Next Page >>
DNSSEC
=============================================================================
FreeBSD-SA-10:01.bind Security Advisory
The FreeBSD Project
Topic: BIND named(8) cache poisoning with DNSSEC validation
Category: contrib
Module: bind
Announced: 2010-01-06
Credits: Michael Sinatra
=============================================================================
FreeBSD-SA-09:04.bind Security Advisory
The FreeBSD Project
Topic: BIND DNSSEC incorrect checks for malformed signatures
Category: contrib
Module: bind
Announced: 2009-01-13
Credits: Google Security Team
Some vulnerabilities were discovered and corrected in bind:
The original fix for CVE-2009-4022 was found to be incomplete. BIND
was incorrectly caching certain responses without performing proper
DNSSEC validation. CNAME and DNAME records could be cached, without
proper DNSSEC validation, when received from processing recursive
client queries that requested DNSSEC records but indicated that
checking should be disabled. A remote attacker could use this flaw
to bypass the DNSSEC validation check and perform a cache poisoning
attack if the target BIND server was receiving such client queries
Problem type : remote
Debian-specific: no
CVE Id(s) : CVE-2010-0097 CVE-2010-0290 CVE-2010-0382
Several cache-poisoning vulnerabilities have been discovered in BIND.
These vulnerabilities are apply only if DNSSEC validation is enabled and
trust anchors have been installed, which is not the default.
The Common Vulnerabilities and Exposures project identifies the
following problems:
This update restores the PID file location for bind to the location
before the last security update. For reference, here is the original
advisory text that explains the security problems fixed:
Several cache-poisoning vulnerabilities have been discovered in BIND.
These vulnerabilities are apply only if DNSSEC validation is enabled and
trust anchors have been installed, which is not the default.
The Common Vulnerabilities and Exposures project identifies the
following problems:
* hosted products are VMware Workstation, Player, ACE, Server, Fusion.
e. vMA and Service Console package bind updated to 9.3.6-4.P1.el5_4.1
It was discovered that BIND was incorrectly caching responses
without performing proper DNSSEC validation, when those responses
were received during the resolution of a recursive client query
that requested DNSSEC records but indicated that checking should be
disabled. A remote attacker could use this flaw to bypass the DNSSEC
validation check and perform a cache poisoning attack if the target
BIND server was receiving such client queries.
Vulnerability : denial of service
Problem type : remote
Debian-specific: no
The BIND, a DNS server, contains a defect related to the processing of
new DNSSEC DS records by the caching resolver, which may lead to name
resolution failures in the delegated zone. If DNSSEC validation is
enabled, this issue can make domains ending in .COM unavailable when
the DS record for .COM is added to the DNS root zone on March 31st,
2011. An unpatched server which is affected by this issue can be
restarted, thus re-enabling resolution of .COM domains.
I. Background
BIND 9 is an implementation of the Domain Name System (DNS) protocols.
The named(8) daemon is an Internet Domain Name Server.
DNS Security Extensions (DNSSEC) provides data integrity, origin
authentication and authenticated denial of existence to resolvers.
II. Problem Description
Very large RRSIG RRsets included in a negative response can trigger
through dynamic DNS updates or incremental zone transfer (IXFR). Such
an update while processing a query could result in deadlock and denial
of service. (CVE-2011-0414)
In addition, this security update addresses a defect related to the
processing of new DNSSEC DS records by the caching resolver, which may
lead to name resolution failures in the delegated zone. If DNSSEC
validation is enabled, this issue can make domains ending in .COM
unavailable when the DS record for .COM is added to the DNS root zone
on March 31st, 2011. An unpatched server which is affected by this
issue can be restarted, thus re-enabling resolution of .COM domains.
Some vulnerabilities were discovered and corrected in bind:
Unspecified vulnerability in ISC BIND 9.4 before 9.4.3-P4, 9.5
before 9.5.2-P1, 9.6 before 9.6.1-P2, 9.7 beta before 9.7.0b3,
and 9.0.x through 9.3.x with DNSSEC validation enabled and checking
disabled (CD), allows remote attackers to conduct DNS cache poisoning
attacks via additional sections in a response sent for resolution
of a recursive client query, which is not properly handled when the
response is processed at the same time as requesting DNSSEC records
(DO). (CVE-2009-4022).
necessary changes.
Details follow:
It was discovered that Bind would incorrectly cache bogus NXDOMAIN
responses. When DNSSEC validation is in use, a remote attacker could
exploit this to cause a denial of service, and possibly poison DNS caches.
