Race condition in the ns_client structure management in ISC BIND 9.9.x before 9.9.1-P2 allows remote attackers to cause a denial of service (memory consumption or process exit) via a large volume of TCP queries.

bind was updated to 9.8.4-P2 to fix security problems and bugs.

Security Fixes Removed the check for regex.h in configure in order to disable regex syntax checking, as it exposes BIND to a critical flaw in libregex on some platforms. [CVE-2013-2266] [RT #32688] https://kb.isc.org/article/AA-00871 (bnc#811876) Prevents named from aborting with a require assertion failure on servers with DNS64 enabled. These crashes might occur as a result of specific queries that are received. (Note that this fix is a subset of a series of updates that will be included in full in BIND 9.8.5 and 9.9.3 as change #3388, RT #30996). [CVE-2012-5688] [RT #30792] A deliberately constructed combination of records could cause named to hang while populating the additional section of a response. [CVE-2012-5166] [RT #31090] Prevents a named assert (crash) when queried for a record whose RDATA exceeds 65535 bytes [CVE-2012-4244] [RT #30416] Prevents a named assert (crash) when validating caused by using 'Bad cache' data before it has been initialized. [CVE-2012-3817] [RT #30025] A condition has been corrected where improper handling of zero-length RDATA could cause undesirable behavior, including termination of the named process. [CVE-2012-1667] [RT #29644] New Features Elliptic Curve Digital Signature Algorithm keys and signatures in DNSSEC are now supported per RFC 6605. [RT #21918] Feature Changes Improves OpenSSL error logging [RT #29932] nslookup now returns a nonzero exit code when it is unable to get an answer. [RT #29492] Bug Fixes Uses binary mode to open raw files on Windows. [RT #30944] Static-stub zones now accept 'forward' and 'fowarders' options (often needed for subdomains of the zone referenced to override global forwarding options). These options are already available with traditional stub zones and their omission from zones of type 'static-stub' was an inadvertent oversight. [RT #30482] Limits the TTL of signed RRsets in cache when their RRSIGs are approaching expiry. This prevents the persistence in cache of invalid RRSIGs in order to assist recovery from a situation where zone re-signing doesn't occur in a timely manner. With this change, named will attempt to obtain new RRSIGs from the authoritative server once the original ones have expired, and even if the TTL of the old records would in other circumstances cause them to be kept in cache for longer. [RT #26429] Corrects the syntax of isc_atomic_xadd() and isc_atomic_cmpxchg() which are employed on Itanium systems to speed up lock management by making use of atomic operations. Without the syntax correction it is possible that concurrent access to the same structures could accidentally occur with unpredictable results.
[RT #25181] The configure script now supports and detects libxml2-2.8.x correctly [RT #30440] The host command should no longer assert on some architectures and builds while handling the time values used with the -w (wait forever) option. [RT #18723] Invalid zero settings for max-retry-time, min-retry-time, max-refresh-time, min-refresh-time will now be detected during parsing of named.conf and an error emitted instead of triggering an assertion failure on startup. [RT #27730] Removes spurious newlines from log messages in zone.c [RT #30675] When built with readline support (i.e. on a system with readline installed) nsupdate no longer terminates unexpectedly in interactive mode. [RT #29550] All named tasks that perform task-exclusive operations now share the same single task. Prior to this change, there was the possibility of a race condition between rndc operations and other functions such as re-sizing the adb hash table. If the race condition was encountered, named would in most cases terminate unexpectedly with an assert. [RT #29872] Ensures that servers are expired from the ADB cache when the timeout limit is reached so that their learned attributes can be refreshed. Prior to this change, servers that were frequently queried might never have their entries removed and reinitialized. This is of particular importance to DNSSEC-validating recursive servers that might erroneously set 'no-edns' for an authoritative server following a period of intermittent connectivity. [RT #29856] Adds additional resilience to a previous security change (3218) by preventing RRSIG data from being added to cache when a pseudo-record matching the covering type and proving non-existence exists at a higher trust level. The earlier change prevented this inconsistent data from being retrieved from cache in response to client queries - with this additional change, the RRSIG records are no longer inserted into cache at all. [RT #26809] dnssec-settime will now issue a warning when the writing of a new private key file would cause a change in the permissions of the existing file. [RT #27724] Fixes the defect introduced by change #3314 that was causing failures when saving stub zones to disk (resulting in excessive CPU usage in some cases). [RT #29952] It is now possible to using multiple control keys again - this functionality was inadvertently broken by change #3924 (RT #28265) which addressed a memory leak. [RT #29694] Setting resolver-query-timeout too low could cause named problems recovering after a loss of connectivity. [RT #29623] Reduces the potential build-up of stale RRsets in cache on a busy recursive nameserver by re-using cached DS and RRSIG rrsets when possible [RT #29446] Corrects a failure to authenticate non-existence of resource records in some circumstances when RPZ has been configured. Also :

