tech-security archive
[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index][Old Index]
NetBSD Security Advisory 2008-009: BIND cache poisoning
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
NetBSD Security Advisory 2008-009
=================================
Topic: BIND cache poisoning
Version: NetBSD-current: affected
NetBSD 4.0: affected
NetBSD 3.1.*: affected
NetBSD 3.1: affected
NetBSD 3.0.*: affected
NetBSD 3.0: affected
bind 8.x packages
bind 9.4.x packages prior to 9.4.2pl1
bind 9.5.x packages prior to 9.5.0pl1
Severity: Remote DNS cache poisoning
Fixed: NetBSD-current: July 10, 2008
NetBSD-4-0 branch: July 16, 2008
(4.0.1 will include the fix)
NetBSD-4 branch: July 16, 2008
(4.1 will include the fix)
NetBSD-3-1 branch: July 24, 2008
(3.1.2 will include the fix)
NetBSD-3-0 branch: July 24, 2008
(3.0.4 will include the fix)
NetBSD-3 branch: July 24, 2008
(3.2 will include the fix)
pkgsrc: bind-9.4.2pl1 corrects the issue
bind-9.5.0pl1 corrects the issue
Abstract
========
Deficiencies in the DNS protocol can allow attackers to inject poisoned
responses into a caching nameserver.
This vulnerability has been assigned CVE reference CVE-2008-1447 and CERT
Vulnerability Note VU#800113.
Technical Details
=================
New cache poisoning techniques have been discovered by Dan Kaminsky which
allow an attacker to poison a cache. This vulnerability can be exploited
by an attacker in a short amount of time.
For further information see:
http://www.kb.cert.org/vuls/id/800113
http://www.isc.org/sw/bind/forgery-resilience.php
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1447
http://www.isc.org/sw/bind/docs/FAQ-about-random-query-issue.php
Solutions and Workarounds
=========================
It is recommended that NetBSD users of vulnerable versions update their
binaries. If you are unable to update BIND in the base operating system
there are fixed versions in pkgsrc that can be used.
The following points should be taken into consideration when assessing
this issue:
* Do not hard code a query source port using the 'query-source' and/or
'query-source-v6' options. This option was set by default in netbsd-4,
netbsd-4-0 and HEAD branches. Please check your named.conf(5) to ensure
that this option is not used. This option has already been removed from
the default configuration in HEAD as of July 23, 2008 and netbsd-4 and
netbsd-4-0 as of July 24, 2008.
* You are only impacted by this issue if you are running BIND as a
caching resolver.
* For the fixed versions of BIND, ISC have stated that there is a
noticeable impact on the performance of BIND caching resolvers with
high query rates. See
http://www.isc.org/index.pl?/sw/bind/bind-security.php
for more information. Later releases of BIND may improve this situation.
* Devices performing Network Address Translation (NAT), more specifically
Port Address Translation (PAT) can either decrease or increase the
randomness of source ports used for DNS queries. ipfilter(8) currently
by design assigns ports in sequence when doing port mapping. The work
around for this is to not do port translation on DNS traffic if that
traffic has already been randomised.
e.g. If you have:
map foo0 a/b -> c/d portmap tcp/udp 10000:20000
then you need to do this:
map foo0 from a/b to any port = 53 -> c/d tcp/udp
map foo0 a/b -> c/d portmap tcp/udp 10000:20000
A patch has been committed to HEAD that makes ipfilter(8) use random
port numbers by default. Pullups have also been requested to the
netbsd-4, netbsd-4-0, netbsd-3, netbsd-3-0 and netbsd-3-1 branches.
This advisory will be updated with further instructions on how to
apply this update once it becomes available in all release branches.
The following instructions describe how to upgrade your bind binaries by
updating your source tree and rebuilding and installing a new version of
bind.
* NetBSD-current:
Systems running NetBSD-current dated from before 2008-07-10
should be upgraded to NetBSD-current dated 2008-07-11 or later.
