|
CERT® Advisory CA-1997-22 BIND - the Berkeley Internet Name DaemonOriginal issue date: August 13, 1997Last revised: May 26, 1998 Updated vendor information for Sun Microsystems A complete revision history is at the end of this file.
Several vulnerabilities in the Berkeley Internet Name Daemon (BIND) have been fixed in the current version of BIND. One of those vulnerabilities is now being exploited, a vulnerability that results in cache poisoning (malicious or misleading data from a remote name server is saved [cached] by another name server). The vulnerability has been fixed in BIND version 4.9.6; however, we recommend upgrading according to our instructions in Section III.B or installing vendor patches (see Appendix A). We also urge you to take the additional precautions described in Section III.C. We will update this advisory as we receive additional information. Please
check our advisory files regularly for updates that relate to your site.
I. DescriptionThe Berkeley Internet Name Daemon (BIND) is an implementation of the Domain Name Service (DNS) written primarily for UNIX Systems. BIND consists of three parts:
Analysis of recent incidents reported to the CERT Coordination Center has shown that the cache poisoning technique is being used to adversely affect the mapping between host names and IP addresses. Once this mapping has been changed, any information sent between hosts on a network may be subjected to inspection, capture, or corruption. Although, the new BIND distributions do address important security problems, not all known problems are fixed. IN particular, several problems can be fixed only with the use of cryptographic authentication techniques. Implementing and deploying this solution is non-trivial; work on this task is currently underway within the Internet community. II. ImpactThe mapping between host names and IP addresses may be changed. As a result, attackers can inspect, capture, or corrupt the information exchanged between hosts on a network.III. SolutionInstall a patch from your vendor or implement the "best practice" workaround we recommend in Section III.B. In either case, take the extra precautions described in Section III.C.A. Obtain and install a patch for this problem.Information from vendors can be found in Appendix A of this advisory; we will update the appendix as we receive more information.B. Until you are able to install the appropriate patch, we recommend the following workaround.The "best practice" for operating the publicly available BIND system can be either:
Note: Although the security posture in BIND version 8.1.1 is identical to that of version 4.9.6, version 8.1.1 is the version that will continue to undergo changes and improvements, hence our selection of its use as the "best practice." 1. Shared Object Client Subroutine LibraryIf your system and its programs rely on the shared object client subroutine library that comes with some releases of BIND, probably named libresolv.so, then you need the shared object subroutine library and other client software from release 4.9.6. (As of this writing, BIND version 8 does not yet support the client part as a shared object library.) This client software is available atftp://ftp.isc.org/isc/bind/src/4.9.6/bind-4.9.6-REL.tar.gz MD5 (bind-4.9.6-REL.tar.gz) = 76dd66e920ad0638c8a37545a6531594 Follow the instructions in the file named INSTALL in the top-level directory.
ftp://ftp.isc.org/isc/bind/src/8.1.1/bind-src.tar.gz MD5 (bind-src.tar.gz) = 7487b8d647edba2053edc1cda0c6afd0 Follow the instructions in the src/INSTALL file. Note that this version will install the client libraries and header files in a non-standard place, /usr/local/lib and /usr/local/include. The src/INSTALL file describes what is being installed and where. When you install release 4.9.6 first, its client, server, and tools parts will be installed in the production locations. When you then install release 8.1.1, the server and tools parts will be overwritten by that release's versions, but the 4.9.6 client part will not. 2. No Shared Object Client Subroutine LibraryIf you do not need the shared object client subroutine library, then you need only upgrade to release 8.1.1. This software is available atftp://ftp.isc.org/isc/bind/src/8.1.1/bind-src.tar.gz MD5 (bind-src.tar.gz) = 7487b8d647edba2053edc1cda0c6afd0 Follow the instructions in src/INSTALL. Note that the client subroutine library and header files are installed in /usr/local/lib and /usr/local/include respectively. To use these when building other systems, you will need to refer to their installed locations. Note: ftp://ftp.isc.org/isc/bind/src/ is mirrored in Germany at ftp://ftp.cert.dfn.de/pub/tools/net/bind/src/ As new versions of BIND