5 ISC BIND 8.4.4 ISC BIND 8.4.3 ISC BIND 8.4.2 ISC BIND 8.4.1 ISC BIND 8.4 ISC BIND 8.3.7 ISC BIND 8.3.6 ISC BIND 8.3.5 ISC BIND 8.3.4 + Apple Mac OS X 10.2.4 + Apple Mac OS X 10.2.3 + Apple Mac OS X Server 10.2.4 + Apple Mac OS X Server 10.2.3 + S.u.S.E. Linux Personal 8.2 ISC BIND 8.3.3 + Apple Mac OS X 10.2.2 + Apple Mac OS X 10.2.1 + Apple Mac OS X 10.2 + Apple Mac OS X 10.1.5 + Apple Mac OS X 10.1.4 + Apple Mac OS X 10.1.3 + Apple Mac OS X 10.1.2 + Apple Mac OS X 10.1.1 + Apple Mac OS X 10.1 + Apple Mac OS X 10.1 + Apple Mac OS X Server 10.2.2 + Apple Mac OS X Server 10.2.1 + Apple Mac OS X Server 10.2 + Apple Mac OS X Server 10.0 + Debian Linux 3.0 + FreeBSD FreeBSD 4.7 -RELEASE + FreeBSD FreeBSD 4.7 + MandrakeSoft Single Network Firewall 7.2 + Mandriva Linux Mandrake 7.2 + OpenPKG OpenPKG 1.1 + OpenPKG OpenPKG Current ISC BIND 8.3.2 + FreeBSD FreeBSD 4.6 -RELEASE + FreeBSD FreeBSD 4.6 ISC BIND 8.3.1 ISC BIND 8.3 .0 ISC BIND 8.2.7 ISC BIND 8.2.6 + OpenPKG OpenPKG 1.0 + Trustix Secure Linux 1.5 + Trustix Secure Linux 1.2 ISC BIND 8.2.5 + OpenPKG OpenPKG 1.0 + Trustix Secure Linux 1.5 ISC BIND 8.2.4 + SuSE Linux 8.1 + SuSE Linux 8.0 + SuSE Linux 7.3 sparc + SuSE Linux 7.3 ppc + SuSE Linux 7.3 + Trustix Secure Linux 1.2 ISC BIND 8.2.3 Beta ISC BIND 8.2.3 + Caldera OpenLinux Server 3.1.1 + Caldera OpenLinux Server 3.1 + Caldera OpenLinux Workstation 3.1.1 + Caldera OpenLinux Workstation 3.1 + Debian Linux 2.2 + EnGarde Secure Linux 1.0.1 + Immunix Immunix OS 7+ ISC BIND 8.2.2 p7 ISC BIND 8.2.2 p6 ISC BIND 8.2.2 p5 + Caldera OpenLinux Desktop 2.3 + Caldera UnixWare 7.1.1 + Debian Linux 2.3 sparc + Debian Linux 2.3 powerpc + Debian Linux 2.3 arm + Debian Linux 2.3 alpha + Debian Linux 2.3 68k + Debian Linux 2.3 + Debian Linux 2.2 sparc + Debian Linux 2.2 powerpc + Debian Linux 2.2 arm + Debian Linux 2.2 alpha + Debian Linux 2.2 68k + Debian Linux 2.2 + IBM AIX 4.3.3 + IBM AIX 4.3.2 + IBM AIX 4.3.1 + IBM AIX 4.3 + MandrakeSoft Corporate Server 1.0.1 + MandrakeSoft Single Network Firewall 7.2 + Mandriva Linux Mandrake 7.2 + Mandriva Linux Mandrake 7.1 + Mandriva Linux Mandrake 7.0 + Mandriva Linux Mandrake 6.1 + Mandriva Linux Mandrake 6.0 + Redhat Linux 7.0 J sparc + Redhat Linux 7.0 J i386 + Redhat Linux 7.0 J alpha + Redhat Linux 7.0 sparc + Redhat Linux 7.0 i386 + Redhat Linux 7.0 alpha + Redhat Linux 6.2 E sparc + Redhat Linux 6.2 E i386 + Redhat Linux 6.2 E alpha + Redhat Linux 6.2 sparc + Redhat Linux 6.2 i386 + Redhat Linux 6.2 alpha + Redhat Linux 6.1 sparc + Redhat Linux 6.1 i386 + Redhat Linux 6.1 alpha + Redhat Linux 6.0 sparc + Redhat Linux 6.0 alpha + Redhat Linux 6.0 + Redhat Linux 5.2 sparc + Redhat Linux 5.2 i386 + Redhat Linux 5.2 alpha + SCO eDesktop 2.4 + SCO eServer 2.3 + SuSE Linux 6.4 ppc + SuSE Linux 6.4 alpha + SuSE Linux 6.4 + SuSE Linux 6.3 alpha + SuSE Linux 6.3 + SuSE Linux 6.2 + SuSE Linux 6.1 alpha + SuSE Linux 6.1 + SuSE Linux 6.0 + Trustix Trustix Secure Linux 1.1 + Trustix Trustix Secure Linux 1.0 ISC BIND 8.2.2 p4 ISC BIND 8.2.2 p3 ISC BIND 8.2.2 p2 ISC BIND 8.2.2 p1 ISC BIND 8.2.2 ISC BIND 8.2.1 ISC BIND 8.2 - Caldera OpenLinux 2.2 - Caldera OpenLinux 1.3 - Caldera UnixWare 7.1.1 - IBM AIX 4.3.3 - IBM AIX 4.3.2 - IBM AIX 4.3.1 - IBM AIX 4.3 - Redhat Linux 6.1 i386 - Redhat Linux 6.0 - Redhat Linux 5.2 i386 - Redhat Linux 5.1 - Redhat Linux 5.0 - Redhat Linux 4.2 - Redhat Linux 4.1 - Redhat Linux 4.0 - Slackware Linux 4.0 IBM AIX 5.3 IBM AIX 5.2 HP HP-UX B.11.11 Avaya Proactive Contact 0 Avaya Predictive Dialer (PDS) APC 3.0 Avaya Predictive Dialer 0 Avaya Interactive Response 1.3 Avaya Interactive Response 1.2.1 Avaya Interactive Response 3.0 Avaya Interactive Response 2.0 Avaya Interactive Response Avaya CMS Supervisor 0 Avaya CMS Server 13.0 Avaya CMS Server 12.0 Avaya CMS Server 11.0 Avaya CMS Server 10.0 Avaya CMS Server 9.0 Avaya CMS Server 8.0 Avaya CMS Server 14.0 Avaya CMS Server 13.1
Not Vulnerable:	Nortel Networks SRG200/400 1.5 Nortel Networks Business Communications Manager 4.0 ISC BIND 8.4.7 -P1

