3571e53040
patches for easier mirroring, to eliminate a special copy, to make www.freebsd.org/security a full copy of security.freebsd.org and be eventually be the same. For now files are just sitting there. The symlinks are missing. Discussed on: www (repository location) Discussed with: simon (so)
104 lines
3.8 KiB
Text
104 lines
3.8 KiB
Text
-----BEGIN PGP SIGNED MESSAGE-----
|
|
|
|
=============================================================================
|
|
FreeBSD-SA-01:10 Security Advisory
|
|
FreeBSD, Inc.
|
|
|
|
Topic: bind remote denial of service
|
|
|
|
Category: core, ports
|
|
Module: bind
|
|
Announced: 2001-01-23
|
|
Credits: Fabio Pietrosanti <fabio@TELEMAIL.IT>
|
|
Affects: FreeBSD 3.x prior to the correction date.
|
|
Ports collection prior to the correction date.
|
|
Corrected: 2000-11-27 (FreeBSD 3.5-STABLE)
|
|
2001-01-05 (Ports collection)
|
|
Vendor status: Updated version released
|
|
FreeBSD only: NO
|
|
|
|
I. Background
|
|
|
|
bind is an implementation of the Domain Name System (DNS) protocols.
|
|
|
|
II. Problem Description
|
|
|
|
A vulnerability exists with the bind nameserver dealing with
|
|
compressed zone transfers. Due to a problem with the compressed zone
|
|
transfer (ZXFR) implementation, if named is configured for zone
|
|
transfers and recursive resolving, it will crash after a ZXFR for the
|
|
authoritative zone and a query of a remote hostname. Since named is
|
|
not configured under a watchdog process which will automatically
|
|
restart it after a failure, this will lead to the denial of DNS
|
|
service on the server.
|
|
|
|
All versions of FreeBSD 3.x prior to the correction date including
|
|
3.5.1-RELEASE are vulnerable to this problem. In addition, the bind8
|
|
port in the ports collection is also vulnerable. FreeBSD 4.x is not
|
|
affected since it contains versions of BIND 8.2.3.
|
|
|
|
III. Impact
|
|
|
|
Malicious remote users can cause the named daemon to crash, if it is
|
|
configured to allow zone transfers and recursive queries.
|
|
|
|
IV. Workaround
|
|
|
|
A partial workaround can be implemented by disallowing zone transfers
|
|
except from trusted hosts. Note that if the trusted hosts are
|
|
compromised or contain malicious users, name servers with this bug
|
|
will be vulnerable to the denial of service attack.
|
|
|
|
V. Solution
|
|
|
|
[Base system]
|
|
|
|
Upgrade your vulnerable FreeBSD system to 3.5.1-STABLE after the
|
|
correction date.
|
|
|
|
[Ports collection]
|
|
|
|
If you have chosen to install BIND from the ports collection and are
|
|
using it instead of the version in the base system, perform one of the
|
|
following steps:
|
|
|
|
1) Upgrade your entire ports collection and rebuild the bind8 port.
|
|
|
|
2) Deinstall the old package and install a new package dated after the
|
|
correction date, obtained from:
|
|
|
|
[i386]
|
|
ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/i386/packages-3-stable/net/bind-8.2.2p7.tgz
|
|
ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/i386/packages-4-stable/net/bind-8.2.2p7.tgz
|
|
ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/i386/packages-5-current/net/bind-8.2.2p7.tgz
|
|
|
|
[alpha]
|
|
Packages are not automatically generated for the alpha architecture at
|
|
this time due to lack of build resources.
|
|
|
|
3) download a new port skeleton for the bind8 port from:
|
|
|
|
http://www.freebsd.org/ports/
|
|
|
|
and use it to rebuild the port.
|
|
|
|
4) Use the portcheckout utility to automate option (3) above. The
|
|
portcheckout port is available in /usr/ports/devel/portcheckout or the
|
|
package can be obtained from:
|
|
|
|
ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/i386/packages-3-stable/devel/portcheckout-2.0.tgz
|
|
ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/i386/packages-4-stable/devel/portcheckout-2.0.tgz
|
|
ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/alpha/packages-4-stable/devel/portcheckout-2.0.tgz
|
|
ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/i386/packages-5-current/devel/portcheckout-2.0.tgz
|
|
ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/alpha/packages-5-current/devel/portcheckout-2.0.tgz
|
|
|
|
-----BEGIN PGP SIGNATURE-----
|
|
Version: GnuPG v1.0.4 (FreeBSD)
|
|
Comment: For info see http://www.gnupg.org
|
|
|
|
iQCVAwUBOm320lUuHi5z0oilAQHFXAP+NVSPyykl5nfZlsU/ocqyMAAt/ArNz1F/
|
|
4GEL8Q5GF2+hhEOG4PoKfDiwQ/CK8gQT8kn46YI8k7J6kyDES3g15zQTPX0E2lJa
|
|
dK0kpL4iWcLndZRHgFmE80//qY2E8G/pVIvhNi4yzjcFVTpshdSdl4OMcMf9IaYE
|
|
zrWZ3Eyvdns=
|
|
=PmSi
|
|
-----END PGP SIGNATURE-----
|