CERT^® Advisory CA-2002-31 Multiple Vulnerabilities in BIND

A complete revision history can be found at the end of this file.

Systems Affected

• Systems running various versions of BIND 4 and BIND 8

Because the normal operation of most services on the Internet depends on the proper operation of DNS servers, other services could be affected if these vulnerabilities are exploited.

Overview

Multiple vulnerabilities with varying impacts have been found in BIND, the popular domain name server and client library software package from the Internet Software Consortium (ISC).

Some of these vulnerabilities may allow remote attackers to execute arbitrary code with the privileges of the user running named, (typically root), or with the privileges of vulnerable client applications. The other vulnerabilities will allow remote attackers to disrupt the normal operation of DNS name service running on victim servers.

I. Description

Multiple vulnerabilities have been found in BIND (Berkeley Internet Name Domain). One of these vulnerabilities (VU#852283) may allow remote attackers to execute arbitrary code with the privileges of the user running named, typically root. Other vulnerabilities (VU#229595, VU#581682) may allow remote attackers to disrupt the normal operation of your name server, possibly causing a crash. A vulnerability in the DNS resolver library (VU#844360) may allow remote attackers to execute arbitrary code with the privileges of applications that issue network name or address requests.

BIND DNS Server Vulnerabilities

VU#852283 - Cached malformed SIG record buffer overflow

The following versions of BIND are affected:

- BIND versions 4.9.5 to 4.9.10
- BIND versions 8.1, 8.2 to 8.2.6, and 8.3.0 to 8.3.3

VU#229595 - Overly large OPT record assertion

The following versions of BIND are affected:

- BIND versions 8.3.0 to 8.3.3

VU#581682 - ISC BIND 8 fails to properly de-reference cache SIG RR elements with invalid expiry times from the internal database

ISC's description of this vulnerability states:

It is possible to de-reference a NULL pointer for certain signature expire values.

The following versions of BIND are affected:

- BIND versions 8.2 to 8.2.6
- BIND versions 8.3.0 to 8.3.3.

BIND DNS Resolver Vulnerabilities

VU#844360 - Domain Name System (DNS) stub resolver libraries vulnerable to buffer overflows via network name or address lookups

The stub resolver library in BIND 4 contains buffer overflows in code that handles responses for network name and address requests. Note that these overflows are distinct from the issues discussed in CA-2002-19 and VU#738331.

The following DNS stub resolver libraries are known to be affected:

- BIND 4.9.2 through 4.9.10

VU#852283 - CAN-2002-1219
VU#229595 - CAN-2002-1220
VU#581682 - CAN-2002-1221
VU#844360 - CAN-2002-0029

II. Impact

VU#852283 - Cached malformed SIG record buffer overflow

A remote attacker could execute arbitrary code on the nameserver with the privileges of the named uid, typically root.

VU#229595 - Overly large OPT record assertion

A remote attacker can disrupt the normal operation of your name server, possibly causing a crash.

VU#581682 - ISC BIND 8 fails to properly de-reference cache SIG RR elements with invalid expiry times from the internal database

A remote attacker can disrupt the normal operation of your name server, possibly causing a crash.

VU#844360 - Domain Name System (DNS) stub resolver libraries vulnerable to buffer overflows via network name or address lookups

A remote attacker could execute arbitrary code with the privileges of the application that made the request or cause a denial of service. The attacker would need to control DNS responses possibly by spoofing the responses or by gaining sufficient access to a DNS server.

III. Solution

Apply a patch from your vendor.

Appendix A contains information provided by vendors for this advisory. As vendors report new information to the CERT/CC, we will update this section and note the changes in our revision history. If a particular vendor is not listed below, we have not received their comments. Please contact your vendor directly.

If a vendor patch is not available, you may wish to consider applying the patches ISC has produced:

BIND 8.3.3 - http://www.isc.org/products/BIND/patches/bind833.diff

BIND 8.2.6 - http://www.isc.org/products/BIND/patches/bind826.diff

BIND 4.9.10 - http://www.isc.org/products/BIND/patches/bind4910.diff

Note that DNS resolver libraries can be used by multiple applications on most systems. It may be necessary to upgrade or apply multiple patches and then recompile statically linked applications.

Applications that are statically linked must be recompiled using patched resolver libraries. Applications that are dynamically linked do not need to be recompiled; however, running services need to be restarted in order to use the patched resolver libraries.

