The handle_connection_error function in ldap_helper.c in bind-dyndb-ldap before 1.1.0rc1 does not properly handle LDAP query errors, which allows remote attackers to cause a denial of service (infinite loop and named server hang) via a non-alphabet character in the base DN in an LDAP search DNS query.

The remote MiracleLinux 4 host has a package installed that is affected by a vulnerability as referenced in the AXSA:2012-575:02 advisory.

    This package provides an LDAP back-end plug-in for BIND. It features support for dynamic updates and     internal caching, to lift the load off of your LDAP server.
    Security issues fixed with this release;
    CVE-2012-2134     No description available at the time of writing, please use the CVE links below.
    Bug Fixes      If a zone contained an invalid Resource Record (RR) with the same Fully Qualified Domain Name (FQDN) as     the zone name, the bind-dyndb-ldap plug-in refused to load the entire zone. This has been fixed: if an     invalid RR is encountered, an error message Failed to parse RR entry is logged and the zone continues to     load.
     The bind-dyndb-ldap plug-in stopped after the first failure to connect to an LDAP server and users had to     execute rndc reload to make the plug-in work. This has been fixed: the plug-in retries to connect     periodically and no user intervention is required.
     Even after the zone_refresh period timed out and a zone was removed from the LDAP server, the plug-in     continued to serve the removed zone. This has been fixed.
     When the named daemon received the rndc reload command or a SIGHUP signal and the plug-in failed to     connect to an LDAP server, the plug-in caused named to crash when it received a query which belonged to a     zone previously handled by the plug-in. This has been fixed.
     If the named daemon lost connection to an LDAP server for some time and then some zones previously     present had been removed from LDAP before a successful reconnection, the plug-in crashed. This has been     fixed.
     Fixed the length of some strings so that the SOA serial number and the expiry time fot the forward zone     are set correctly during ipa-server installation.
     With sub-domains delegated to other DNS servers, the bind-dyndb-ldap plugin managing the top-domain DNS     failed to put A or AAAA glue records in the additional section of a DNS answer and sub-domains were not     accessible by other DNS servers.This has been fixed.
     The plug-in now correctly returns answers for queries with non-ASCII characters.
    Enhancements      Now supports two new attributes, idnsAllowQuery and idnsAllowTransfer, which can be used to set ACLs for     queries or transfers.
     Now supports the new zone attributes idnsForwarders and idnsForwardPolicy which can be used to configure     forwarding.
     Now supports zone transfers.
     Added a new option called sync_ptr that can be used to keep A and AAAA records and their PTR records     synchronized.
     It is now possible to store configuration for the plug-in in LDAP with idnsConfigObject. Options set     through this have higher priority than the ones from the named.conf file.
    Refer to /usr/share/doc/bind-dyndb-ldap/README for more information about the new options and attributes.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 4 host has a package installed that is affected by a vulnerability as referenced in the AXSA:2012-800:03 advisory.

    This package provides an LDAP back-end plug-in for BIND. It features support for dynamic updates and     internal caching, to lift the load off of your LDAP server.
    Security issues fixed with this release;
     CVE-2012-2134     No description available at the time of writing, please use the CVE links below.
    Bug Fixes      Improved the parsing of Resource Records (RR). If a RR is invalid, the bind-dyndb-ldap plug-in logs a     Failed to parse RR entry error message and the rest of the zone continues to load as expected.
     The bind-dyndb-ldap plugin tried only once to connect to an LDAP server. If it failed, it did not try     again and users had to run rndc reload to make the plugin work again. This has been fixed, the plugin     retries periodically until it succeeds and user intervention is not necessary.
     After the zone_refresh period timed out and despite the zone being removed from the LDAP server, the     plug-in would still serve the zone. This has been fixed.
     The plugin could sometimes make the named daemon crashed. This has been fixed.
     If the named daemon momentarily lost connection to an LDAP server, and if some zones previously present     had been removed from the server during the time named was not connected, the plug-in would crash. This     has been fixed.
     Fixed some string lengths that resulted in the Start of Authority (SOA) serial number and expiry time     being incorrectly set during the ipa-server installation. This has been fixed.
     It now escapes special characters DNS names in queries correctly.
     Fixed the delegation of A or AAAA glue records in the additional section of a DNS answer: delegated zones     are correctly resolvable.
    Enhancements      Added idnsAllowQuery and idnsAllowTransfer, two new attributes used to set ACLs for queries or transfers.
     Added idnsForwarders and idnsForwardPolicy, two new attributes used to configure forwarding.
     Added support for zone transfers.
     Added sync_ptr, a new option used to keep A and AAAA records and their PTR records synchronized.
     Previously, the plug-in configuration was taken from the named.conf file. Now it is also available from     idnsConfigObject in LDAP, which has a higher priority than named.conf, although this will change in the     future.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 6 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2012-0683 advisory.

