The GeoIP functionality in ISC BIND 9.10.0 through 9.10.1 allows remote attackers to cause a denial of service (assertion failure and named exit) via vectors related to (1) the lack of GeoIP databases for both IPv4 and IPv6, or (2) IPv6 support with certain options.

New bind packages are available for Slackware 13.0, 13.1, 13.37, 14.0, 14.1, and -current to fix security issues.

According to its self-reported version number, the remote installation of BIND is potentially affected by multiple vulnerabilities :

  - A flaw exists within the Domain Name Service due to an     error in the code used to follow delegations. A remote     attacker, with a maliciously-constructed zone or query,     can cause the service to issue unlimited queries,     resulting in resource exhaustion. (CVE-2014-8500)

  - Multiple flaws exist with GeoIP functionality. These     flaws allow a remote attacker to cause a denial of     service. Note that these issues only affect the 9.10.x     branch. (CVE-2014-8680)

  - A denial of service vulnerability exists due to an error     relating to DNSSEC validation and the managed-keys     feature. A remote attacker can trigger an incorrect     trust-anchor management scenario in which no key is     ready for use, resulting in an assertion failure and     daemon crash. (CVE-2015-1349)

  - An error exists related to handling the     'geoip-directory' option in named.conf when running     'rndc reconfig' or 'rndc reload' that allows connections     by unintended clients.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-201502-03 (BIND: Multiple Vulnerabilities)

    Multiple vulnerabilities have been discovered in BIND. Please review the       CVE identifiers referenced below for details.
  Impact :

    A remote attacker can cause a denial of service condition by the lack of       GeoIP databases, or via a large or infinite number of referrals.
  Workaround :

    There is no known workaround at this time.

Versions of ISC BIND earlier than 9.10.1-P1 are unpatched for the following vulnerabilities:

  - Denial of service vulnerability that can be triggered when handling a maliciously constructed query or zone request, causing the service to issue unlimited queries in an attempt to follow a delegation (CVE-2014-8500)

  - Denial of service vulnerability in the pre-fetch feature that is triggered when the response to a specially crafted DNS query contains particular attributes. (CVE-2014-3214)

  - Denial of service vulnerability in EDNS option processing  (CVE-2014-3859)

  - Denial of service in three unspecified flaws in the GeoIP feature (CVE-2014-8680)

ISC reports :

We have today posted updated versions of 9.9.6 and 9.10.1 to address a significant security vulnerability in DNS resolution. The flaw was discovered by Florian Maury of ANSSI, and applies to any recursive resolver that does not support a limit on the number of recursions.
[CERTFR-2014-AVI-512], [USCERT VU#264212]

A flaw in delegation handling could be exploited to put named into an infinite loop, in which each lookup of a name server triggered additional lookups of more name servers. This has been addressed by placing limits on the number of levels of recursion named will allow (default 7), and on the number of queries that it will send before terminating a recursive query (default 50). The recursion depth limit is configured via the max-recursion-depth option, and the query limit via the max-recursion-queries option. For more information, see the security advisory at https://kb.isc.org/article/AA-01216/.
[CVE-2014-8500] [RT #37580]

In addition, we have also corrected a potential security vulnerability in the GeoIP feature in the 9.10.1 release only. For more information on this issue, see the security advisory at https://kb.isc.org/article/AA-01217. [CVE-2014-8680]

According to its self-reported version number, the remote installation of BIND is affected by multiple denial of service vulnerabilities :

  - A flaw exists within the Domain Name Service due to an     error in the code used to follow delegations. A remote     attacker, with a maliciously-constructed zone or query,     could potentially cause the service to issue unlimited     queries leading to resource exhaustion. (CVE-2014-8500)

  - Multiple flaws exist with the GeoIP feature. These flaws     could allow a remote attacker to cause a denial of     service. Note these issues only affect the 9.10.x     branch. (CVE-2014-8680)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
82914	Slackware 13.0 / 13.1 / 13.37 / 14.0 / 14.1 / current : bind (SSA:2015-111-01)	Nessus	Slackware Local Security Checks	high
81487	ISC BIND 9.10.2 < 9.10.2rc2 Multiple Vulnerabilities	Nessus	DNS	high
81226	GLSA-201502-03 : BIND: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	high
8569	ISC BIND 9.10.x < 9.10.1-P1 Multiple DoS	Nessus Network Monitor	DNS Servers	high
79957	FreeBSD : bind -- denial of service vulnerability (ab3e98d9-8175-11e4-907d-d050992ecde8)	Nessus	FreeBSD Local Security Checks	high
79861	ISC BIND 9 Multiple DoS Vulnerabilities	Nessus	DNS	high

Detections

Analytics

CVE-2014-8680

high

Tenable Plugins

high

high

high

high

high

high