System administrators should consider the following process when addressing this issue:

1. Patch or obtain updated resolver libraries.
2. Restart any dynamically linked services that use the resolver libraries.
3. Recompile any statically linked applications using the patched or updated resolver libraries.

Workarounds

VU#852283 - Cached malformed SIG record buffer overflow

VU#229595 - Overly large OPT record assertion

VU#581682 - ISC BIND 8 fails to properly dereference cache SIG RR elements with invalid expiry times from the internal database

One potential workaround to limit exposure to the vulnerabilities in named is to disable recursion on any nameserver responding to DNS requests made by untrusted systems. As mentioned in Securing an Internet Name Server":

Disabling recursion puts your name servers into a passive mode, telling them never to send queries on behalf of other name servers or resolvers. A totally non-recursive name server is protected from cache poisoning, since it will only answer queries directed to it. It doesn't send queries, and hence doesn't cache any data. Disabling recursion can also prevent attackers from bouncing denial of services attacks off your name server by querying for external zones.

Additional Countermeasures

ISC recommends upgrading to BIND version 9.2.1. BIND version 9.2.1 is available from: http://www.isc.org/products/BIND/bind9.html.

Note that the upgrade from previous versions of BIND may require additional site reconfiguration.

Appendix A. - Vendor Information

This appendix contains information provided by vendors for this advisory. As vendors report new information to the CERT/CC, we will update this section and note the changes in our revision history. If a particular vendor is not listed below, we have not received their comments.

Alcatel

Apple

Conectiva

An advisory about this vulnerability is pending and should be sent to our security mailing list and published in our web site during the day (Nov 14th).

Cray Inc.

Debian GNU/Linux

2002-11-18  Roland McGrath  

	* resolv/nss_dns/dns-network.c (getanswer_r): In BYNAME case, search
	all aliases for one that matches the ".IN-ADDR.ARPA" form.
	Do the parsing inline instead of copying strings and calling
	inet_network, and properly skip all alias names not matching the form.

2002-11-14  Paul Eggert  

	* resolv/nss_dns/dns-network.c (getanswer_r): Check for buffer
	overflow when skipping the question part and when unpacking aliases.

===================================================================
RCS file: /cvs/glibc/libc/resolv/nss_dns/dns-network.c,v
retrieving revision 1.15
retrieving revision 1.17
diff -u -r1.15 -r1.17
--- libc/resolv/nss_dns/dns-network.c	2002/10/17 21:49:12	1.15
+++ libc/resolv/nss_dns/dns-network.c	2002/11/19 06:40:16	1.17
@@ -283,7 +283,15 @@

   /* Skip the question part.  */
   while (question_count-- > 0)
-    cp += __dn_skipname (cp, end_of_message) + QFIXEDSZ;
+    {
+      int n = __dn_skipname (cp, end_of_message);
+      if (n < 0 || end_of_message - (cp + n) < QFIXEDSZ)
+       {
+         __set_h_errno (NO_RECOVERY);
+         return NSS_STATUS_UNAVAIL;
+       }
+      cp += n + QFIXEDSZ;
+    }

   alias_pointer = result->n_aliases = &net_data->aliases[0];
   *alias_pointer = NULL;
@@ -344,64 +352,94 @@
 	      return NSS_STATUS_UNAVAIL;
 	    }
 	  cp += n;
-	  *alias_pointer++ = bp;
-	  n = strlen (bp) + 1;
-	  bp += n;
-	  linebuflen -= n;
-	  result->n_addrtype = class == C_IN ? AF_INET : AF_UNSPEC;
-	  ++have_answer;
+         if (alias_pointer + 2 < &net_data->aliases[MAX_NR_ALIASES])
+           {
+             *alias_pointer++ = bp;
+             n = strlen (bp) + 1;
+             bp += n;
+             linebuflen -= n;
+             result->n_addrtype = class == C_IN ? AF_INET : AF_UNSPEC;
+             ++have_answer;
+           }
 	}
     }

   if (have_answer)
     {
-      char *tmp;
-      int len;
-      char *in, *cp, *rp, *wp;
-      int cnt, first_flag;
-
       *alias_pointer = NULL;
       switch (net_i)
 	{
 	case BYADDR:
-	  result->n_name = result->n_aliases[0];
+	  result->n_name = *result->n_aliases++;
 	  result->n_net = 0L;
-	  break;
-	case BYNAME:
-	  len = strlen (result->n_aliases[0]);
-	  tmp = (char *) alloca (len + 1);
-	  tmp[len] = 0;
-	  wp = &tmp[len - 1];
-
-	  rp = in = result->n_aliases[0];
-	  result->n_name = ans;
-
-	  first_flag = 1;
-	  for (cnt = 0; cnt < 4; ++cnt)
-	    {
-	      char *startp;
+	  return NSS_STATUS_SUCCESS;

