Slashdot Mirror

← Back to Stories (view on slashdot.org)

High Severity BIND Vulnerability Advisory Issued

Posted by CmdrTaco on from the put-on-your-hard-hat dept.

wiredmikey writes "The Internet Systems Consortium (ISC) and US-CERT have issued a high severity vulnerability warning, discovered by Neustar, which affects BIND, the most widely used DNS software on the Internet. Successful exploitation could enable attacker to cause Bind servers to stop processing all requests. According to the disclosure, 'When an authoritative server processes a successful IXFR transfer or a dynamic update, there is a small window of time during which the IXFR/update coupled with a query may cause a deadlock to occur. This deadlock will cause the server to stop processing all requests. A high query rate and/or a high update rate will increase the probability of this condition.'"

9 of 144 comments (clear)

  1. latest BIND not affected by doperative · · Score: 5, Informative

    "There have been no active exploits known, and versions 9.7.1-9.7.2-P3 versions of BIND are affected. US-CERT encourages users and administrators using the affected versions of BIND to upgrade to BIND 9.7.3 "

    1. Re:latest BIND not affected by Bacon+Bits · · Score: 3, Informative

      That's because the latest BIND was released specifically to patch this vulnerability. They just didn't really tell anybody about the vulnerability until after 9.7.3 was released. Don't believe me?

      CERT was notified at the end of January.
      "Date Notified: 2011-01-24" [ http://www.kb.cert.org/vuls/id/559980 ]

      The CVE was reserved in the middle of January.
      "Assigned (20110111)" [ http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0414 ]

      Yet the release notes for 9.7.3 don't mention any fixes which would coincide with this vulnerability:
      http://ftp.isc.org/isc/bind9/9.7.3/RELEASE-NOTES-BIND-9.7.3.html

      Thanks, ISC, for patching a vulnerability a month after you found out about it and then telling us two weeks later that you did that. That's awesome security procedure there.

      --
      The road to tyranny has always been paved with claims of necessity.
    2. Re:latest BIND not affected by Ethanol · · Score: 4, Informative

      That's because the latest BIND was released specifically to patch this vulnerability. They just didn't really tell anybody about the vulnerability until after 9.7.3 was released.

      That's not correct. The locking bug had already been fixed in 9.7.3b1, a month before it was found to be exploitable as a DoS. When we did find that out, we consulted with vendors and decided to continue with the releases in progress.

    3. Re:latest BIND not affected by Anonymous Coward · · Score: 3, Informative

      We notified our forum members as soon as we understood the full scope of the issue, key operators/vendors the next day, and the general community one week later, as per our Security Disclosure Policy: http://www.isc.org/security-vulnerability-disclosure-policy.

    4. Re:latest BIND not affected by pclminion · · Score: 5, Insightful

      Thanks, ISC, for patching a vulnerability a month after you found out about it and then telling us two weeks later that you did that

      You know, I'm really tired of people who obviously don't write code saying crap like this. Fixing a subtle deadlock could quite realistically take a month. First, you need to figure out really why it happens. Then you need to figure out the CORRECT way to fix it, then you need to implement the fix, then you need to TEST the thing to make sure you didn't introduce anything ELSE that could cause a problem. If the bug was in an easy area of code, chances are it would have been found and fixed a long time ago. BIND has been around a long, long time. Anything left in there now is, by definition, hard to find and hard to fix.

      Look folks, security bugs happen BECAUSE people whip out code without thinking and without testing. Now you ask for them to do exactly that? You need to get a grip on reality.

    5. Re:latest BIND not affected by thogard · · Score: 3, Insightful

      Keep in mind that ISC runs a lot of very large name servers all over the world that are under constant DDOS attacks and they didn't see this in the wild. At this point, its a theoretical attack and there is a theatrical work around. Releasing the info too soon could have resulted in a real attack against a theatrical work around. I think they did the right thing considering if you had a DDOS problem, you can ask in a number of places and they would have told to you to try the work around.

  2. not "high severity" by Lord+Ender · · Score: 4, Informative

    This sounds like a denial-of-service flaw. Such flaws are considered "low severity" in all but the rarest cases. A high-severity flaw would be one which either gives a hacker control of a service or access to sensitive information.

    This is just one more in a long list of well-known ways anyone could knock a server offline.

    --
    A slashdotter who didn't build his own computer is like a Jedi who didn't build his own lightsaber.
    1. Re:not "high severity" by Leebert · · Score: 4, Insightful

      This sounds like a denial-of-service flaw. Such flaws are considered "low severity" in all but the rarest cases. A high-severity flaw would be one which either gives a hacker control of a service or access to sensitive information.

      It depends entirely upon the requirements for availability. I agree that generally the A in the CIA triad is the least important, but not by any means always.

      Imagine if this could be easily leveraged to shut down all DNS resolvers for, say, all of Comcast. Wouldn't you agree that it's probably a greater impact than, say, a single unimportant desktop somewhere in marketing being compromised by the Flash Of The Day vulnerability?

      Thus is the black magic of IT risk management. :)

      That said, my first thought when reading this headline was the same as yours.

  3. Re:Many companies avoid using networked nameserver by Albanach · · Score: 3, Insightful

    Seriously? What companies avoid nameservers?

    Why would you believe your P2P software is less prone to vulnerabilities than BIND?

    but it also permits the company to defacto limit the webservers that employees may visit.

    Perhaps, If your company employs people who cannot type in an IP address. Nonetheless, I can think of many much better ways to limit employee internet access.

    All software has vulnerabilities. If your nameserver has an issue, you upgrade BIND and you're done. If your P2P software on every desktop has a vulnerability, you now have to update software on every desktop. Assuming, that is, that the vulnerability is ever publicly disclosed.