Original issue date: August 13, 1997<BR>
Last revised: May 26, 1998<BR>
Updated vendor information for Sun Microsystems
<P>A complete revision history is at the end of this file.
<BR><STRONG>*** This advisory supersedes CA-96.02. ***</STRONG>
<P>Several vulnerabilities in the Berkeley Internet Name Daemon (BIND)
have been fixed in the current version of BIND. One of those vulnerabilities
is now being exploited, a vulnerability that results in cache poisoning
(malicious or misleading data from a remote name server is saved [cached]
by another name server).
<P>The vulnerability has been fixed in BIND version 4.9.6; however, we
recommend upgrading according to our instructions in Section III.B or installing
vendor patches (see Appendix A). We also urge you to take the additional
precautions described in Section III.C.
<P>We will update this advisory as we receive additional information. Please
check our advisory files regularly for updates that relate to your site.
<BR>
<HR>
<H2>I. Description</H2>
<P>The Berkeley Internet Name Daemon (BIND) is an implementation of the
Domain Name Service (DNS) written primarily for UNIX Systems. BIND consists
of three parts:
<UL>
<LI>The client part. This part contains subroutine libraries used by programs
that require DNS services. Example clients of these libraries are telnet,
the X Windows System, and ssh (the secure shell). The client part consists
of subroutine libraries, header files, and manual pages.<BR>
<BR></LI>
<LI>The server part. This part contains the name server daemon (named) and
its support program (named-xfer). These programs provide one source of
the data used for mapping between host names and IP addresses. When appropriately
configured, these name server daemons can interoperate across a network
(the Internet for example) to provide the mapping services for that network.
The server part consists of the daemon, its support programs and scripts,
and manual pages.<BR>
<BR></LI>
<LI>The tools part. This part contains various tools for interrogating name
servers in a network. They use the client part to extract information from
those servers. The tools part consists of these interrogation tools and
manual pages.</LI>
</UL>
As BIND has matured, several vulnerabilities in the client, server, and
tools parts have been fixed. Among these is server cache poisoning. Cache
poisoning occurs when malicious or misleading data received from a remote
name server is saved (cached) by another name server. This "bad" data is
then made available to programs that request the cached data through the
client interface.
<P>Analysis of recent incidents reported to the CERT Coordination Center
has shown that the cache poisoning technique is being used to adversely
affect the mapping between host names and IP addresses. Once this mapping
has been changed, any information sent between hosts on a network may be
subjected to inspection, capture, or corruption.
<P>Although, the new BIND distributions do address important security problems,
not all known problems are fixed. IN particular, several problems
can be fixed only with the use of cryptographic authentication techniques.
Implementing and deploying this solution is non-trivial; work on this task
is currently underway within the Internet community.
<H2>II. Impact</H2>
The mapping between host names and IP addresses may be changed. As a result,
attackers can inspect, capture, or corrupt the information exchanged between
hosts on a network.
<H2>III. Solution</H2>
Install a patch from your vendor or implement the "best practice" workaround
we recommend in Section III.B. In either case, take the extra precautions
described in Section III.C.
<H3>A. Obtain and install a patch for this problem.</H3>
Information from vendors can be found in Appendix A of this advisory; we
will update the appendix as we receive more information.
<H3>B. Until you are able to install the appropriate patch, we recommend the following workaround.</H3>
The "best practice" for operating the publicly available BIND system can
be either:
<UL>
<LI>a heterogeneous solution that involves first installing BIND release 4.9.6
and then release 8.1.1, or</LI>
<LI>a homogeneous solution that involves installing only BIND release 8.1.1.</LI>
</UL>
In the paragraphs below, we describe how to determine which solution you
should use.
<P>Note: Although the security posture in BIND version 8.1.1 is identical
to that of version 4.9.6, version 8.1.1 is the version that will continue
to undergo changes and improvements, hence our selection of its use as
the "best practice."