-	      startp = rp;
-	      while (*rp != '.')
-		++rp;
-	      if (rp - startp > 1 || *startp != '0' || !first_flag)
-		{
-		  first_flag = 0;
-		  if (cnt > 0)
-		    *wp-- = '.';
-		  cp = rp;
-		  while (cp > startp)
-		    *wp-- = *--cp;
-		}
-	      in = rp + 1;
-	    }
-
-	  result->n_net = inet_network (wp);
+	case BYNAME:
+	  {
+	    char **ap = result->n_aliases++;
+	    while (*ap != NULL)
+	      {
+		/* Check each alias name for being of the forms:
+		   4.3.2.1.in-addr.arpa		= net 1.2.3.4
+		   3.2.1.in-addr.arpa		= net 0.1.2.3
+		   2.1.in-addr.arpa		= net 0.0.1.2
+		   1.in-addr.arpa		= net 0.0.0.1
+		*/
+		uint32_t val = 0;	/* Accumulator for n_net value.  */
+		unsigned int shift = 0; /* Which part we are parsing now.  */
+		const char *p = *ap; /* Consuming the string.  */
+		do
+		  {
+		    /* Match the leading 0 or 0[xX] base indicator.  */
+		    unsigned int base = 10;
+		    if (*p == '0' && p[1] != '.')
+		      {
+			base = 8;
+			++p;
+			if (*p == 'x' || *p == 'X')
+			  {
+			    base = 16;
+			    ++p;
+			    if (*p == '.')
+			      break; /* No digit here.  Give up on alias.  */
+			  }
+			if (*p == '\0')
+			  break;
+		      }
+
+		    uint32_t part = 0; /* Accumulates this part's number.  */
+		    do
+		      {
+			if (isdigit (*p) && (*p - '0' < base))
+			  part = (part * base) + (*p - '0');
+			else if (base == 16 && isxdigit (*p))
+			  part = (part << 4) + 10 + (tolower (*p) - 'a');
+			++p;
+		      } while (*p != '\0' && *p != '.');
+
+		    if (*p != '.')
+		      break;	/* Bad form.  Give up on this name.  */
+
+		    /* Install this as the next more significant byte.  */
+		    val |= part << shift;
+		    shift += 8;
+		    ++p;
+
+		    /* If we are out of digits now, there are two cases:
+		       1. We are done with digits and now see "in-addr.arpa".
+		       2. This is not the droid we are looking for.  */
+		    if (!isdigit (*p) && !strcasecmp (p, "in-addr.arpa"))
+		      {
+			result->n_net = val;
+			return NSS_STATUS_SUCCESS;
+		      }
+
+		    /* Keep going when we have seen fewer than 4 parts.  */
+		  } while (shift < 32);
+	      }
+	  }
 	  break;
 	}
-
-      ++result->n_aliases;
-      return NSS_STATUS_SUCCESS;
     }

   __set_h_errno (TRY_AGAIN);

November 14, 2002: Initial release
November 14, 2002: Added vendor statement for MandrakeSoft
November 14, 2002: Added vendor statement for Cray Inc.
November 14, 2002: Re-worded VU#844360 overview, description, and impact, added indentation
November 14, 2002: Added vendor statement for Microsoft Corporation
November 14, 2002: Added vendor statement for Debian GNU/Linux
November 15, 2002: Added vendor statement for IBM
November 15, 2002: Added vendor statement for MetaSolv
November 15, 2002: Added vendor statement for Sun
November 15, 2002: Added vendor statement for Nortel
November 21, 2002: Added vendor statement for Apple
December 03, 2002: Revised vendor statement for Nortel (note their update was sent on Nov 27, 2002)
December 09, 2002: Revised vendor statement for IBM
February 25, 2003: Added vendor statement for Alcatel
February 26, 2003: Added vendor statement for glibc
February 27, 2003: Updated vendor statement for IBM
April 29, 2003: Added vendor statement for Xerox