Slashdot Mirror
New DoS Vulnerability In All Versions of BIND 9
Icemaann writes "ISC is reporting that a new, remotely exploitable vulnerability has been found in all versions of BIND 9. A specially crafted dynamic update packet will make BIND die with an assertion error. There is an exploit in the wild and there are no access control workarounds. Red Hat claims that the exploit does not affect BIND servers that do not allow dynamic updates, but the ISC post refutes that. This is a high-priority vulnerability and DNS operators will want to upgrade BIND to the latest patch level."
This is very interesting. I'm sure the people behind BIND will scramble to get things sorted out ASAP, but I wonder how long it will take other vendors (Apple, I'm looking at you!) to release a patch.
I do have to wonder about exploits like this that seem initially incredibly serious, yet nothing much comes from them and they don't seem to get exploited to the extent that you might expect they would - this one reminds me of l0pht's famous claim that they can bring down the internet in 30 minutes. If this vulnerability is really as serious as they say, and as easy to exploit as it appears to be then in the wrong hands, this could really be an "internet killer"
Specialist Mac support for creative pros, Melbourne
I don't want to bash BIND but it has had a fair amount of sec issues (well a lot), try unbound or nsd instead http://unbound.nlnetlabs.nl/ http://www.nlnetlabs.nl/projects/nsd/
Well DNS operators do appear to be in a bit of a bind don't they?
Evil people are out to get you.
Was once the day whe a notice like this would kick off a flurry of migrationn plans, compiler scripting, compiling, and restarting servers in the dead of night. (and bonuses to match!)
But now?
# yum -y update && shutdown - r now
Sometimes I pine for the 'good old days'. A little. (ok, hardly at all)
I have no problem with your religion until you decide it's reason to deprive others of the truth.
Good thing I'm using FreeDOS!
According to this document, BIND 9 has issues including being monolithic, having a "Bad Process Model", Hard to Administer and Hard to Hack. That's not a good reputation to have.
To some extent, these issues apply to everything Linux save for the last point. I am waiting for the time these points will not apply to Linux and its associated software.
I must say that understanding BIND's configuration file was not that easy for me at first but after trying several times, I can say I am almost an expert. Things can be made simpler though. A text based interactive system could be of a lot of help. Tools like Webmin come in handy too though they require that a system be running initially.
From the advisory: "Receipt of a specially-crafted dynamic update message to a zone for which the server is the master may cause BIND 9 servers to exit. Testing indicates that the attack packet has to be formulated against a zone for which that machine is a master. Launching the attack against slave zones does not trigger the assert."...
So an obvious workaround is to only expose your slave DNS servers and to not expose your master server to the Internet. That's part of "best common practices" isn't it? You have one master and multiple slaves and you protect that master. Come on, this is pretty simple stuff. Just simple secure DNS practices should mitigate this. Yeah, if you haven't done it that way to begin with, you've got a mess on your hands converting and it's easier to patch. But patch AND fix your configuration.
...to Windows! DOS is just so 80's and 90's it's not funny.
(Suggested mod: +1 funny)
These posts express my own personal views, not those of my employer
Difficult compared to what? DJBDNS is much more difficult to wrangle. It's really not that bad if you attempt to learn it.
Somewhere I think djb is managing to both smile and raise his eyebrows simultaneously.
This is a reason why I want to be able to do LDAP based zone updates.
It's unlikely that, if you're running a DNS server inside of your private network, someone on the outside is going to be able to hit it. But then, like all other vulnerabilities, you combine this one with a couple of other attacks (such as a non-privileged login), and all of the sudden you've got something really dangerous. :-(
Your Servant, B. Baggins
Recent versions of BIND (8+) are not terrible to administer, and have much more reasonable data files. Older version were *really* nasty, and had a data file format so complicated that we invented a dedicated zone-transfer mechanism just so people could send DNS data to each other.
And while djbdns uses an unconventional admin system with lots of environmental variables, that's a one-time setup (that is probably done in large part by your package manager) and the actual data files are dead-simple -- plain text, one record per line, can do DNS lookups at build time, can concatenate files, etc. There are valid complaints to be made about djbdns, but I don't think "difficult to wrangle" is one of them.
It gets restarted automatically. Check system.log.