<H4>1. Shared Object Client Subroutine Library</H4>
If your system and its programs rely on the shared object client subroutine
library that comes with some releases of BIND, probably named libresolv.so,
then you need the shared object subroutine library and other client software
from release 4.9.6. (As of this writing, BIND version 8 does not yet support
the client part as a shared object library.) This client software is available
at
<P><A HREF="ftp://ftp.isc.org/isc/bind/src/4.9.6/bind-4.9.6-REL.tar.gz">ftp://ftp.isc.org/isc/bind/src/4.9.6/bind-4.9.6-REL.tar.gz</A>
<P>MD5 (bind-4.9.6-REL.tar.gz) = 76dd66e920ad0638c8a37545a6531594
<P>Follow the instructions in the file named INSTALL in the top-level directory.
<BR>After installing this client part, install the server and tool parts
from release 8.1.1. This software is available at
<P><A HREF="ftp://ftp.isc.org/isc/bind/src/8.1.1/bind-src.tar.gz">ftp://ftp.isc.org/isc/bind/src/8.1.1/bind-src.tar.gz</A>
<P>MD5 (bind-src.tar.gz) = 7487b8d647edba2053edc1cda0c6afd0
<P>Follow the instructions in the src/INSTALL file. Note that this version
will install the client libraries and header files in a non-standard place,
/usr/local/lib and /usr/local/include. The src/INSTALL file describes what
is being installed and where.
<P>When you install release 4.9.6 first, its client, server, and tools
parts will be installed in the production locations. When you then install
release 8.1.1, the server and tools parts will be overwritten by that release's
versions, but the 4.9.6 client part will not.
<H4>2. No Shared Object Client Subroutine Library</H4>
If you do not need the shared object client subroutine library, then you
need only upgrade to release 8.1.1. This software is available at<A HREF="ftp://ftp.isc.org/isc/bind/src/8.1.1/bind-src.tar.gz"></A>
<P><A HREF="ftp://ftp.isc.org/isc/bind/src/8.1.1/bind-src.tar.gz">ftp://ftp.isc.org/isc/bind/src/8.1.1/bind-src.tar.gz</A>
<P>MD5 (bind-src.tar.gz) = 7487b8d647edba2053edc1cda0c6afd0
<P>Follow the instructions in src/INSTALL. Note that the client subroutine
library and header files are installed in /usr/local/lib and /usr/local/include
respectively. To use these when building other systems, you will need to
refer to their installed locations.
<P>Note: ftp://ftp.isc.org/isc/bind/src/ is mirrored in Germany at <A HREF="ftp://ftp.cert.dfn.de/pub/tools/net/bind/src/">ftp://ftp.cert.dfn.de/pub/tools/net/bind/src/</A>
<P>As new versions of BIND are released in the future, you will be able
to find them at these sites, as well as other mirrors. You can also check
ftp://info.cert.org/pub/latest_sw_versions/ for version information.
<H3>C. Take additional precautions.</H3>
As good security practice in general, filter at a router all name-based
authentication services so that you do not rely on DNS information for
authentication. This includes the services rlogin, rsh (rcp), xhost, NFS,
and any other locally installed services that provide trust based on domain
name information.
<P><HR>
<H2>Appendix A - Vendor Information</H2>
Below is a list of the vendors who have provided information for this advisory.
We will update this appendix as we receive additional information. If you
do not see your vendor's name, the CERT/CC did not hear from that vendor.
Please contact the vendor directly.
<H3>Berkeley Software Design, Inc. (BSDI)</H3>
Patches from BSDI<A HREF="ftp://ftp.bsdi.com/bsdi/patches/patches-2.1/U210-038"></A>
<P><A HREF="ftp://ftp.bsdi.com/bsdi/patches/patches-2.1/U210-038">ftp://ftp.bsdi.com/bsdi/patches/patches-2.1/U210-038</A>
<BR>md5 checksum: 8ce46cd2d1aff3b294a84ae54e82a824
<P><A HREF="ftp://ftp.bsdi.com/bsdi/patches/patches-3.0/M300-025">ftp://ftp.bsdi.com/bsdi/patches/patches-3.0/M300-025</A>
<BR>md5 checksum: d7b5c6094089955cd1af207dab05bc0f
<H3>Cray Research - A Silicon Graphics Company</H3>
Cray Research has determined that the version of BIND shipped with all
current releases of Unicos and Unicos/mk are susceptible to the problem
described in this advisory. We are currently working on upgrading our version
of BIND to the 4.9.6 release.
