-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 NetBSD Security Advisory 2015-002 ================================= Topic: bind Denial of Service (CVE-2014-8500) Version: NetBSD-current: source prior to Dec 10, 2014 NetBSD 7 Beta: affected NetBSD 6.1: affected NetBSD 6.0: affected NetBSD 5.2: affected NetBSD 5.1: affected Severity: Denial of Service Fixed: NetBSD-current: Dec 11, 2014 NetBSD-7 branch: Jan 06, 2015 NetBSD-6 branch: Jan 06, 2015 NetBSD-6-1 branch: Jan 06, 2015 NetBSD-6-0 branch: Jan 06, 2015 NetBSD-5 branch: Dec 26, 2014 NetBSD-5-2 branch: Dec 26, 2014 NetBSD-5-1 branch: Dec 26, 2014 Please note that NetBSD releases prior to 5.1 are no longer supported. It is recommended that all users upgrade to a supported release. Abstract ======== A lack of defense against arbitrarily long delegation chains can be exploited to crash bind. This primarily concerns resolvers that resolve third-party controlled domains; authoritative servers can only be affected if an attacker can control a delegation that the authoritative server needs to traverse to service the zone. This vulnerability has been assigned CVE-2014-8500. Technical Details ================= By making use of maliciously-constructed zones or a rogue server, an attacker can exploit an oversight in the code BIND uses to follow delegations in the Domain Name Service, causing BIND to issue unlimited queries in an attempt to follow the delegation. This can lead to resource exhaustion and denial of service (up to and including termination of the named server process.) The fix introduces a config setting to determine at which length named will stop following the delegation chain and return a failure instead. Solutions and Workarounds ========================= There is no practical workaround (the impractical is not to try to resolve malicious zones). Solutions: + Install and use a bind package from pkgsrc. + Update named from a daily build later than the fix date: fetch from http://nyftp.NetBSD.org/pub/NetBSD-daily//// the file binary/sets/base.tgz for all releases: cd / && tar xzpf ./usr/sbin/named \ ./usr/lib/libbind9.so\* \ ./usr/lib/libisc.so\* \ ./usr/lib/libdns.so\* \ ./usr/lib/libisccfg.so\* \ ./usr/lib/liblwres.so\* \ ./usr/lib/libisccc.so\* If you use debug or profiling libraries or build static binaries with bind libs, also install the updated versions from the comp.tgz or debug.tgz. + Rebuild your system with the fixes applied. NetBSD-current, NetBSD-7, NetBSD-6: For better maintainability bind was updated to the latest ISC release of the bind branch. This means updating just the files containing the vulnerable code won't work. Updating src/external/bsd/bind also won't be enough since all the bind libraries got version bumps, and src/distrib/sets/lists/* will also need selective updates. For this reason, updating the entire src tree and recompiling is recommended. NetBSD-5: fixed versions are (relative to src/dist/bind): File netbsd-5 netbsd-5-2 netbsd-5-1 bin/named/config.c 1.1.1.8.4.5 