Only a fool would configure public-facing DNS servers as masters, although I've seen it done. Only the king of the land of fools would put his domain's real DNS master on a public-facing network. Thus, only domains administered by fools should be directly affected. Darwin for teh win!
# yum -y update && shutdown -r now
and pray to FSM that it comes back up.
Anybody want my mod points?
If you're running a serious server you should always do a reboot test after installing any software. I've been burned many times by someone doing a "harmless" installation only to find out 6 months later a critical library was upgraded with an incompatible one (a recent example is expat 2.0) and the server doesn't boot like it should.
Always reboot! Even with the super slow bios you get in servers nowadays it should only take 2 minutes to be back up and running.
I reported a bug *very* similar to this back in Oct, and only now its coming to light? WTF? I submitted this back in january and it was rejected. Ah well. Here's my page on it: http://garion.tzo.com/resume/page2/bind.html
Slashdot is like Playboy: I read it for the articles
Recent versions of BIND (8+) are not terrible to administer
Try configuring dynamic DNS through nsupdate with a shared secret.
If you have an NS key, you can specify the key on the command line, or you can store the key in a file, and pass the filename.
The former is a security risk (as anyone running 'ps' can see your key). The latter? Well, someone decided that it would be a good idea to hard code metadata in the filename (even though the same metadata must be present inside the file too.) Oh, and you need two files, even though it's only using one. Oh, and you need to name the key the same as the zone in your named.conf.
Considering that I've only ever seen that level of idiocy from first year comp-sci majors, I have to wonder at the technical competence of the people in charge of writing BIND.
Your post reads like you'll ask for $20 to show people how THEY TOO CAN SET UP A .HOSTS FILE.
Just saying.
Also, your approach is stupid because I like to use the internet.
Don't forget to set your hosts file to read only. There's bastards out there who will rewrite it for you. Ads. I have a huge hosts file too. But it's mostly for homing out annoyances. Tip: Use Notepad++ for editing your hosts file instead of standard Notepad. The former preserves the lack-of-extent Hosts requires. The latter adds .txt, and you're stuck shuffling file names around. Nice little editor, too.
Do not mock my vision of impractical footwear
For a quick "fix":
iptables -A INPUT -p udp --dport 53 -j DROP -m u32 --u32 '30>>27&0xF=5'
Will block (all) dnsupdate requests.
Sounds like a lot of work when you can just run Treewalk DNS and be done with it.It is fast, uses very little resources (mine is using 5Mb ATM) and never gives a bit of trouble.
ACs don't waste your time replying, your posts are never seen by me.
Does anyone know if CentOS 4 will have an update for BIND to ver 9.4.3-P3, 9.5.1-P3 or 9.6.1-P1?
Any ISP's DNS that mucks about with NXDOMAIN is by definition not standard.
Is it faster for 0.0.0.0 to give you nothing or for 127.0.0.1 to give you a connection refused?
" Your post reads like you'll ask for $20 to show people how THEY TOO CAN SET UP A .HOSTS FILE "
Still cheaper than a $35 domain from Verisign.
Need Mercedes parts ?
Just like I said in my post, I'm talking about ISPs (lookin at YOU charter...) that supply a malicious DNS server.
" Older version were *really* nasty, and had a data file format so complicated... "
Rememeber that this was a product of the early 1980s; Brian Reid, Director of Digital Equipment Corporation's Network Systems Laboratory ("decwrl.uucp") hired a kid, Paul Vixie, to take the buggy Berkley B-tree code and turn it into something resembling professional software. At the time even C was not even close to ubiquitous, Assembler was though and in fact the great majority of code written for the early microprocessor based systems of that era was written in assembly.
So it should not be any great shock that bind config files looked like assembly code, or that the later versions looked like C.
Frankly I found the earlier bind config files much easier to use, and the djbdns config files even easier (once you get used to them) to use, and (much) more importantly, you can write a program to manipulate these datum very easily. It's ugly and complicated with bind data files of any version.
Need Mercedes parts ?
Come on people, still using BIND? Why don't you use djbdns? It's easier to use and has a guarnatee!!!
Until the skies turn blue...
Until the air of freedom strikes us...
While this is true for CentOS (RHEL) and Debian-based distros, it's not universally true for others.
512 MB RAM, 20 GB disk, 200 GB transfer, five datacenters. $19.95/month.
There are excellent alternatives to bind.
For example, i have been using nsd for years.
