tech-security archive

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index][Old Index]

NetBSD Security Advisory 2008-009: BIND cache poisoning



-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


                 NetBSD Security Advisory 2008-009
                 =================================

Topic:          BIND cache poisoning

Version:        NetBSD-current:         affected
                NetBSD 4.0:             affected
                NetBSD 3.1.*:           affected
                NetBSD 3.1:             affected
                NetBSD 3.0.*:           affected
                NetBSD 3.0:             affected
                                        bind 8.x packages
                                        bind 9.4.x packages prior to 9.4.2pl1
                                        bind 9.5.x packages prior to 9.5.0pl1

Severity:       Remote DNS cache poisoning

Fixed:          NetBSD-current:         July 10, 2008
                NetBSD-4-0 branch:      July 16, 2008
                        (4.0.1 will include the fix)
                NetBSD-4 branch:        July 16, 2008
                        (4.1 will include the fix)
                NetBSD-3-1 branch:      July 24, 2008
                        (3.1.2 will include the fix)
                NetBSD-3-0 branch:      July 24, 2008
                        (3.0.4 will include the fix)
                NetBSD-3 branch:        July 24, 2008
                        (3.2 will include the fix)
                pkgsrc:                 bind-9.4.2pl1 corrects the issue
                                        bind-9.5.0pl1 corrects the issue

Abstract
========

Deficiencies in the DNS protocol can allow attackers to inject poisoned
responses into a caching nameserver.

This vulnerability has been assigned CVE reference CVE-2008-1447 and CERT
Vulnerability Note VU#800113.


Technical Details
=================

New cache poisoning techniques have been discovered by Dan Kaminsky which
allow an attacker to poison a cache.  This vulnerability can be exploited
by an attacker in a short amount of time.

For further information see:

  http://www.kb.cert.org/vuls/id/800113
  http://www.isc.org/sw/bind/forgery-resilience.php
  http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1447
  http://www.isc.org/sw/bind/docs/FAQ-about-random-query-issue.php


Solutions and Workarounds
=========================

It is recommended that NetBSD users of vulnerable versions update their
binaries.  If you are unable to update BIND in the base operating system
there are fixed versions in pkgsrc that can be used.

The following points should be taken into consideration when assessing
this issue:

  * Do not hard code a query source port using the 'query-source' and/or
    'query-source-v6' options.  This option was set by default in netbsd-4, 
    netbsd-4-0 and HEAD branches.  Please check your named.conf(5) to ensure
    that this option is not used.  This option has already been removed from
    the default configuration in HEAD as of July 23, 2008 and netbsd-4 and 
    netbsd-4-0 as of July 24, 2008.

  * You are only impacted by this issue if you are running BIND as a
    caching resolver.

  * For the fixed versions of BIND, ISC have stated that there is a
    noticeable impact on the performance of BIND caching resolvers with
    high query rates.  See

      http://www.isc.org/index.pl?/sw/bind/bind-security.php 

    for more information.  Later releases of BIND may improve this situation.

  * Devices performing Network Address Translation (NAT), more specifically 
    Port Address Translation (PAT) can either decrease or increase the 
    randomness of source ports used for DNS queries. ipfilter(8) currently 
    by design assigns ports in sequence when doing port mapping.  The work 
    around for this is to not do port translation on DNS traffic if that 
    traffic has already been randomised.
    e.g. If you have:

      map foo0 a/b -> c/d portmap tcp/udp 10000:20000

    then you need to do this:

      map foo0 from a/b to any port = 53 -> c/d tcp/udp
      map foo0 a/b -> c/d portmap tcp/udp 10000:20000 

    A patch has been committed to HEAD that makes ipfilter(8) use random
    port numbers by default.  Pullups have also been requested to the
    netbsd-4, netbsd-4-0, netbsd-3, netbsd-3-0 and netbsd-3-1 branches.
    This advisory will be updated with further instructions on how to
    apply this update once it becomes available in all release branches.

The following instructions describe how to upgrade your bind binaries by
updating your source tree and rebuilding and installing a new version of
bind.

* NetBSD-current:

        Systems running NetBSD-current dated from before 2008-07-10
        should be upgraded to NetBSD-current dated 2008-07-11 or later.

