Post em Destaque

Gravar a Área de Trabalho

  Olá Este é um post simples, mas com uma dica bem útil para quem gosta de fazer tutoriais ou que, por qualquer outro motivo, deseje gravar a área de trabalho enquanto utiliza o seu sistema FreeBSD (deve funcionar com outros unix-like também). Para capturar a área de trabalho não é necessário...

Leia mais...

Bind9 vulnerabilidade – DNSSEC validation Denial of Service

Postado por gondim | Categoria FreeBSD, Segurança, Software Livre | Dia 06-08-2012

Tags:

9

Para aqueles que tem um servidor de DNS com bind 9.x dêem uma olhada nesse advisory abaixo
e corrijam o quanto antes o problema:

==========================================================================
FreeBSD-SA-12:05.bind                                       Security Advisory
                                                          The FreeBSD Project

Topic:          named(8) DNSSEC validation Denial of Service

Category:       contrib
Module:         bind
Announced:      2012-08-06
Credits:        Einar Lonn of IIS.se
Affects:        All supported versions of FreeBSD
Corrected:      2012-08-06 21:33:11 UTC (RELENG_7, 7.4-STABLE)
                2012-08-06 21:33:11 UTC (RELENG_7_4, 7.4-RELEASE-p10)
                2012-07-24 19:04:35 UTC (RELENG_8, 8.3-STABLE)
                2012-08-06 21:33:11 UTC (RELENG_8_3, 8.3-RELEASE-p4)
                2012-08-06 21:33:11 UTC (RELENG_8_2, 8.2-RELEASE-p10)
                2012-08-06 21:33:11 UTC (RELENG_8_1, 8.1-RELEASE-p13)
                2012-07-24 22:32:03 UTC (RELENG_9, 9.1-PRERELEASE)
                2012-08-06 21:33:11 UTC (RELENG_9_0, 9.0-RELEASE-p4)
CVE Name:       CVE-2012-3817

For general information regarding FreeBSD Security Advisories,
including descriptions of the fields above, security branches, and the
following sections, please visit <URL:http://security.FreeBSD.org/>.

I.   Background

BIND 9 is an implementation of the Domain Name System (DNS) protocols.
The named(8) daemon is an Internet Domain Name Server.

DNS Security Extensions (DNSSEC) provides data integrity, origin
authentication and authenticated denial of existence to resolvers.

II.  Problem Description

BIND 9 stores a cache of query names that are known to be failing due
to misconfigured name servers or a broken chain of trust.  Under high
query loads, when DNSSEC validation is active, it is possible for a
condition to arise in which data from this cache of failing queries
could be used before it was fully initialized, triggering an assertion
failure.

III. Impact

A remote attacker that is able to generate high volume of DNSSEC
validation enabled queries can trigger the assertion failure that causes
it to crash, resulting in a denial of service.

IV.  Workaround

No workaround is available, but systems not running the BIND resolving
name server with dnssec-validation enabled are not affected.

V.   Solution

Perform one of the following:

1) Upgrade your vulnerable system to 7-STABLE, 8-STABLE, or 9-STABLE,
or to the RELENG_7_4, RELENG_8_3, RELENG_8_2, RELENG_8_1, or RELENG_9_0
security branch dated after the correction date.

2) To update your vulnerable system via a source code patch:

The following patches have been verified to apply to FreeBSD 7.4,
8.3, 8.2, 8.1 and 9.0 systems.

a) Download the relevant patch from the location below, and verify the
detached PGP signature using your PGP utility.

# fetch http://security.FreeBSD.org/patches/SA-12:05/bind.patch
# fetch http://security.FreeBSD.org/patches/SA-12:05/bind.patch.asc

b) Execute the following commands as root:

# cd /usr/src
# patch < /path/to/patch
# cd /usr/src/lib/bind/dns
# make obj && make depend && make && make install
# cd /usr/src/usr.sbin/named
# make obj && make depend && make && make install

3) To update your vulnerable system via a binary patch:

Systems running 7.4-RELEASE, 8.3-RELEASE, 8.2-RELEASE, 8.1-RELEASE,
or 9.0-RELEASE on the i386 or amd64 platforms can be updated via the
freebsd-update(8) utility:

# freebsd-update fetch
# freebsd-update install

4) Install and run BIND from the Ports Collection after the correction
date.  The following versions and newer versions of BIND installed from
the Ports Collection are not affected by this vulnerability:

        bind96-9.6.3.1.ESV.R7.2
        bind97-9.7.6.2
        bind98-9.8.3.2
        bind99-9.9.1.2

VI.  Correction details

The following list contains the revision numbers of each file that was
corrected in FreeBSD.

