NetBSD-Announce archive

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index][Old Index]

NetBSD Security Advisory 2011-006: BIND DoS via packet with rrtype zero

Hash: SHA1

                 NetBSD Security Advisory 2011-006

Topic:          BIND DoS via packet with rrtype zero

Version:        NetBSD-current:         affected prior to 20110706
                NetBSD 5.1:             affected prior to 20110708
                NetBSD 5.0:             affected prior to 20110708
                NetBSD 4.0.*:           affected prior to 20110716
                NetBSD 4.0:             affected prior to 20110716
                pkgsrc:                 net/bind96, net/bind97 and net/bind98
                                        packages prior to 20110706

Severity:       Denial of Service

Fixed:          NetBSD-current:         Jul 6th, 2011
                NetBSD-5-1 branch:      Jul 8th, 2011
                NetBSD-5-0 branch:      Jul 8th, 2011
                NetBSD-5 branch:        Jul 8th, 2011
                NetBSD-4-0 branch:      Jul 16th, 2011
                NetBSD-4 branch:        Jul 16th, 2011
                pkgsrc net/bind96:      bind- corrects this issue
                pkgsrc net/bind97:      bind-9.7.3pl3 corrects this issue
                pkgsrc net/bind98:      bind-9.8.0pl4 corrects this issue

Please note that NetBSD releases prior to 4.0 are no longer supported.
It is recommended that all users upgrade to a supported release.


Packets with rrtype zero can cause named to crash.

This vulnerability has been assigned CVE-2011-2464.

Technical Details

A defect in the affected BIND 9 versions allows an attacker to remotely
cause the "named" process to exit by sending a specially crafted packet.
This defect affects both recursive and authoritative servers.
The code location of the defect makes it impossible to protect BIND
using ACLs configured within named.conf or by disabling any features
at compile-time or run-time.

A remote attacker would need to be able to send a specially crafted packet
directly to a server running a vulnerable version of BIND.
There is also the potential for an indirect attack via malware that is
inadvertently installed and run, where infected machines have direct
access to an organization's nameservers.

Note: CVE-2011-2465 is also fixed with this update, CVE-2011-0414,
CVE-2011-1907 and  CVE-2011-1910 have been fixed previously but weren't
of sufficient impact to warrant an advisory.

Solutions and Workarounds

We suggest fixing this vulnerability by using the current net/bind98 or
net/bind97 pkgsrc package instead of the in-system bind until the entire
system can be updated (eg to the next security/critical release, or a
binary snapshot from from past
the fix date).

Thanks To

Thanks to the Internet Systems Consortium for reporting this
vulnerability and providing fixed versions.

Revision History

        2011-07-26      Initial release

More Information

Advisories may be updated as new information becomes available.
The most recent version of this advisory (PGP signed) can be found at

Information about NetBSD and NetBSD security can be found at and .

Copyright 2011, The NetBSD Foundation, Inc.  All Rights Reserved.
Redistribution permitted only in full, unmodified form.

$NetBSD: NetBSD-SA2011-006.txt,v 1.2 2011/07/25 22:17:18 tonnerre Exp $

Version: GnuPG v1.4.11 (GNU/Linux)


Home | Main Index | Thread Index | Old Index