    [0.2.0-7.1]
    - fix for CVE-2012-2134

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The dynamic LDAP back end is a plug-in for BIND that provides back-end capabilities to LDAP databases. It features support for dynamic updates and internal caching that help to reduce the load on LDAP servers.

A flaw was found in the way bind-dyndb-ldap handled LDAP query errors.
If a remote attacker were able to send DNS queries to a named server that is configured to use bind-dyndb-ldap, they could trigger such an error with a DNS query leveraging bind-dyndb-ldap's insufficient escaping of the LDAP base DN (distinguished name). This would result in an invalid LDAP query that named would retry in a loop, preventing it from responding to other DNS queries. With this update, bind-dyndb-ldap only attempts to retry one time when an LDAP search returns an unexpected error. (CVE-2012-2134)

All bind-dyndb-ldap users should upgrade to this updated package, which contains a backported patch to correct this issue. For the update to take effect, the named service must be restarted.

Update to the 1.1.0rc1 version which fixes CVE-2012-2134.

  - it was possible to DoS named process by query which     contained non-alphabet characters and which belongs to     zone served by the plugin. (CVE-2012-2134)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An updated bind-dyndb-ldap package that fixes one security issue is now available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

The dynamic LDAP back end is a plug-in for BIND that provides back-end capabilities to LDAP databases. It features support for dynamic updates and internal caching that help to reduce the load on LDAP servers.

A flaw was found in the way bind-dyndb-ldap handled LDAP query errors.
If a remote attacker were able to send DNS queries to a named server that is configured to use bind-dyndb-ldap, they could trigger such an error with a DNS query leveraging bind-dyndb-ldap's insufficient escaping of the LDAP base DN (distinguished name). This would result in an invalid LDAP query that named would retry in a loop, preventing it from responding to other DNS queries. With this update, bind-dyndb-ldap only attempts to retry one time when an LDAP search returns an unexpected error. (CVE-2012-2134)

Red Hat would like to thank Ronald van Zantvoort for reporting this issue.

All bind-dyndb-ldap users should upgrade to this updated package, which contains a backported patch to correct this issue. For the update to take effect, the named service must be restarted.

ID	Name	Product	Family	Type	Severity
284066	MiracleLinux 4 : bind-dyndb-ldap-1.1.0-0.9.b1.0.1.AXS4 (AXSA:2012-575:02)	Nessus	Miracle Linux Local Security Checks	Local	high
283891	MiracleLinux 4 : bind-dyndb-ldap-1.1.0-0.9.b1.0.2.AXS4 (AXSA:2012-800:03)	Nessus	Miracle Linux Local Security Checks	Local	high
68530	Oracle Linux 6 : bind-dyndb-ldap (ELSA-2012-0683)	Nessus	Oracle Linux Local Security Checks	Local	high
61314	Scientific Linux Security Update : bind-dyndb-ldap on SL6.x i386/x86_64 (20120521)	Nessus	Scientific Linux Local Security Checks	Local	medium
59259	Fedora 17 : bind-dyndb-ldap-1.1.0-0.11.rc1.fc17 (2012-6666)	Nessus	Fedora Local Security Checks	Local	medium
59233	CentOS 6 : bind-dyndb-ldap (CESA-2012:0683)	Nessus	CentOS Local Security Checks	Local	medium
59224	RHEL 6 : bind-dyndb-ldap (RHSA-2012:0683)	Nessus	Red Hat Local Security Checks	Local	medium
59100	Fedora 15 : bind-dyndb-ldap-1.1.0-0.11.rc1.fc15 (2012-6759)	Nessus	Fedora Local Security Checks	Local	medium
59099	Fedora 16 : bind-dyndb-ldap-1.1.0-0.11.rc1.fc16 (2012-6722)	Nessus	Fedora Local Security Checks	Local	medium

Detections

Analytics

CVE-2012-2134

high

Tenable Plugins

high

high

high

medium

medium

medium

medium

medium

medium