1.1.1.8.4.4.2.1 1.1.1.8.4.1.2.4 bin/named/query.c 1.8.4.9 1.8.4.7.2.2 1.8.4.2.2.7 bin/named/server.c 1.1.1.9.4.5 1.1.1.9.4.4.2.1 1.1.1.9.4.1.2.4 lib/dns/adb.c 1.6.4.5 1.6.4.4.2.1 1.6.4.1.2.4 lib/dns/resolver.c 1.8.4.7 1.8.4.6.2.1 1.8.4.2.2.5 lib/dns/include/dns/adb.h 1.1.1.5.4.4 1.1.1.5.4.3.2.1 1.1.1.5.12.4 lib/dns/include/dns/resolver.h 1.1.1.5.4.5 1.1.1.5.4.4.2.1 1.1.1.5.4.1.2.4 lib/export/isc/Makefile.in 1.1.2.4 1.1.2.3.2.1 1.1.4.5 lib/isc/Makefile.in 1.1.1.6.4.5 1.1.1.6.4.4.2.1 1.1.1.6.4.1.2.4 lib/isc/include/isc/Makefile.in 1.1.1.5.4.5 1.1.1.5.4.4.2.1 1.1.1.5.4.1.2.4 lib/isc/include/isc/types.h 1.1.1.5.4.5 1.1.1.5.4.4.2.1 1.1.1.5.4.1.2.4 lib/isccfg/namedconf.c 1.1.1.7.4.5 1.1.1.7.4.4.2.1 1.1.1.7.4.1.2.4 lib/isc/counter.c 1.1.2.1 1.1.4.2 1.1.6.2 lib/isc/include/isc/counter.h 1.1.2.1 1.1.4.2 1.1.6.2 supporting files: src/lib/libisc/Makefile 1.2.4.3 1.2.4.2.2.1 1.2.4.1.2.2 src/usr.sbin/bind/Makefile.inc 1.32.4.2 1.32.4.1.2.1 1.32.12.2 To update from CVS, re-build and re-install the system: # cd src # cvs update -d -P -r VERSION FILE # cd lib/isc # make USETOOLS=no cleandir dependall # make USETOOLS=no install # cd ../dns # make USETOOLS=no cleandir dependall # make USETOOLS=no install # cd ../isccfg # make USETOOLS=no cleandir dependall # make USETOOLS=no install # cd ../../bin/named # make USETOOLS=no cleandir dependall # make USETOOLS=no install Thanks To ========= Thanks to Florian Maury (ANSSI) for reporting this issue and the ISC security team for their advisory (https://kb.isc.org/article/AA-01216), which is cited by this advisory. Revision History ================ 2015-01-08 Initial release More Information ================ Advisories may be updated as new information becomes available. The most recent version of this advisory (PGP signed) can be found at http://ftp.NetBSD.org/pub/NetBSD/security/advisories/NetBSD-SA2015-002.txt.asc Information about NetBSD and NetBSD security can be found at http://www.NetBSD.org/ and http://www.NetBSD.org/Security/ . Copyright 2015, The NetBSD Foundation, Inc. All Rights Reserved. Redistribution permitted only in full, unmodified form. $NetBSD: NetBSD-SA2015-002.txt,v 1.1 2015/01/08 21:02:23 tonnerre Exp $ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIcBAEBAgAGBQJUrvCMAAoJEAZJc6xMSnBuWqEP/1knhCOQEuvxqC9SBl3wWc// ft5enLBImScO3ImloLJYeudB79vbtNInPKT940bLEJ5H3KPrb4XEn/tR9PwKYpqU bLphpvS0Xa9vC3McV2Cm+dum62g197DsDHVHYSUSQhPPIT/TV+vpVi4OZn0BNXin hIFPIRszHdrP6fLCNNjdU7CQ8r0/ZEexCWJ+5EAlpYFXj6n117S8lWl3ctpTXFhk 47ekUAyz5BqQxUxntPbt/klRJOqSqUxeKfeFgOCATdu3PGKhvvr9rT31A7bOwCaZ hPvCMFZ9TmZY5OvtsoBTseosWG1R9kJL8hByQP1NFT39Kyu3Tf/A+mf3gt/MXJGT uk7QTGkvqbffYOU69iSbdWwntbMUHub21CTkJfgKF57CSpvhj2QpwqhB6x+buqB7 MpLzXDxaXX/OJ5eP834Zp7hnjqiMh5C4VUveqQKGPZAx9HKwzw8w4r5CX/7csJzk MFn5j+78GceOGyroA9cy42mbZqlut6ys9RYKrqgqSq4PFSt4kpRB/YpzAeEJ0UCd 2ca1zD55m07cIM8WeMkOJxU3ebCJgbA4ZJXKXQYdoBG8SUftXZxlukxJTWe/NRBI oqri17ana3COpu+5ybxc0Y5eizrYrZPbCnOZw89bQdnphCOUdNrWG9Efm8t59iz7 BCyaTaPxTMCHbxfFMriC =gNcZ -----END PGP SIGNATURE-----