Potential 0-Day Vulnerability For BIND 9

Posted by Soulskill on Thursday November 17, 2011 @02:35AM from the bind-your-own-business dept.

Morty writes "BIND, the popular DNS server software, has been crashing all over the Internet. The root cause is believed to be a 0-day vulnerability in BIND's resolver. The ISC has issued an alert. Quoting: 'An as-yet unidentified network event caused BIND 9 resolvers to cache an invalid record, subsequent queries for which could crash the resolvers with an assertion failure. ISC is working on determining the ultimate cause by which a record with this particular inconsistency is cached. At this time we are making available a patch which makes named recover gracefully from the inconsistency, preventing the abnormal exit.'"

1 of 187 comments (clear)

Min score:

Reason:

Sort:

Re:A confusing summary on /., let me try to do bet by surgen · 2011-11-17 03:25 · Score: 5, Interesting

Thanks for the clear explanation.

If you run BIND, rather than getting your alerts via /. look into a support contract so you get them directly from the vendor.
Very true. Its funny, that this morning I had applied security patches to a debian stable box and thought "hmm, looks like BIND is getting fixed, wonder what thats about" before this even got posted to slashdot.