Security vulnerabilities in ISC BIND 9

Internet Systems Consortium today released two new security advisories detailing a couple of newly found security issues within ISC BIND 9.

ISC BIND 9 Remote packet Denial of Service against Authoritative and Recursive Servers

A defect in the affected versions of BIND could cause the “named” process to exit when queried, if the server has recursion enabled and was configured with an RPZ zone containing certain types of records. Specifically, these are any DNAME record and certain kinds of CNAME records.

The patch release of BIND 9.8.0-P4 alters the behavior of RPZ zones by ignoring any DNAME records in an RPZ zone, and correctly returning CNAME records from RPZ zones. (Details)

ISC BIND 9 Remote Crash with Certain RPZ Configurations

A defect in the affected BIND 9 versions allows an attacker to remotely cause the “named” process to exit using a specially crafted packet. This defect affects both recursive and authoritative servers. The code location of the defect makes it impossible to protect BIND using ACLs configured within named.conf or by disabling any features at compile-time or run-time.

A remote attacker would need to be able to send a specially crafted packet directly to a server running a vulnerable version of BIND. There is also the potential for an indirect attack via malware that is inadvertently installed and run, where infected machines have direct access to an organization’s nameservers. (Details)