ISC BIND Windows UDP Client Handler Denial Of Service Vulnerability

Bugtraq ID:	31252
Class:	Unknown
CVE:	CVE-2008-4163
Remote:	Yes
Local:	No
Published:	Sep 19 2008 12:00AM
Updated:	May 07 2015 05:23PM
Credit:	ISC
Vulnerable:	ISC BIND 9.5.0-P2-W1 ISC BIND 9.4.2-P2-W1 ISC BIND 9.3.5-P2-W1
Not Vulnerable:	ISC BIND 9.5.0-P2-W2 ISC BIND 9.4.2-P2-W2 ISC BIND 9.3.5-P2-W2

ISC BIND Windows UDP Client Handler Denial Of Service Vulnerability

ISC BIND for Windows is prone to a denial-of-service vulnerability because it fails to handle certain UDP packets.

An attacker can exploit this issue to cause the UDP client handler to shut down, denying service to legitimate users.

The issue affects BIND 9.3.5-P2-W1, 9.4.2-P2-W1, and 9.5.0-P2-W1 for the Windows platform.

ISC BIND Windows UDP Client Handler Denial Of Service Vulnerability

Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

ISC BIND Windows UDP Client Handler Denial Of Service Vulnerability

Solution:
The vendor has released fixes. Please see the references for more information.


ISC BIND 9.3.5-P2-W1

• ISC bind-9.3.5-P2-W2.tar.gz
  ftp://ftp.isc.org/isc/bind9/9.3.5-P2-W2/bind-9.3.5-P2-W2.tar.gz

ISC BIND 9.5.0-P2-W1

• ISC bind-9.5.0-P2-W2.tar.gz
  ftp://ftp.isc.org/isc/bind9/9.5.0-P2-W2/bind-9.5.0-P2-W2.tar.gz

ISC BIND 9.4.2-P2-W1

• ISC bind-9.4.2-P2-W2.tar.gz
  ftp://ftp.isc.org/isc/bind9/9.4.2-P2-W2/bind-9.4.2-P2-W2.tar.gz

ISC BIND Windows UDP Client Handler Denial Of Service Vulnerability

References:

• BIND 9.3.5-P2-W2 is now available. (ISC)
  
• BIND 9.4.2-P2-W2 is now available. (ISC)
  
• BIND 9.5.0-P2-W2 is now available (ISC)
  
• Internet Systems Consortium Homepage (ISC)