(CVE-2010-0097)
USN-865-1 provided updated Bind packages to fix a security vulnerability.
The upstream security patch to fix CVE-2009-4022 was incomplete and
>
> Perhaps it's more politically convenient to leave blind attacks in place
> in order to push other agenda? It seems invariably those making the
> all-or-nothing argument that 16 bits (in reality 30 bits if you get off
> your ass and think about it) is not enough entropy no matter the
> generator are all too often pushing DNSSEC in the very next sentence.
> I'm not saying DNSSEC is good or bad, and it is designed to remedy more
> than just blind attacks, but it's unethical to ignore a problem that can
> be mitigated in the short term just so a new technology can be forced
> down people's throats in the long term.
https://www.isc.org/node/373
http://groups.google.com/group/comp.protocols.dns.bind/browse_thread/thread/49ef622c8329fd33
Description:
Previous versions of BIND incorrectly interpret the return value of the
OpenSSL DSA_do_verify function. On systems using DNSSEC, a malicious zone
could present a malformed DSA certificate and bypass proper certificate
validation, allowing spoofing attacks.
rPath Linux does not ship with DNSSEC enabled, and therefore is not, by
default, vulnerable to this attack.
Perhaps it's more politically convenient to leave blind attacks in place
in order to push other agenda? It seems invariably those making the
all-or-nothing argument that 16 bits (in reality 30 bits if you get off
your ass and think about it) is not enough entropy no matter the
generator are all too often pushing DNSSEC in the very next sentence.
I'm not saying DNSSEC is good or bad, and it is designed to remedy more
than just blind attacks, but it's unethical to ignore a problem that can
be mitigated in the short term just so a new technology can be forced
down people's throats in the long term.
Problem type : remote
Debian-specific: no
CVE ID : CVE-2009-4008
It was discovered that Unbound, a caching DNS resolver, ceases to
provide answers for zones signed using DNSSEC after it has processed a
crafted query. (CVE-2009-4008)
In addition, this update improves the level of DNSSEC support in the
lenny version of Unbound so that it is possible for system
administrators to configure the trust anchor for the root zone.
> > And because mail server name and email address does not need to be any
> > connection also checking of signature of certificate agaist CA does not
> > help much. It does not protect attack agaist MX records on DNS.
>
> true - so in an ideal world, we would need DNSSec everywhere and strict
> certificate checking to significantly reduce the possibility of MiTM
> attacks. In a not so ideal world, every little bit helps, so if we can
> get mail servers to routinely use encryption between each other, that's
> a nice first step and using valid certificates that can actually be
> verified is a second one. Both will help significantly already.
named in ISC BIND 9.x before 9.6.2-P3, 9.7.x before 9.7.2-P3,
9.4-ESV before 9.4-ESV-R4, and 9.6-ESV before 9.6-ESV-R3 does not
properly determine the security status of an NS RRset during a DNSKEY
algorithm rollover, which might allow remote attackers to cause a
denial of service (DNSSEC validation error) by triggering a rollover
(CVE-2010-3614).
ISC BIND before 9.7.2-P2, when DNSSEC validation is enabled, does
not properly handle certain bad signatures if multiple trust anchors
exist for a single zone, which allows remote attackers to cause a
Some vulnerabilities were discovered and corrected in bind:
Unspecified vulnerability in ISC BIND 9.4 before 9.4.3-P4, 9.5
before 9.5.2-P1, 9.6 before 9.6.1-P2, 9.7 beta before 9.7.0b3,
and 9.0.x through 9.3.x with DNSSEC validation enabled and checking
disabled (CD), allows remote attackers to conduct DNS cache poisoning
attacks via additional sections in a response sent for resolution
of a recursive client query, which is not properly handled when the
response is processed at the same time as requesting DNSSEC records
(DO). (CVE-2009-4022).
Synopsis
========
Incomplete verification of RSA and DSA certificates might lead to
spoofed records authenticated using DNSSEC.
Background
==========
ISC BIND is the Internet Systems Consortium implementation of the
AOL, VISA etc (really good). An attacker would still be able to setup a 'test'
root CA and make you accept it's cert for that 'test' DNS universe-part (bad).
It seems to me more of a DNS problem than a x509 problem.
If that's the case we should tend in using protocols for securing the DNS system,
like DNSSEC or something better.
x509 and TLS is really nice and helps even in that.
cheers,
Giannis
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0290
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0382
Description:
In previous versions of BIND, there have been several vulnerabilities
reported related to cache poisoning of systems where DNSSEC is enabled.