The following directories need to be updated from the
netbsd-current CVS branch (aka HEAD):
dist/bind
usr.sbin/bind
lib/libbind9
lib/libdns
lib/libisc
lib/libisccc
lib/libisccfg
lib/liblwres
To update from CVS, re-build, and re-install bind:
# cd src
# cvs update -d -P dist/bind usr.sbin/bind lib/libbind9 \
lib/libdns lib/libisc lib/libisccc lib/libisccfg \
lib/liblwres
# cd lib/libpthread
# make USETOOLS=no cleandir dependall
# cd ../lib/libcrypt
# make USETOOLS=no cleandir dependall
# cd ../lib/libcrypto
# make USETOOLS=no cleandir dependall
# cd ../libbind9
# make USETOOLS=no cleandir dependall
# make USETOOLS=no install
# cd ../libdns
# make USETOOLS=no cleandir dependall
# make USETOOLS=no install
# cd ../libisc
# make USETOOLS=no cleandir dependall
# make USETOOLS=no install
# cd ../libisccc
# make USETOOLS=no cleandir dependall
# make USETOOLS=no install
# cd ../libisccfg
# make USETOOLS=no cleandir dependall
# make USETOOLS=no install
# cd ../liblwres
# make USETOOLS=no cleandir dependall
# make USETOOLS=no install
# cd ../../usr.sbin/bind
# make USETOOLS=no cleandir dependall
# make USETOOLS=no install
* NetBSD 4.*:
Systems running NetBSD 4.* sources dated from before
2008-07-16 should be upgraded from NetBSD 4.* sources dated
2008-07-17 or later.
The following directories need to be updated from the
netbsd-4 or netbsd-4-0 branches:
dist/bind
usr.sbin/bind
To update from CVS, re-build, and re-install bind:
# cd src
# cvs update -r <branch_name> -d -P dist/bind
# cvs update -r <branch_name> -d -P usr.sbin/bind
# cd usr.sbin/bind
# make USETOOLS=no cleandir dependall
# make USETOOLS=no install
* NetBSD 3.*:
Systems running NetBSD 3.* sources dated from before
2008-07-24 should be upgraded from NetBSD 3.* sources dated
2008-07-25 or later.
The following directories need to be updated from the
netbsd-3, netbsd-3-0 or netbsd-3-1 branches:
dist/bind
usr.sbin/bind
To update from CVS, re-build, and re-install bind:
# cd src
# cvs update -r <branch_name> -d -P dist/bind
# cvs update -r <branch_name> -d -P usr.sbin/bind
# cd usr.sbin/bind
# make USETOOLS=no cleandir dependall
# make USETOOLS=no install
Thanks To
=========
Christos Zoulas, Greg Troxel, Jeremy C. Reed, Havard Eidnes and Manuel Bouyer
for initial patches and testing on various releases.
Dan Kaminsky is credited with discovering this issue.
Revision History
================
2008-07-25 Initial release
More Information
================
Advisories may be updated as new information becomes available.
The most recent version of this advisory (PGP signed) can be found at
ftp://ftp.NetBSD.org/pub/NetBSD/security/advisories/NetBSD-SA2008-009.txt.asc
Information about NetBSD and NetBSD security can be found at
http://www.NetBSD.org/ and http://www.NetBSD.org/Security/.
Copyright 2008, The NetBSD Foundation, Inc. All Rights Reserved.
Redistribution permitted only in full, unmodified form.
$NetBSD: NetBSD-SA2008-009.txt,v 1.2 2008/07/24 23:58:35 adrianp Exp $
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (NetBSD)
iQCVAwUBSIkXID5Ru2/4N2IFAQJHRwP/VDWSXjntWY85Y9rdDOmO5wIjAgV+IjTd
L9GWzvAfkh3JIJnMPtf1Z3P3N+2omNzcrra1chW5A+9nPaSmKLmq9FhT21sNXCD/
FkW/jt+6UdtkdSUXUI+OcnBj7ngUqLT8E5YGbHxg/Tc02vtYunHSWD0fsX80RbcQ
qU4lbWImAes=
=XDy8
-----END PGP SIGNATURE-----
Home |
Main Index |
Thread Index |
Old Index