ISC BIND named SIGINT and SIGIOT symlink Vulnerability

Bugtraq ID:	80
Class:	Access Validation Error
CVE:	CVE-1999-1499
Remote:	No
Local:	No
Published:	Apr 10 1998 12:00AM
Updated:	Jul 11 2009 12:16AM
Credit:	Made public in ""BIND 4.9.7 named follows symlinks, clobbers anything." by Joe H. <[email protected]> to BugTraq on April 10, 1998.
Vulnerable:	ISC BIND 4.9.7 -T1B
Not Vulnerable:	ISC BIND 8.1.2 + HP HP-UX 11.11 + HP HP-UX 11.0 ISC BIND 8.1.1 ISC BIND 8.1 ISC BIND 4.9.7 + HP HP-UX 11.0 4 + HP HP-UX 11.0 + HP HP-UX 10.24 + HP HP-UX 10.20 + HP HP-UX 10.10

ISC BIND named SIGINT and SIGIOT symlink Vulnerability

The named daemon will dump the named database to /var/tmp/named_dump.db
when it receives a SIGINT signal. It does not check for symbolic links while
doing so and can be made to overwrite any file in the system.

The named daemons will append named statistics to /var/tmp/named.stats
when it receives a SIGIOT signal. It does not check for symbolic links while
doing so and ca be made to append to any file in the system.

BIND 8.1.x is not vulnerable as it uses a private directory specified in
named.{boot,conf} for temporary and debug dumps.

ISC BIND named SIGINT and SIGIOT symlink Vulnerability

Solution:
Upgrade to BIND 4.9.7, BIND 8.1.x or apply the following
patch.

*** named/ns_init.c.000 Mon Jun 2 06:34:35 1997
--- named/ns_init.c Sun Apr 12 13:12:05 1998
***************
*** 560,567 ****
* We will always transfer this zone again
* after a reload.
*/
! sprintf(buf, "%s/NsTmp%ld.%d", _PATH_TMPDIR,
! (long)getpid(), tmpnum++);
source = savestr(buf);
zp->z_flags |= Z_TMP_FILE;
} else
--- 560,567 ----
* We will always transfer this zone again
* after a reload.
*/
! sprintf(buf, "NsTmp%ld.%d", (long)getpid(),
! tmpnum++);
source = savestr(buf);
zp->z_flags |= Z_TMP_FILE;
} else
*** named/ns_main.c.000 Mon Jun 2 06:34:36 1997
--- named/ns_main.c Sun Apr 12 14:51:45 1998
***************
*** 1463,1469 ****
dprintf(1, (ddt, "sigprof()\n"));
if (fork() == 0)
{
- (void) chdir(_PATH_TMPDIR);
exit(1);
}
errno = save_errno;
--- 1463,1468 ----
*** named/pathnames.h.000 Thu Dec 15 17:24:22 1994
--- named/pathnames.h Sat Apr 11 10:57:45 1998
***************
*** 74,88 ****
#ifndef _PATH_XFER
# define _PATH_XFER "/usr/libexec/named-xfer"
#endif
! #define _PATH_DEBUG "/var/tmp/named.run"
! #define _PATH_DUMPFILE "/var/tmp/named_dump.db"
#ifndef _PATH_PIDFILE
# define _PATH_PIDFILE "/var/run/named.pid"
#endif
! #define _PATH_STATS "/var/tmp/named.stats"
! #define _PATH_XFERTRACE "/var/tmp/xfer.trace"
! #define _PATH_XFERDDT "/var/tmp/xfer.ddt"
! #define _PATH_TMPXFER "/var/tmp/xfer.ddt.XXXXXX"
#define _PATH_TMPDIR "/var/tmp"

#else /* BSD */
--- 74,88 ----
#ifndef _PATH_XFER
# define _PATH_XFER "/usr/libexec/named-xfer"
#endif
! #define _PATH_DEBUG "named.run"
! #define _PATH_DUMPFILE "named_dump.db"
#ifndef _PATH_PIDFILE
# define _PATH_PIDFILE "/var/run/named.pid"
#endif
! #define _PATH_STATS "named.stats"
! #define _PATH_XFERTRACE "xfer.trace"
! #define _PATH_XFERDDT "xfer.ddt"
! #define _PATH_TMPXFER "xfer.ddt.XXXXXX"
#define _PATH_TMPDIR "/var/tmp"

#else /* BSD */
***************
*** 92,106 ****
#ifndef _PATH_XFER
# define _PATH_XFER "/etc/named-xfer"
#endif
! #define _PATH_DEBUG "/usr/tmp/named.run"
! #define _PATH_DUMPFILE "/usr/tmp/named_dump.db"
#ifndef _PATH_PIDFILE
# define _PATH_PIDFILE "/etc/named.pid"
#endif
! #define _PATH_STATS "/usr/tmp/named.stats"
! #define _PATH_XFERTRACE "/usr/tmp/xfer.trace"
! #define _PATH_XFERDDT "/usr/tmp/xfer.ddt"
! #define _PATH_TMPXFER "/usr/tmp/xfer.ddt.XXXXXX"
#define _PATH_TMPDIR "/usr/tmp"
#endif /* BSD */

--- 92,106 ----
#ifndef _PATH_XFER
# define _PATH_XFER "/etc/named-xfer"
#endif
! #define _PATH_DEBUG "named.run"
! #define _PATH_DUMPFILE "named_dump.db"
#ifndef _PATH_PIDFILE
# define _PATH_PIDFILE "/etc/named.pid"
#endif
! #define _PATH_STATS "named.stats"
! #define _PATH_XFERTRACE "xfer.trace"
! #define _PATH_XFERDDT "xfer.ddt"
! #define _PATH_TMPXFER "xfer.ddt.XXXXXX"
#define _PATH_TMPDIR "/usr/tmp"
#endif /* BSD */

ISC BIND named SIGINT and SIGIOT symlink Vulnerability

References: