3571e53040
patches for easier mirroring, to eliminate a special copy, to make www.freebsd.org/security a full copy of security.freebsd.org and be eventually be the same. For now files are just sitting there. The symlinks are missing. Discussed on: www (repository location) Discussed with: simon (so)
252 lines
9.1 KiB
Text
252 lines
9.1 KiB
Text
-----BEGIN PGP SIGNED MESSAGE-----
|
|
|
|
=============================================================================
|
|
FreeBSD-SA-01:18 Security Advisory
|
|
FreeBSD, Inc.
|
|
|
|
Topic: BIND remotely exploitable buffer overflow
|
|
|
|
Category: core, ports
|
|
Module: bind
|
|
Announced: 2001-01-31
|
|
Credits: COVERT Labs <seclabs@NAI.COM>
|
|
Claudio Musmarra
|
|
Affects: All released versions of FreeBSD 3.x, 4.x.
|
|
FreeBSD 3.5-STABLE prior to the correction date.
|
|
FreeBSD 4.2-STABLE prior to the correction date.
|
|
Ports collection prior to the correction date.
|
|
Corrected: 2001-01-30 (FreeBSD 3.5-STABLE)
|
|
2001-01-29 (FreeBSD 4.2-STABLE)
|
|
2001-01-29 (Ports collection)
|
|
Vendor status: Updated version released
|
|
FreeBSD only: NO
|
|
|
|
I. Background
|
|
|
|
BIND is an implementation of the Domain Name Service (DNS) protocols.
|
|
|
|
II. Problem Description
|
|
|
|
An overflowable buffer related to the processing of transaction
|
|
signatures (TSIG) exists in all versions of BIND prior to
|
|
8.2.3-RELEASE. The vulnerability is exploitable regardless of
|
|
configuration options and affects both recursive and non-recursive DNS
|
|
servers.
|
|
|
|
Additional vulnerabilities allow the leaking of environment variables
|
|
and the contents of the program stack. These vulnerabilities may
|
|
assist the ability of attackers to exploit the primary vulnerability
|
|
described above, and make provide additional information about the
|
|
state or configuration of the system.
|
|
|
|
All previous versions of BIND 8, such as the beta versions included in
|
|
FreeBSD 4.x prior to the correction date (designated the version
|
|
number BIND 8.2.3-T<#>B) are vulnerable to this problem. Systems
|
|
running versions of BIND 9.x (available in the FreeBSD ports
|
|
collection) are unaffected.
|
|
|
|
Further information about the vulnerabilities is contained in the CERT
|
|
advisory located at:
|
|
|
|
http://www.cert.org/advisories/CA-2001-02.html
|
|
|
|
Note that this advisory also describes vulnerabilities in the BIND 4.x
|
|
software, which is not included in any recent version of FreeBSD.
|
|
|
|
All versions of FreeBSD 3.x and 4.x prior to the correction date
|
|
including 3.5.1-RELEASE and 4.2-RELEASE are vulnerable to this
|
|
problem, if they have been configued to run named (this is not enabled
|
|
by default). In addition, the bind8 port in the ports collection
|
|
(versions prior to 8.2.3) is also vulnerable.
|
|
|
|
To check whether a DNS server is running a vulnerable version of BIND,
|
|
perform the following command as any user:
|
|
|
|
% dig @serverip version.bind. CHAOS TXT
|
|
|
|
The following segment of output indicates a non-vulnerable server
|
|
running BIND 8.2.3-RELEASE:
|
|
|
|
...
|
|
;; ANSWER SECTION:
|
|
VERSION.BIND. 0S CHAOS TXT "8.2.3-REL"
|
|
...
|
|
|
|
III. Impact
|
|
|
|
Malicious remote users can cause arbitrary code to be executed as the
|
|
user running the named daemon. This is often the root user, although
|
|
FreeBSD provides built-in support for the execution of named as an
|
|
unprivileged 'bind' user, which greatly limits the scope of the
|
|
vulnerability should a successful penetration take place.
|
|
|
|
IV. Workaround
|
|
|
|
There is no known practical workaround to prevent the vulnerability
|
|
from being exploited, short of upgrading the software. A partial
|
|
workaround to limit the impact of the vulnerability should it be
|
|
exploited is to run named as an unprivileged user.
|
|
|
|
Add the following line to /etc/rc.conf:
|
|
|
|
named_flags="-u bind -g bind" # Flags for named
|
|
|
|
Add the following line to your /etc/namedb/named.conf file, in the
|
|
"options" section:
|
|
|
|
pid-file "/var/named/named.pid";
|
|
|
|
See the named.conf(5) manual page for more details about configuring
|
|
named.
|
|
|
|
Perform the following commands as root:
|
|
|
|
Create a directory writable by the bind user where named can store its
|
|
pid file:
|
|
|
|
# mkdir /var/named
|
|
# chown bind:bind /var/named
|
|
|
|
Shut down the DNS server:
|
|
|
|
# ndc stop
|
|
|
|
Restart it using the non-privileged user and group:
|
|
|
|
# ndc -p /var/named/named.pid start -u bind -g bind
|
|
|
|
Note that when not running as the root user, named will lose the
|
|
ability to re-bind to interfaces which change address, or which are
|
|
added to the system after named has been started. If such an event
|
|
takes place, named will need to be stopped and restarted in order to
|
|
re-bind to the interface(s). See the ndc(8) manual page for more
|
|
information about how to do this.
