Buffer overflows in the DNS stub resolver library in ISC BIND 4.9.2 through 4.9.10, and other derived libraries such as BSD libc and GNU glibc, allow remote attackers to execute arbitrary code via DNS server responses that trigger the overflow in the (1) getnetbyname, or (2) getnetbyaddr functions, aka "LIBRESOLV: buffer overrun" and a different vulnerability than CVE-2002-0684.

Trevor Johnson reported that the Red Hat Linux RPMs used by linux_base contained multiple older vulnerabilities, such as a DNS resolver issue and critical bugs in X font handling and XPM image handling.

[Bind version 9, the bind9 package, is not affected by these problems.]

ISS X-Force has discovered several serious vulnerabilities in the Berkeley Internet Name Domain Server (BIND). BIND is the most common implementation of the DNS (Domain Name Service) protocol, which is used on the vast majority of DNS servers on the Internet. DNS is a vital Internet protocol that maintains a database of easy-to-remember domain names (host names) and their corresponding numerical IP addresses.

Circumstantial evidence suggests that the Internet Software Consortium (ISC), maintainers of BIND, was made aware of these issues in mid-October. Distributors of Open Source operating systems, including Debian, were notified of these vulnerabilities via CERT about 12 hours before the release of the advisories on November 12th. This notification did not include any details that allowed us to identify the vulnerable code, much less prepare timely fixes.

Unfortunately ISS and the ISC released their security advisories with only descriptions of the vulnerabilities, without any patches. Even though there were no signs that these exploits are known to the black-hat community, and there were no reports of active attacks, such attacks could have been developed in the meantime - with no fixes available.

We can all express our regret at the inability of the ironically named Internet Software Consortium to work with the Internet community in handling this problem. Hopefully this will not become a model for dealing with security issues in the future.

The Common Vulnerabilities and Exposures (CVE) project identified the following vulnerabilities :

  - CAN-2002-1219: A buffer overflow in BIND 8 versions     8.3.3 and earlier allows a remote attacker to execute     arbitrary code via a certain DNS server response     containing SIG resource records (RR). This buffer     overflow can be exploited to obtain access to the victim     host under the account the named process is running     with, usually root.
  - CAN-2002-1220: BIND 8 versions 8.3.x through 8.3.3     allows a remote attacker to cause a denial of service     (termination due to assertion failure) via a request for     a subdomain that does not exist, with an OPT resource     record with a large UDP payload size.

  - CAN-2002-1221: BIND 8 versions 8.x through 8.3.3 allows     a remote attacker to cause a denial of service (crash)     via SIG RR elements with invalid expiry times, which are     removed from the internal BIND database and later cause     a null dereference.

These problems have been fixed in version 8.3.3-2.0woody1 for the current stable distribution (woody), in version 8.2.3-0.potato.3 for the previous stable distribution (potato) and in version 8.3.3-3 for the unstable distribution (sid). The fixed packages for unstable will enter the archive today.

The remote BIND server is vulnerable to the SIG cached RR overflow vulnerability. An attacker may use this flaw to gain a shell on this system.

The remote BIND server is vulnerable to three different vulnerabilities : 
1) The remote BIND server, based on its version number, if running recursive DNS functionality, is vulnerable to a buffer overflow.
2) The remote BIND server is vulnerable to a denial of service (crash) via SIG RR elements with invalid expiry times.
3) The remote BIND server is vulnerable to a denial of service.
When a DNS lookup is requested on a non-existant sub-domain of a valid domain and an OPT resource record with a large UDP payload is attached, the server may fail.   

Updated glibc packages that fix a security flaw in the resolver as well as dlclose handling are now available.

The GNU libc packages (known as glibc) contain the standard C libraries used by applications.

A security audit of the glibc packages in Red Hat Enterprise Linux 2.1 found a flaw in the resolver library which was originally reported as affecting versions of ISC BIND 4.9. This flaw also applied to glibc versions before 2.3.2. An attacker who is able to send DNS responses (perhaps by creating a malicious DNS server) could remotely exploit this vulnerability to execute arbitrary code or cause a denial of service. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2002-0029 to this issue.

These updated packages also fix a dlclose function bug on certain shared libraries, which caused program crashes.

All users of glibc should upgrade to these updated packages, which resolve these issues.

The remote BIND 4.x server, according to its version number, is vulnerable to a buffer overflow in the DNS stub resolver library.

An attacker might use this flaw to execute arbitrary code on the remote host.

ID	Name	Product	Family	Severity
19106	FreeBSD : linux_base -- vulnerabilities in Red Hat 7.1 libraries (bf2e7483-d3fa-440d-8c6e-8f1f2f018818)	Nessus	FreeBSD Local Security Checks	critical
15033	Debian DSA-196-1 : bind - several vulnerabilities	Nessus	Debian Local Security Checks	high
1011	ISC BIND < 4.9.11 Multiple Remote Vulnerabilities (deprecated)	Nessus Network Monitor	DNS Servers	critical
1010	ISC BIND < 8.3.4 Remote Buffer Overflow (deprecated)	Nessus Network Monitor	DNS Servers	critical
1009	ISC BIND < 8.2.7 Multiple Remote Vulnerabilities (deprecated)	Nessus Network Monitor	DNS Servers	critical
1006	ISC BIND < 8.3.4 Multiple Remote Vulnerabilities (deprecated)	Nessus Network Monitor	DNS Servers	high
14212	RHEL 2.1 : glibc (RHSA-2004:383)	Nessus	Red Hat Local Security Checks	high
11857	ISC BIND < 4.9.11 stub resolver (libresolv.a) DNS Response Overflow	Nessus	DNS	critical

Detections

Analytics

CVE-2002-0029

critical

Tenable Plugins

critical

high

critical

critical

critical

high

high

critical