  - adds an optional 'recursive-only yes|no' to the     response-policy statement

  - adds an optional 'max-policy-ttl' to the response-policy     statement to limit the false data that 'recursive-only     no' can introduce into resolvers' caches

  - introduces a predefined encoding of PASSTHRU policy by     adding 'rpz-passthru' to be used as the target of CNAME     policy records (the old encoding is still accepted.)

  - adds a RPZ performance test to bin/tests/system/rpz when     queryperf is available. [RT #26172]     Upper-case/lower-case handling of RRSIG signer-names is     now handled consistently: RRSIG records are generated     with the signer-name in lower case. They are accepted     with any case, but if they fail to validate, we try     again in lower case. [RT #27451]

  - Update the IPv4 address of the D root name server.

The remote host is running Bind, a popular name server. 

Versions of BIND 9.6-ESV earlier than 9.6-ESV-R7-P2, 9.7.x earlier than 9.7.6-P2, 9.8.x earlier than 9.8.3-P2, and than 9.9.1-P2 are potentially affected by the following vulnerabilities : 

  - Under a heavy query load, the application may use uninitialized data structures related to failed query cache access. This error can cause the application to crash. Note this issue only affects the application when DNSSEC validation is enabled. (CVE-2012-3817)

  - Under a heavy, incoming TCP query load, the application can be affected by a memory leak that can lead to decreased performance and application termination on systems that kill processes that are out of memory. (CVE-2012-3868)

New bind packages are available for Slackware 12.1, 12.2, 13.0, 13.1, 13.37, 14.0, and -current to fix security issues.

The remote host is affected by the vulnerability described in GLSA-201209-04 (BIND: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in BIND:
      Domain names are not properly revoked due to an error in the cache         update policy (CVE-2012-1033).
      BIND accepts records with zero-length RDATA fields (CVE-2012-1667).
      An assertion failure from the failing-query cache could occur when         DNSSEC validation is enabled (CVE-2012-3817).
      A memory leak may occur under high TCP query loads (CVE-2012-3868).
      An assertion error can occur when a query is performed for a record         with RDATA greater than 65535 bytes (CVE-2012-4244).
  Impact :

    A remote attacker may be able to cause a Denial of Service condition or       keep domain names resolvable after it has been deleted from registration.
  Workaround :

    There is no known workaround at this time.

Update to 9.9.1-P2 security release which fixes CVE-2012-3817 and CVE-2012-3868.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to its self-reported version number, the remote installation of BIND is affected by multiple denial of service vulnerabilities :

  - Under a heavy query load, the application may use     uninitialized data structures related to failed query     cache access. This error can cause the application to     crash. Note this issue only affects the application     when DNSSEC validation is enabled. (CVE-2012-3817)

  - Under a heavy, incoming TCP query load, the application     can be affected by a memory leak that can lead to     decreased performance and application termination on     systems that kill processes that are out of memory.
    (CVE-2012-3868)

Note that Nessus has only relied on the version itself and has not attempted to determine whether or not the install is actually affected.

ID	Name	Product	Family	Severity
74953	openSUSE Security Update : bind (openSUSE-SU-2013:0605-1)	Nessus	SuSE Local Security Checks	high
6807	ISC BIND 9 Multiple DoS	Nessus Network Monitor	DNS Servers	high
63167	Slackware 12.1 / 12.2 / 13.0 / 13.1 / 13.37 / 14.0 / current : bind (SSA:2012-341-01)	Nessus	Slackware Local Security Checks	high
62237	GLSA-201209-04 : BIND: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
61467	Fedora 17 : bind-9.9.1-5.P2.fc17 (2012-11146)	Nessus	Fedora Local Security Checks	high
60120	ISC BIND 9 Multiple Denial of Service Vulnerabilities	Nessus	DNS	high

Detections

Analytics

CVE-2012-3868

medium

Tenable Plugins

high

high

high

high

high

high