ISC BIND 8 Remote Cache Poisoning Vulnerability

BIND 8 is prone to a remote cache-poisoning vulnerability because of weaknesses in its random-number generator.

An attacker may leverage this issue to manipulate cache data, potentially facilitating man-in-the-middle, site-impersonation, or denial-of-service attacks.

Versions of BIND from 8.2.0 through to 8.4.7 are vulnerable to this issue.

ISC BIND 8 Remote Cache Poisoning Vulnerability

The following exploit code is available:

• /data/vulnerabilities/exploits/25459-SHUFFLE_ONLY.pl
• /data/vulnerabilities/exploits/25459-USE_POOL.pl

ISC BIND 8 Remote Cache Poisoning Vulnerability

Solution:
The vendor has released BIND 8.4.7-P1 to address this issue. Please see the references for more information.


Sun Solaris 8_sparc

• Sun 109326-20
  http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21 -109326-20-1

IBM AIX 5.2

• IBM bind8_ifix.tar
  ftp://aix.software.ibm.com/aix/efixes/security/bind8_ifix.tar

IBM AIX 5.3

• IBM bind8_ifix.tar
  ftp://aix.software.ibm.com/aix/efixes/security/bind8_ifix.tar

Sun Solaris 9

• Sun 112837-14
  http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21 -112837-14-1

Sun Solaris 9_x86

• Sun 114265-13
  http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21 -114265-13-1

Sun Solaris 8_x86

• Sun 109327-20
  http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21 -109327-20-1