To address these issues, BIND has been updated to 9.4.3-P5 in both
rPath Linux 1 and 2.
For rPL 1, this update includes a library version change, so the
older package versions have been promoted to the rpl:1-compat label.
The first vulnerable version, 0.9.8c-1, was uploaded to the unstable
distribution on 2006-09-17, and has since propagated to the testing and
current stable (etch) distributions. The old stable distribution
(sarge) is not affected.
Affected keys include SSH keys, OpenVPN keys, DNSSEC keys, and key
material for use in X.509 certificates and session keys used in SSL/TLS
connections. Keys generated with GnuPG or GNUTLS are not affected,
though.
A detector for known weak key material will be published at:
_______________________________________________________________________
Problem Description:
A flaw was found in how BIND checked the return value of the OpenSSL
DSA_do_verify() function. On systems that use DNSSEC, a malicious zone
could present a malformed DSA certificate and bypass proper certificate
validation, which would allow for spoofing attacks (CVE-2009-0025).
The updated packages have been patched to prevent this issue.
_______________________________________________________________________
Michael Sinatra discovered that the DNS resolver component in BIND
does not properly check DNS records contained in additional sections
of DNS responses, leading to a cache poisoning vulnerability. This
vulnerability is only present in resolvers which have been configured
with DNSSEC trust anchors, which is still rare.
Note that this update contains an internal ABI change, which means
that all BIND-related packages (bind9, dnsutils and the library
packages) must be updated at the same time (preferably using "apt-get
update" and "apt-get upgrade"). In the unlikely event that you have
CVE Id(s) : CVE-2009-0025
It was discovered that BIND, an implementation of the DNS protocol
suite, does not properly check the result of an OpenSSL function which
is used to verify DSA cryptographic signatures. As a result,
incorrect DNS resource records in zones protected by DNSSEC could be
accepted as genuine.
For the stable distribution (etch), this problem has been fixed in
version 9.3.4-2etch4.
odd to have to keep fixing it-- i fixed it in bind4 and bind8 when theo
de raadt offered me his random number generator to use. bind9 should've
used that same one but apparently didn't. note that with this fix, the
difficulty in poisoning someone's cache rises from "a few tens of seconds"
to "a few minutes". it's a 16-bit field. not a lot of room for
randomness or unpredictability. only DNSSEC, a protocol change, fixes
this problem, which is fundamentally a protocol problem. but since folks
just won't leave it alone and keep on reporting it year after decade, we
will keep on improving our random number generator for this dinky little
16-bit field. i just wish the reporters wouldn't be so smarmy and self
congradulatory about it. it's not like this hasn't been reported, and
necessary changes.
Details follow:
It was discovered that Bind did not properly perform certificate verification.
When DNSSEC with DSA certificates are in use, a remote attacker could exploit
this to bypass certificate validation to spoof DNS entries and poison DNS
caches. Among other things, this could lead to misdirected email and web
traffic.
b. Update bind package for the Service Console fixes a security issue.
A flaw was discovered in the way Berkeley Internet Name Domain
(BIND) checked the return value of the OpenSSL DSA_do_verify
function. On systems using DNSSEC, a malicious zone could present
a malformed DSA certificate and bypass proper certificate
validation, allowing spoofing attacks.
The Common Vulnerabilities and Exposures project (cve.mitre.org)
has assigned the name CVE-2009-0025 to this issue.
Several remote vulnerabilities have been discovered in BIND, an
implementation of the DNS protocol suite. The Common Vulnerabilities
and Exposures project identifies the following problems:
CVE-2010-3762
When DNSSEC validation is enabled, BIND does not properly
handle certain bad signatures if multiple trust anchors exist
for a single zone, which allows remote attackers to cause a
denial of service (server crash) via a DNS query.
CVE-2010-3614
David Bryan - Hacking with GnuRadio
Don Ankney - Is XSS Solveable?
Jim O’Gorman - Policy - The Biscuit Game of Infosec
Datagram - Lockpicking Forensics
Kevin Nassery - Diplomatic Security Consulting
Erik Berls - Deploying DNSSEC
Joe McCray - Advanced SQL Injection
Strom Carlson - Why your mother will never care about Linux
Deviant Ollam - Packing and the Friendly Skies
CP, Adam, Frank^2, Vyrus - TwatFS: Surly abuse of social networking bandwidth
Ryan S. Upton, CISSP - Incident Response 101
Next Page>>
|