are released in the future, you will be able to find them at these sites, as well as other mirrors. You can also check ftp://info.cert.org/pub/latest_sw_versions/ for version information. C. Take additional precautions.As good security practice in general, filter at a router all name-based authentication services so that you do not rely on DNS information for authentication. This includes the services rlogin, rsh (rcp), xhost, NFS, and any other locally installed services that provide trust based on domain name information.Appendix A - Vendor InformationBelow is a list of the vendors who have provided information for this advisory. We will update this appendix as we receive additional information. If you do not see your vendor's name, the CERT/CC did not hear from that vendor. Please contact the vendor directly.Berkeley Software Design, Inc. (BSDI)Patches from BSDIftp://ftp.bsdi.com/bsdi/patches/patches-2.1/U210-038
ftp://ftp.bsdi.com/bsdi/patches/patches-3.0/M300-025
Cray Research - A Silicon Graphics CompanyCray Research has determined that the version of BIND shipped with all current releases of Unicos and Unicos/mk are susceptible to the problem described in this advisory. We are currently working on upgrading our version of BIND to the 4.9.6 release.Digital Equipment Corporationxref CASE ID: SSRT0494UAt the time of writing this document, patches(binary kits) are in progress and final patch testing is expected to begin soon. Digital will provide notice of the completion/availability of the patches through AES services (DIA, DSNlink FLASH) and be available from your normal Digital Support channel. DIGITAL EQUIPMENT CORPORATION AUG/97
Hewlett-Packard CompanyHP is vulnerable. Patches in process.IBM CorporationIBM is currently working on the following APARs which will be available soon:AIX 4.1: IX70236
To OrderAPARs may be ordered using Electronic Fix Distribution (via FixDist) or from the IBM Support Center. For more information on FixDist, reference URL:http://service.software.ibm.com/aixsupport/ or send e-mail to aixserv@austin.ibm.com with a subject of "FixDist". IBM and AIX are registered trademarks of International Business Machines
Corporation.
NEC CorporationNEC is vulnerable. The systems affected by this problemare as follows: UX/4800
Patches are in progress and will be made available from ftp://ftp.meshnet.or.jp/pub/48pub/security. Siemens-Nixdorf Informationssysteme AGWe are investigating this problem and will provide updated information for this advisory when it becomes available.The Santa Cruz OperationThe following SCO operating systems are vulnerable:- SCO Open Desktop/Open Server 3.0, SCO UNIX 3.2v4
SCO CMW+ 3.0 is not vulnerable as bind is not supported on CMW+ platforms. SCO has made an interim fix available for anonymous ftp: ftp://ftp.sco.com/SSE/sse008.ltr.Z - cover letter ftp://ftp.sco.com/SSE/sse008.tar.Z - replacement binaries The fix includes binaries for the following SCO operating systems: - SCO Open Desktop/Open Server 3.0, SCO UNIX 3.2v4
Sun Microsystems
The following patches relate to the BIND vulnerability: SunOS version Patch Id ------------- -------- 5.6 105755-03 5.6_x86 105756-03 5.5.1 103663-11 5.5.1_x86 103664-11 5.5 103667-09 5.5_x86 103668-09 5.4 102479-11 5.4_x86 102480-09 5.3 101359-08 Sun recommended security patches (including checksums) are available from: http://sunsolve.sun.com/sunsolve/pubpatches/patches.html The CERT Coordination Center staff thanks Paul Vixie and Wolfgang Ley for their contributions to this advisory. This document is available from: http://www.cert.org/advisories/CA-1997-22.html CERT/CC Contact Information
Phone: +1 412-268-7090 (24-hour hotline) Fax: +1 412-268-6989 Postal address: CERT/CC personnel answer the hotline 08:00-17:00 EST(GMT-5) / EDT(GMT-4) Monday through Friday; they are on call for emergencies during other hours, on U.S. holidays, and on weekends. Using encryptionWe strongly urge you to encrypt sensitive information sent by email. Our public PGP key is available from If you prefer to use DES, please call the CERT hotline for more information. Getting security informationCERT publications and other security information are available from our web site
* "CERT" and "CERT Coordination Center" are registered in the U.S. Patent and Trademark Office.
NO WARRANTY Conditions for use, disclaimers, and sponsorship information
Copyright 1997 Carnegie Mellon University. Revision History May 26, 1998 Updated vendor information for Sun Microsystems Sept. 30, 1997 Updated copyright statement Sept. 19, 1997 Appendix A - Added information for BSDI. Aug. 20, 1997 Introduction - Clarified that 4.9.6 is not vulnerable. Section III - Added a note why sites should upgrade to 8.1.1. |