|
|
|
|
Use of the -t option to named will also increase security when run as
|
|
a non-privileged user by confining the named process to a chroot
|
|
environment and thereby partially limiting the access it has to the
|
|
rest of the system. Configuration of these options is beyond the
|
|
scope of the advisory. The following website contains information
|
|
which may be useful to administrators wishing to perform this step:
|
|
|
|
http://www.losurs.org/docs/howto/Chroot-BIND.html
|
|
|
|
Note that this tutorial does not specifically relate to FreeBSD, and
|
|
the information contained therein may need to be modified for FreeBSD
|
|
systems.
|
|
|
|
Note that such a penetration of the unprivileged bind user may still
|
|
allow the attacker to take advantage of a local security vulnerability
|
|
or misconfiguration to further increase privileges. Therefore this
|
|
should only be considered a temporary workaround while preparations
|
|
can be made to upgrade permanently.
|
|
|
|
It is recommended that all affected users upgrade their systems
|
|
immediately as described in the following section.
|
|
|
|
V. Solution
|
|
|
|
Note that BIND 8.2.3-RELEASE is more strict about invalid zone file
|
|
syntax than older versions. DNS zones which contain errors may need
|
|
to be corrected before the new version can be run.
|
|
|
|
[Base system]
|
|
|
|
Upgrade your vulnerable FreeBSD system to 3.5-STABLE or 4.2-STABLE
|
|
after the respective correction dates.
|
|
|
|
A binary tarball containing the updated BIND files may be released in
|
|
a few days, but is being held back for quality assurance reasons. In
|
|
the meantime an unofficial tarball is available from the following
|
|
location. Users are advised that the following tarball has not been
|
|
tested on a production system, and those wishing to perform an upgrade
|
|
without upgrading the entire OS are advised to use the bind8 port as
|
|
described below.
|
|
|
|
http://www.freebsd.org/~kris/bind-8.2.3-4.x.tgz
|
|
http://www.freebsd.org/~kris/bind-8.2.3-4.x.tgz.asc
|
|
|
|
To fetch and install it, perform the following actions as root:
|
|
|
|
# fetch http://www.freebsd.org/~kris/bind-8.2.3-4.x.tgz
|
|
# fetch http://www.freebsd.org/~kris/bind-8.2.3-4.x.tgz.asc
|
|
|
|
Verify the detached PGP signature using your PGP utility.
|
|
|
|
# cd /
|
|
# tar xvfz /path/to/bind-8.2.3-4.x.tgz
|
|
|
|
Stop and restart the named process as shown:
|
|
|
|
# ndc restart
|
|
|
|
See the note in the previous section about how to restart ndc as a
|
|
non-privileged user if it has been configued to run that way.
|
|
|
|
[Ports collection]
|
|
|
|
If you have chosen to install BIND from the ports collection and are
|
|
using it instead of the version in the base system, perform one of the
|
|
following steps:
|
|
|
|
1) Update your entire ports collection and rebuild the bind8 port.
|
|
|
|
If you are installing the port for the first time, be sure to edit the
|
|
named_program variable in /etc/rc.conf to point to the installed
|
|
location of the named executable.
|
|
|
|
The bind8 port can be configured to install itself in /usr and read
|
|
configuration data from /etc so that it is drop-in compatible with the
|
|
system version of BIND. Install the port as follows:
|
|
|
|
# cd /usr/ports/net/bind8
|
|
# make PREFIX=/usr PIDDIR=/var/run DESTETC=/etc/namedb \
|
|
DESTRUN=/var/run all install clean
|
|
|
|
If you install the BIND port over the top of the system version in
|
|
this way, be sure to add the following line to /etc/make.conf to
|
|
prevent the future rebuilding of the system version during 'make
|
|
world':
|
|
|
|
NO_BIND= true # do not build BIND
|
|
|
|
2) Deinstall the old package and install a new package dated after the
|
|
correction date, obtained from:
|
|
|
|
[i386]
|
|
ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/i386/packages-3-stable/net/bind-8.2.3.tgz
|
|
ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/i386/packages-4-stable/net/bind-8.2.3.tgz
|
|
ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/i386/packages-5-current/net/bind-8.2.3.tgz
|
|
|
|
NOTE: It may be several days before updated packages are available.
|
|
|
|
[alpha]
|
|
Packages are not automatically generated for the alpha architecture at
|
|
this time due to lack of build resources.
|
|
|
|
3) download a new port skeleton for the bind8 port from:
|
|
|
|
http://www.freebsd.org/ports/
|
|
|
|
and use it to rebuild the port.
|
|
|
|
4) Use the portcheckout utility to automate option (3) above. The
|
|
portcheckout port is available in /usr/ports/devel/portcheckout or the
|
|
package can be obtained from:
|
|
|
|
ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/i386/packages-3-stable/devel/portcheckout-2.0.tgz
|
|
ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/i386/packages-4-stable/devel/portcheckout-2.0.tgz
|
|
ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/alpha/packages-4-stable/devel/portcheckout-2.0.tgz
|
|
ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/i386/packages-5-current/devel/portcheckout-2.0.tgz
|
|
ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/alpha/packages-5-current/devel/portcheckout-2.0.tgz
|
|
|
|
-----BEGIN PGP SIGNATURE-----
|
|
Version: GnuPG v1.0.4 (FreeBSD)
|
|
Comment: For info see http://www.gnupg.org
|
|
|
|
iQCVAwUBOniArlUuHi5z0oilAQGE+AQAiwizuORMqyzOw21QFyap2Z7lv7BkYuiC
|
|
9zZ97X3WR+i8AujTfIrhwK1UdO6KFbp5Rjc54f3XHtaMotoRcp3x24xADpGQDP4s
|
|
Xyw267ZoV7ZYuG6VcAgBzq9pqiCnU9rqRQy2aRn/8iCvcl/G5249B3DuMMtLiMw+
|
|
Iuz0OOxWeLM=
|
|
=hanM
|
|
-----END PGP SIGNATURE-----
|