BID:6160

ISC BIND SIG Cached Resource Record Buffer Overflow Vulnerability

Info

ISC BIND SIG Cached Resource Record Buffer Overflow Vulnerability

Bugtraq ID:	6160
Class:	Boundary Condition Error
CVE:	CVE-2002-1219
Remote:	Yes
Local:	No
Published:	Nov 12 2002 12:00AM
Updated:	Jul 11 2009 07:16PM
Credit:	Discovery of this vulnerability credited to Neel Mehta of ISS X-Force.
Vulnerable:	Sun Solaris 9_x86 Sun Solaris 9 Sun Solaris 8_x86 Sun Solaris 8_sparc Sun Solaris 7.0_x86 Sun Solaris 7.0 Sun Cobalt RaQ XTR SGI IRIX 6.5.18 SGI IRIX 6.5.17 SGI IRIX 6.5.16 SGI IRIX 6.5.15 SGI IRIX 6.5.14 SGI IRIX 6.5.13 SGI IRIX 6.5.12 SGI IRIX 6.5.11 SGI IRIX 6.5.10 SGI IRIX 6.5.9 SGI IRIX 6.5.8 SGI IRIX 6.5.7 SGI IRIX 6.5.6 SGI IRIX 6.5.5 SGI IRIX 6.5.4 SGI IRIX 6.5.3 SGI IRIX 6.5.2 SGI IRIX 6.5.1 SGI IRIX 6.5 SCO Open Server 5.0.7 SCO Open Server 5.0.6 SCO Open Server 5.0.5 Openwall Openwall GNU/*/Linux (Owl)-current OpenBSD OpenBSD 3.2 OpenBSD OpenBSD 3.1 OpenBSD OpenBSD 3.0 ISC BIND 8.3.3 ISC BIND 8.3.2 + FreeBSD FreeBSD 4.6 -RELEASE + FreeBSD FreeBSD 4.6 ISC BIND 8.3.1 ISC BIND 8.3 .0 ISC BIND 8.2.6 + OpenPKG OpenPKG 1.0 + Trustix Secure Linux 1.5 + Trustix Secure Linux 1.2 ISC BIND 8.2.5 + OpenPKG OpenPKG 1.0 + Trustix Secure Linux 1.5 ISC BIND 8.2.4 + SuSE Linux 8.1 + SuSE Linux 8.0 + SuSE Linux 7.3 sparc + SuSE Linux 7.3 ppc + SuSE Linux 7.3 + Trustix Secure Linux 1.2 ISC BIND 8.2.3 + Caldera OpenLinux Server 3.1.1 + Caldera OpenLinux Server 3.1 + Caldera OpenLinux Workstation 3.1.1 + Caldera OpenLinux Workstation 3.1 + Debian Linux 2.2 + EnGarde Secure Linux 1.0.1 + Immunix Immunix OS 7+ ISC BIND 8.2.2 ISC BIND 8.2.1 ISC BIND 8.2 - Caldera OpenLinux 2.2 - Caldera OpenLinux 1.3 - Caldera UnixWare 7.1.1 - IBM AIX 4.3.3 - IBM AIX 4.3.2 - IBM AIX 4.3.1 - IBM AIX 4.3 - Redhat Linux 6.1 i386 - Redhat Linux 6.0 - Redhat Linux 5.2 i386 - Redhat Linux 5.1 - Redhat Linux 5.0 - Redhat Linux 4.2 - Redhat Linux 4.1 - Redhat Linux 4.0 - Slackware Linux 4.0 ISC BIND 4.9.10 OW2 ISC BIND 4.9.10 ISC BIND 4.9.9 ISC BIND 4.9.8 ISC BIND 4.9.7 + HP HP-UX 11.0 4 + HP HP-UX 11.0 + HP HP-UX 10.24 + HP HP-UX 10.20 + HP HP-UX 10.10 ISC BIND 4.9.6 ISC BIND 4.9.5 ISC BIND 4.9.4 ISC BIND 4.9.3 ISC BIND 4.9 HP HP-UX 11.22 HP HP-UX 11.11 HP HP-UX 11.0 4 HP HP-UX 11.0 HP HP-UX 10.24 HP HP-UX 10.20 HP HP-UX 10.10 FreeBSD FreeBSD 4.7 FreeBSD FreeBSD 4.6 FreeBSD FreeBSD 4.5 FreeBSD FreeBSD 4.4 Compaq Tru64 5.1 b PK1 (BL1) Compaq Tru64 5.1 b Compaq Tru64 5.1 a PK3 (BL3) Compaq Tru64 5.1 a PK2 (BL2) Compaq Tru64 5.1 a PK1 (BL1) Compaq Tru64 5.1 a Compaq Tru64 5.1 PK5 (BL19) Compaq Tru64 5.1 PK4 (BL18) Compaq Tru64 5.1 PK3 (BL17) Compaq Tru64 5.1 Compaq Tru64 5.0 a PK3 (BL17) Compaq Tru64 5.0 a Compaq Tru64 4.0 g PK3 (BL17) Compaq Tru64 4.0 g Compaq Tru64 4.0 f PK7 (BL18) Compaq Tru64 4.0 f PK6 (BL17) Compaq Tru64 4.0 f Astaro Security Linux 3.2 11 Astaro Security Linux 3.2 10 Astaro Security Linux 3.2 00 Astaro Security Linux 2.0 30 Astaro Security Linux 2.0 27 Astaro Security Linux 2.0 26 Astaro Security Linux 2.0 25 Astaro Security Linux 2.0 24 Astaro Security Linux 2.0 23 Astaro Security Linux 2.0 16 Apple Mac OS X 10.2 Apple Mac OS X 10.1 Apple Mac OS X 10.0