<H3>Digital Equipment Corporation</H3>
xref CASE ID: SSRT0494U
<P>At the time of writing this document, patches(binary kits) are in progress
and final patch testing is expected to begin soon. Digital will provide
notice of the completion/availability of the patches through AES services
(DIA, DSNlink FLASH) and be available from your normal Digital Support
channel.
<UL>
<DIV ALIGN=right>DIGITAL EQUIPMENT CORPORATION AUG/97</DIV>
</UL>
<H3>Hewlett-Packard Company</H3>
HP is vulnerable. Patches in process.
<H3>IBM Corporation</H3>
IBM is currently working on the following APARs which will be available
soon:
<P>AIX 4.1: IX70236
<BR>AIX 4.2: IX70237
<H4>To Order</H4>
APARs may be ordered using Electronic Fix Distribution (via FixDist) or
from the IBM Support Center. For more information on FixDist, reference
URL:
<P><A HREF="http://service.software.ibm.com/aixsupport/">http://service.software.ibm.com/aixsupport/</A>
<P>or send e-mail to <A HREF="mailto:aixserv@austin.ibm.com">aixserv@austin.ibm.com</A>
with a subject of "FixDist".
<P>IBM and AIX are registered trademarks of International Business Machines
Corporation.
<BR>
<H3>NEC Corporation</H3>
NEC is vulnerable. The systems affected by this problem
<BR>are as follows:
<P>UX/4800
<BR>UX/4800(64)
<BR>EWS-UX/V(Rel4.2MP)
<BR>EWS-UX/V(Rel4.2)
<BR>UP-UX/V(Rel4.2MP)
<P>Patches are in progress and will be made available from
<P><A HREF="ftp://ftp.meshnet.or.jp/pub/48pub/security">ftp://ftp.meshnet.or.jp/pub/48pub/security</A>.
<H3>Siemens-Nixdorf Informationssysteme AG</H3>
We are investigating this problem and will provide updated information
for this advisory when it becomes available.
<H3>The Santa Cruz Operation</H3>
The following SCO operating systems are vulnerable:
<P>- SCO Open Desktop/Open Server 3.0, SCO UNIX 3.2v4
<BR>- SCO OpenServer 5.0
<BR>- SCO UnixWare 2.1
<P>SCO CMW+ 3.0 is not vulnerable as bind is not supported on CMW+ platforms.
<P>SCO has made an interim fix available for anonymous ftp:
<P>ftp://ftp.sco.com/SSE/sse008.ltr.Z - cover letter
<P>ftp://ftp.sco.com/SSE/sse008.tar.Z - replacement binaries
<P>The fix includes binaries for the following SCO operating systems:
<P>- SCO Open Desktop/Open Server 3.0, SCO UNIX 3.2v4
<BR>- SCO OpenServer 5.0
<BR>- SCO UnixWare 2.1
<H3>Sun Microsystems</H3>
<P>
<PRE>The following patches relate to the BIND vulnerability:
SunOS version Patch Id
------------- --------
5.6 105755-03
5.6_x86 105756-03
5.5.1 103663-11
5.5.1_x86 103664-11
5.5 103667-09
5.5_x86 103668-09
5.4 102479-11
5.4_x86 102480-09
5.3 101359-08
Sun recommended security patches (including checksums) are available from:
http://sunsolve.sun.com/sunsolve/pubpatches/patches.html
</PRE>
<BR>
<BR>
<HR>
<P>The CERT Coordination Center staff thanks Paul Vixie and Wolfgang Ley
for their contributions to this advisory.
<P><HR>
<P><HR>
<!--#include virtual="/include/footer_nocopyright.html" -->
<P>Copyright 1997 Carnegie Mellon University.</P>
<HR>
Revision History
<PRE>
May 26, 1998 Updated vendor information for Sun Microsystems
Sept. 30, 1997 Updated copyright statement
Sept. 19, 1997 Appendix A - Added information for BSDI.
Aug. 20, 1997 Introduction - Clarified that 4.9.6 is not vulnerable.
Section III - Added a note why sites should upgrade to 8.1.1.
</PRE>
|