        The following directories need to be updated from the
        netbsd-current CVS branch (aka HEAD):

                dist/bind
                usr.sbin/bind
                lib/libbind9
                lib/libdns
                lib/libisc
                lib/libisccc
                lib/libisccfg
                lib/liblwres

        To update from CVS, re-build, and re-install bind:

                # cd src
                # cvs update -d -P dist/bind usr.sbin/bind lib/libbind9 \
                        lib/libdns lib/libisc lib/libisccc lib/libisccfg \
                        lib/liblwres
                # cd lib/libpthread
                # make USETOOLS=no cleandir dependall
                # cd ../lib/libcrypt
                # make USETOOLS=no cleandir dependall
                # cd ../lib/libcrypto
                # make USETOOLS=no cleandir dependall
                # cd ../libbind9
                # make USETOOLS=no cleandir dependall
                # make USETOOLS=no install
                # cd ../libdns 
                # make USETOOLS=no cleandir dependall
                # make USETOOLS=no install
                # cd ../libisc
                # make USETOOLS=no cleandir dependall
                # make USETOOLS=no install
                # cd ../libisccc
                # make USETOOLS=no cleandir dependall
                # make USETOOLS=no install
                # cd ../libisccfg
                # make USETOOLS=no cleandir dependall
                # make USETOOLS=no install
                # cd ../liblwres
                # make USETOOLS=no cleandir dependall
                # make USETOOLS=no install
                # cd ../../usr.sbin/bind
                # make USETOOLS=no cleandir dependall
                # make USETOOLS=no install

* NetBSD 4.*:

        Systems running NetBSD 4.* sources dated from before
        2008-07-16 should be upgraded from NetBSD 4.* sources dated
        2008-07-17 or later.

        The following directories need to be updated from the
        netbsd-4 or netbsd-4-0 branches:

                dist/bind
                usr.sbin/bind

        To update from CVS, re-build, and re-install bind:

                # cd src
                # cvs update -r <branch_name> -d -P dist/bind 
                # cvs update -r <branch_name> -d -P usr.sbin/bind
                # cd usr.sbin/bind
                # make USETOOLS=no cleandir dependall
                # make USETOOLS=no install

* NetBSD 3.*:

        Systems running NetBSD 3.* sources dated from before
        2008-07-24 should be upgraded from NetBSD 3.* sources dated
        2008-07-25 or later.

        The following directories need to be updated from the
        netbsd-3, netbsd-3-0 or netbsd-3-1 branches:

                dist/bind
                usr.sbin/bind

        To update from CVS, re-build, and re-install bind:

                # cd src
                # cvs update -r <branch_name> -d -P dist/bind 
                # cvs update -r <branch_name> -d -P usr.sbin/bind
                # cd usr.sbin/bind
                # make USETOOLS=no cleandir dependall
                # make USETOOLS=no install


Thanks To
=========

Christos Zoulas, Greg Troxel, Jeremy C. Reed, Havard Eidnes and Manuel Bouyer
for initial patches and testing on various releases.
Dan Kaminsky is credited with discovering this issue.


Revision History
================

        2008-07-25      Initial release


More Information
================

Advisories may be updated as new information becomes available.
The most recent version of this advisory (PGP signed) can be found at 
  ftp://ftp.NetBSD.org/pub/NetBSD/security/advisories/NetBSD-SA2008-009.txt.asc

Information about NetBSD and NetBSD security can be found at
http://www.NetBSD.org/ and http://www.NetBSD.org/Security/.


Copyright 2008, The NetBSD Foundation, Inc.  All Rights Reserved.
Redistribution permitted only in full, unmodified form.

$NetBSD: NetBSD-SA2008-009.txt,v 1.2 2008/07/24 23:58:35 adrianp Exp $

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (NetBSD)

iQCVAwUBSIkXID5Ru2/4N2IFAQJHRwP/VDWSXjntWY85Y9rdDOmO5wIjAgV+IjTd
L9GWzvAfkh3JIJnMPtf1Z3P3N+2omNzcrra1chW5A+9nPaSmKLmq9FhT21sNXCD/
FkW/jt+6UdtkdSUXUI+OcnBj7ngUqLT8E5YGbHxg/Tc02vtYunHSWD0fsX80RbcQ
qU4lbWImAes=
=XDy8
-----END PGP SIGNATURE-----




Home | Main Index | Thread Index | Old Index