Not Vulnerable:	SGI IRIX 6.5.19 ISC BIND 9.2.1 + Caldera OpenUnix 8.0 + MandrakeSoft Single Network Firewall 7.2 + Mandriva Linux Mandrake 7.2 + SCO Unixware 7.1.3 ISC BIND 9.2 + HP HP-UX 11.11 + HP HP-UX 11.11 + HP HP-UX 11.0 + HP HP-UX 11.0 + Mandriva Linux Mandrake 8.2 + Mandriva Linux Mandrake 8.2 + Mandriva Linux Mandrake 8.1 ia64 + Mandriva Linux Mandrake 8.1 ia64 + Mandriva Linux Mandrake 8.1 + Mandriva Linux Mandrake 8.1 + Redhat Linux 7.3 i386 + Redhat Linux 7.3 + Redhat Linux 7.3 ISC BIND 9.1.3 + Redhat Linux 7.2 ia64 + Redhat Linux 7.2 i686 + Redhat Linux 7.2 i586 + Redhat Linux 7.2 i386 + Redhat Linux 7.2 + SuSE Linux 8.0 i386 + SuSE Linux 8.0 + SuSE Linux 7.3 sparc + SuSE Linux 7.3 ppc + SuSE Linux 7.3 i386 + SuSE Linux 7.3 ISC BIND 9.1.2 + SuSE Linux 7.2 i386 + SuSE Linux 7.2 ISC BIND 9.1.1 + Mandriva Linux Mandrake 8.0 ppc + Mandriva Linux Mandrake 8.0 ISC BIND 9.1 + Caldera OpenUnix 8.0 + HP Secure OS software for Linux 1.0 + Redhat Linux 7.1 ia64 + Redhat Linux 7.1 i386 + Redhat Linux 7.1 alpha + Redhat Linux 7.1 + SuSE Linux 7.1 x86 + SuSE Linux 7.1 sparc + SuSE Linux 7.1 ppc + SuSE Linux 7.1 alpha + SuSE Linux 7.1 ISC BIND 9.0 + SuSE Linux 7.0 sparc + SuSE Linux 7.0 ppc + SuSE Linux 7.0 i386 + SuSE Linux 7.0 alpha + SuSE Linux 7.0 ISC BIND 8.3.4 + Apple Mac OS X 10.2.4 + Apple Mac OS X 10.2.3 + Apple Mac OS X Server 10.2.4 + Apple Mac OS X Server 10.2.3 + S.u.S.E. Linux Personal 8.2 ISC BIND 8.2.7 ISC BIND 4.9.11 Astaro Security Linux 3.2 12