CVS:

Branch                                                           Revision
  Path
- -------------------------------------------------------------------------
RELENG_7
  src/contrib/bind9/lib/dns/resolver.c                       1.1.1.9.2.11
RELENG_7_4
  src/UPDATING                                            1.507.2.36.2.12
  src/sys/conf/newvers.sh                                  1.72.2.18.2.15
  src/contrib/bind9/lib/dns/resolver.c                    1.1.1.9.2.8.2.1
RELENG_8
  src/contrib/bind9/CHANGES                                      1.9.2.15
  src/contrib/bind9/lib/dns/resolver.c                            1.3.2.6
  src/contrib/bind9/lib/dns/zone.c                               1.6.2.10
  src/contrib/bind9/lib/isc/random.c                              1.2.2.4
  src/contrib/bind9/version                                      1.9.2.15
RELENG_8_3
  src/UPDATING                                             1.632.2.26.2.6
  src/sys/conf/newvers.sh                                   1.83.2.15.2.8
  src/contrib/bind9/lib/dns/resolver.c                        1.6.2.7.2.1
RELENG_8_2
  src/UPDATING                                            1.632.2.19.2.12
  src/sys/conf/newvers.sh                                  1.83.2.12.2.15
  src/contrib/bind9/lib/dns/resolver.c                        1.6.2.4.2.1
RELENG_8_1
  src/UPDATING                                            1.632.2.14.2.16
  src/sys/conf/newvers.sh                                  1.83.2.10.2.17
  src/contrib/bind9/lib/dns/resolver.c                        1.6.2.3.2.1
RELENG_9
  src/contrib/bind9/CHANGES                                      1.21.2.5
  src/contrib/bind9/lib/dns/resolver.c                           1.15.2.3
  src/contrib/bind9/lib/dns/zone.c                                1.7.2.3
  src/contrib/bind9/version                                      1.21.2.5
RELENG_9_0
  src/UPDATING                                              1.702.2.4.2.6
  src/sys/conf/newvers.sh                                    1.95.2.4.2.8
  src/contrib/bind9/lib/dns/resolver.c                           1.15.4.1
- -------------------------------------------------------------------------

Subversion:

Branch/path                                                      Revision
- -------------------------------------------------------------------------
stable/7/                                                         r239108
releng/7.4/                                                       r239108
stable/8/                                                         r238749
releng/8.3/                                                       r239108
releng/8.2/                                                       r239108
releng/8.1/                                                       r239108
stable/9/                                                         r238756
releng/9.0/                                                       r239108
- -------------------------------------------------------------------------

VII. References

https://kb.isc.org/article/AA-00729

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3817

The latest revision of this advisory is available at
http://security.FreeBSD.org/advisories/FreeBSD-SA-12:05.bind.asc
Share Button

Comments (9)

Muito bom post . Eu só tropeçou em http://www.bsdinfo.com.br e queria dizer que eu realmente gostei de navegar seus posts. Afinal de contas eu vou estar assinando o seu feed rss e eu espero que você escreva novamente em breve! . Desejo-lhe sorte !

We appreciate the compliments and ask if possible that you can share with your contacts.

Thanks and keep watching our blog.

magnífico apresentar, muito informativo . Eu estou querendo saber por que os especialistas deste sector oposto não percebe isso . Você deve continuar a sua escrita. Tenho certeza de que , http://www.bsdinfo.com.br ter uma base de leitores enorme ‘ já ! . manter a sorrir !

We appreciate the compliments and ask if possible that you can share with your contacts.

Thank you.

Tal Web site informativo! Graças grandes ! Obrigado por um bom tempo de visitar http://www.bsdinfo.com.br . É realmente um prazer compreensão de um site como esse cheio de informação legal. Obrigado! abraço!

We appreciate the compliments and ask if possible that you can share with your contacts.

Thank you. And keep following us.

Bem, esse é o meu primeiro check-out para http://www.bsdinfo.com.br ! Somos um grupo de voluntários e começar uma nova iniciativa em uma comunidade regional no nicho exatamente o mesmo. Seu blog nos forneceu informações valiosas para trabalhar. Você fez uma tarefa maravilhosa ! Enviando os meus cumprimentos

I will really love for you for guests posting on http://www.bsdinfo.com.br

You certainly have some agreeable opinions and views. http://www.bsdinfo.com.br provides a fresh look at the subject.

Write a comment

*