ISC BIND 8.2

• ISC BIND 8.4.7-P1
  ftp://ftp.isc.org/isc/bind8/src/8.4.7-P1/

ISC BIND 8.2.1

• ISC BIND 8.4.7-P1
  ftp://ftp.isc.org/isc/bind8/src/8.4.7-P1/

ISC BIND 8.2.2 p3

• ISC BIND 8.4.7-P1
  ftp://ftp.isc.org/isc/bind8/src/8.4.7-P1/

ISC BIND 8.2.2 p6

• ISC BIND 8.4.7-P1
  ftp://ftp.isc.org/isc/bind8/src/8.4.7-P1/

ISC BIND 8.2.2 p4

• ISC BIND 8.4.7-P1
  ftp://ftp.isc.org/isc/bind8/src/8.4.7-P1/

ISC BIND 8.2.2 p5

• ISC BIND 8.4.7-P1
  ftp://ftp.isc.org/isc/bind8/src/8.4.7-P1/

ISC BIND 8.2.2 p7

• ISC BIND 8.4.7-P1
  ftp://ftp.isc.org/isc/bind8/src/8.4.7-P1/

ISC BIND 8.2.2

• ISC BIND 8.4.7-P1
  ftp://ftp.isc.org/isc/bind8/src/8.4.7-P1/

ISC BIND 8.2.2 p2

• ISC BIND 8.4.7-P1
  ftp://ftp.isc.org/isc/bind8/src/8.4.7-P1/

ISC BIND 8.2.2 p1

• ISC BIND 8.4.7-P1
  ftp://ftp.isc.org/isc/bind8/src/8.4.7-P1/

ISC BIND 8.2.3

• ISC BIND 8.4.7-P1
  ftp://ftp.isc.org/isc/bind8/src/8.4.7-P1/

ISC BIND 8.2.3 Beta

• ISC BIND 8.4.7-P1
  ftp://ftp.isc.org/isc/bind8/src/8.4.7-P1/

ISC BIND 8.2.4

• ISC BIND 8.4.7-P1
  ftp://ftp.isc.org/isc/bind8/src/8.4.7-P1/

ISC BIND 8.2.5

• ISC BIND 8.4.7-P1
  ftp://ftp.isc.org/isc/bind8/src/8.4.7-P1/

ISC BIND 8.2.6

• ISC BIND 8.4.7-P1
  ftp://ftp.isc.org/isc/bind8/src/8.4.7-P1/

ISC BIND 8.2.7

• ISC BIND 8.4.7-P1
  ftp://ftp.isc.org/isc/bind8/src/8.4.7-P1/

ISC BIND 8.3 .0

• ISC BIND 8.4.7-P1
  ftp://ftp.isc.org/isc/bind8/src/8.4.7-P1/

ISC BIND 8.3.1

• ISC BIND 8.4.7-P1
  ftp://ftp.isc.org/isc/bind8/src/8.4.7-P1/

ISC BIND 8.3.2

• ISC BIND 8.4.7-P1
  ftp://ftp.isc.org/isc/bind8/src/8.4.7-P1/

ISC BIND 8.3.3

• ISC BIND 8.4.7-P1
  ftp://ftp.isc.org/isc/bind8/src/8.4.7-P1/

ISC BIND 8.3.4

• ISC BIND 8.4.7-P1
  ftp://ftp.isc.org/isc/bind8/src/8.4.7-P1/

ISC BIND 8.3.5

• ISC BIND 8.4.7-P1
  ftp://ftp.isc.org/isc/bind8/src/8.4.7-P1/

ISC BIND 8.3.6

• ISC BIND 8.4.7-P1
  ftp://ftp.isc.org/isc/bind8/src/8.4.7-P1/

ISC BIND 8.3.7

• ISC BIND 8.4.7-P1
  ftp://ftp.isc.org/isc/bind8/src/8.4.7-P1/

ISC BIND 8.4

• ISC BIND 8.4.7-P1
  ftp://ftp.isc.org/isc/bind8/src/8.4.7-P1/

ISC BIND 8.4.1

• ISC BIND 8.4.7-P1
  ftp://ftp.isc.org/isc/bind8/src/8.4.7-P1/

ISC BIND 8.4.2

• ISC BIND 8.4.7-P1
  ftp://ftp.isc.org/isc/bind8/src/8.4.7-P1/

ISC BIND 8.4.3

• ISC BIND 8.4.7-P1
  ftp://ftp.isc.org/isc/bind8/src/8.4.7-P1/

ISC BIND 8.4.4

• ISC BIND 8.4.7-P1
  ftp://ftp.isc.org/isc/bind8/src/8.4.7-P1/

ISC BIND 8.4.5

• ISC BIND 8.4.7-P1
  ftp://ftp.isc.org/isc/bind8/src/8.4.7-P1/

ISC BIND 8.4.6

• ISC BIND 8.4.7-P1
  ftp://ftp.isc.org/isc/bind8/src/8.4.7-P1/

ISC BIND 8.4.7

• ISC BIND 8.4.7-P1
  ftp://ftp.isc.org/isc/bind8/src/8.4.7-P1/

ISC BIND 8 Remote Cache Poisoning Vulnerability

References:

• BIND 8 End Of Life Announcement (ISC)
  
• ISC BIND Homepage (ISC)
  
• BIND 8 EOL and BIND 8 DNS Cache Poisoning (Amit Klein, Trusteer) ("Amit Klein" )
  
• ASA-2007-448 Security Vulnerability in BIND 8 May Allow Cache Poisoning Attack ( (Avaya)
  
• ASA-2008-022 HP-UX Running BIND 8, Remote DNS Cache Poisoning (HPSBUX02289) (Avaya)
  
• BIND 8 DNS Cache Poisoning (Amit Klein)
  
• Nortel Networks Security Advisory 2008008807 (Nortel Networks)
  
• Nortel Response to Potential Vunerability VU#927905 - BIND 8 May Allow Cache Poi (Nortel Networks)
  
• Sun Alert ID: 103063: Security Vulnerability in BIND 8 May Allow Cache Poisoning (Sun Microsystems)
  
• Vulnerability Note VU#927905 BIND version 8 generates cryptographically weak DNS (US-CERT)