Super easy to configure. Lacks recursive
resolver tho..
http://www.nlnetlabs.nl/projects/nsd/
Smugness to spare? My smugness was overflowing more than BIND9 buffers.
:).
Great opportunity to vent some smugness today
It could have been worse (and no, I haven't read the article yet). Failing an assertion means that they actually wrote an assertion that did it's job. It's impossible to know without reading the code, but this might have been a remote code execution exploit if they hadn't.
I won't join Slashcott. OTOH, If Beta goes live, I just won't be back until it's fixed. Sorry Dice.
You should really read up on data structures, using a hash map which I guess most DNS-servers use is a LOT faster than searching through a hosts file.
Erik Dalén
I am already updated. Thanks to Debian.
Why on earth is BIND shipping with assertions that cause the entire server to exit when they fail? They should just cause processing of the current request to exit.
BIND is not a typical Linux application. It was developed at Berkeley and shipped with BSD Unix, and later also with Windows.
Not a very clever bit of trolling.
You may hide your master DNS servers but your slaves are probably still master for "localhost".
So, basically, the program can be crashed by a specially-crafted malicious update package, and the designers of the program are asking you to update the program in order to shield yourself from exploitation by updates.
I think there's a joke in there somewhere. Anybody want to give it a shot?
No it doesn't. Why do you lie ? .txt . You can open the existing hosts file by right clicking and selecting "open with" and then choose notepad. It doesn't append .txt to an existing file name.
/etc/hosts which is much quicker than trying to remember where MS hid the file on their OS.
If you create a new file it will append
I don't generally care anyway, as I can vi
Time to let go of that ancient rule that ports under 1024 are root-only.
Religion is what happens when nature strikes and groupthink goes wrong.
My approach isn't stupid in regards to that. Free? That's a "pretty good price", wouldn't YOU say? And, you're also FREE to customize it, & thus, YOUR PERSONALIZED VERSION OF A CUSTOM HOSTS FILE, JUST GOES ALONG WITH YOUR PERSONALIZED SPED UP & SAFER VERSION OF THE INTERNET... &, just as YOU see fit & like, easily. Notepad.exe for instance? My gosh - lol, just "does wonders" here, on this account... lol!
Are you the ghost of Billy Mays?
And this is why asserts should *never* go into production builds of any project. It's fine to have asserts in your debug build, but ALWAYS deal with the unexpected case immediately after your assert (which should be compiled out in release mode).
If you have no way of throwing an error and handling it gracefully back up your call stack (no, you don't always need exceptions for this), then you've done a shit job!
Today's weirdness is tomorrow's reason why. -- Hunter S. Thompson
May I have your contact information? I would like to hire you next time I need to write a come-on for an item I'm trying to peddle :P
Bot Assisted Blogging
Tip: In Notepad.exe if you surround the filename and extension with quote marks (") on your new file it will keep the extension and not append .txt
it's not an article but a security advisory. meaning _if_ you run BIND9 somewhere please do read it. ;-)
"morning is a state of mind
Isn't 0.0.0.0 the broadcast address? Likely blocked by your router then. Comma si, comma sa.
It's generally in c:\windows\system32\drivers\etc
Do not mock my vision of impractical footwear
Notepad doesn't change the names of existing files, but it does seem to like to force the .txt on new files that it creates.
I don't think 0.0.0.0 is the broadcast address. The only time I've ever seen it used is in combination with a /0 netmask to stand for "all addresses" e.g. 0.0.0.0/0 I believe the broadcast address is generally the last IP in the subnet, so if you're on 192.168.1.0/24, your broadcast would be 192.168.1.255.
I'm no network guru, so maybe I'm off a bit too, but I think I'm closer. I'm sure others will be more than happy to correct me. :-)
"I know that every word that man just said is true, because it's EXACTLY what I wanted to hear." -- Space Ghost
... about a security flow in MS DOS nowadays ?
Duuude, by the time you setup your host file for all the sites you visit, the Internet age will be gone....Talk about "FAST".
I can't tell after reading the ISC release and various other documents how this exploit takes place. I have a machine with UDP port 53 publicly visible, but TCP port 53 is firewalled off against all IPs except the machines under my control. Is this a UDP or a TCP exploit?
Someone above posted an iptables rule that applied to UDP port 53. Is that correct?