Exploit / POC

ISC BIND SIG Cached Resource Record Buffer Overflow Vulnerability

Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Solution / Fix

ISC BIND SIG Cached Resource Record Buffer Overflow Vulnerability

Solution:
Sun have released a security update to address this issue in the RAQ XTR. Please see references section for further details. A fix is linked below.

SCO has released a security advisory to address this issue in OpenServer (CSSA-2003-SCO.17.1). Further information relating to obtaining and applying fixes can be found in the referenced advisory.

HP has released a revised advisory (HPSBUX0208-209(rev.15)) to address this issue in affected HP-UX systems. Customers who are affected by this issue are advised to apply appropriate patches. Further information regarding obtaining and applying patches is available in the referenced advisory.

HP has released an updated advisory HPSBUX0208-209(rev.14) for HP-UX systems. Preliminary updates for HP-UX 11 and 11.11 are available. Further information on obtaining and applying fixes is available in the referenced HP advisory (HPSBUX0208-209).

ISC has stated that new versions of BIND 4 and 8 will be available in the near future. Users are advised to contact ISC for further details. ISC has released patches for some versions.

FreeBSD has released an advisory. Users are advised to update systems to the 4.7-STABLE branch or to the appropriate RELENG_4_x branch dated after the correction date. A patch is also available. Further details on obtaining and applying fixes can be found in the referenced advisory.

EnGarde Secure Linux has released an advisory. Further information about obtaining and applying fixes can be found in the referenced advisory.

SuSE has released an advisory. Updated packages are available. Further information about obtaining and applying fixes can be found in the referenced advisory.

Mandrake has released an advisory (MDKSA-2002:077) containing fix information. Further information about obtaining and applying fixes can be found in the referenced advisory.

Debian has released an advisory (DSA 196-1) containing fix information. Further information about obtaining and applying fixes can be found in the referenced advisory.

Conectiva has released an advisory (CLA-2002:546) containing fix information. Further information about obtaining and applying fixes can be found in the referenced advisory.

OpenPKG has released an advisory containing upgrades for this and other vulnerabilities. OpenPKG 1.0 users are advised to upgrade to the bind-8.2.6-1.0.2 package or later. OpenPKG 1.1 users are advised to upgrade to the bind8-8.3.3-1.1.1 package or later. OpenPKG CURRENT users are advised to upgrade to the bind8-8.3.3-20021114 package or later. bind-9.2.1-1.1.0 packages are also available for OpenPKG 1.1/CURRENT. Further details on obtaining and applying fixes can be found in the attached reference.

This issue is present in Astaro Security Linux versions prior to Up2Date 3.212. Up2Date 3.211 is the minimum version required for users to install Up2Date 3.212.

Trustix Secure Linux has released an advisory. Further details about obtaining and applying fixes can be found in the referenced advisory.

NetBSD has released an advisory. Details about upgrading vulnerable packages through CVS can be found in the referenced advisory.

SGI has released an advisory, and advised vulnerable users to apply patch 4881 to execute the server in a chroot environment. This patch does not fix the vulnerability, but does limit the impact of exploitation. SGI has reported this vulnerability will be fixed in IRIX 6.5.19.

SCO has released an advisory and fixes for OpenLinux (CSSA-2002-059.0). Users are advised to upgrade as soon as possible.

SCO has released a security advisory for UnixWare (CSSA-2003-SCO.2). Information, on obtaining and applying fixes, can be gathered from the reverenced advisory.

Sun recommends disabling recursion if not needed. Patches are available.

Apple has patched this issue in MacOS X versions 10.2.3 and later. See referenced web page for additional details.

Fixes are available:

OpenBSD OpenBSD 3.2