TUCoPS :: Unix :: General :: ciach096.txt

-----BEGIN PGP SIGNED MESSAGE-----
[ For Public Release ] 
 __________________________________________________________
 The U.S. Department of Energy
 Computer Incident Advisory Capability
 ___ __ __ _ ___
 / | /_\ /
 \___ __|__ / \ \___
 __________________________________________________________
 INFORMATION BULLETIN
 Vulnerability in Bind
 (Update to Bulletin G-14, Domain Name Service Vulnerabilities)
August 14, 1997 21:00 GMT Number H-96
______________________________________________________________________________
PROBLEM: Domain Name Service (DNS) servers being exploited, using BIND
 and sendmail weaknesses.
PLATFORM: Systems running any version of BIND before release 8.1.1.
DAMAGE: Data becomes corrupted ("cache poisoning").
SOLUTION: Patches or workarounds are available for several platforms. See
 below.
______________________________________________________________________________
VULNERABILITY Intruders have been able to exploit this vulnerability on DNS
ASSESSMENT: servers. This vulnerability may potentially extend to other
 network services.
______________________________________________________________________________
[Start CERT Advisory]
=============================================================================
CERT* Advisory CA-97.22
Original issue date: August 13, 1997
Last revised: --
Topic: BIND - the Berkeley Internet Name Daemon
- -----------------------------------------------------------------------------
 *** This advisory supersedes CA-96.02. ***
Several vulnerabilities in the Berkeley Internet Name Daemon (BIND) have been
fixed in the current version of BIND. One of those vulnerabilities is now
being exploited, a vulnerability that results in cache poisoning (malicious
or misleading data from a remote name server is saved [cached] by another
name server). All versions of BIND before release 8.1.1 are vulnerable.
The CERT/CC team recommends installing a patch from your vendor (See Appendix
A). Until you can install a vendor patch, we recommend the workaround
described in Section III.B. We also urge you to take the additional
precautions described in Section III.C.
We will update this advisory as we receive additional information. Please
check our advisory files regularly for updates that relate to your site.
- -----------------------------------------------------------------------------
I. Description
 The Berkeley Internet Name Daemon (BIND) is an implementation of the
 Domain Name Service (DNS) written primarily for UNIX Systems. BIND
 consists of three parts:
 * The client part. This part contains subroutine libraries used by
 programs that require DNS services. Example clients of these libraries
 are telnet, the X Windows System, and ssh (the secure shell). The
 client part consists of subroutine libraries, header files, and manual
 pages.
 * The server part. This part contains the name server daemon (named) and
 its support program (named-xfer). These programs provide one source of
 the data used for mapping between host names and IP addresses. When
 appropriately configured, these name server daemons can interoperate
 across a network (the Internet for example) to provide the mapping
 services for that network. The server part consists of the daemon, its
 support programs and scripts, and manual pages.
 * The tools part. This part contains various tools for interrogating
 name servers in a network. They use the client part to extract
 information from those servers. The tools part consists of these
 interrogation tools and manual pages.
 As BIND has matured, several vulnerabilities in the client, server,
 and tools parts have been fixed. Among these is server cache poisoning.
 Cache poisoning occurs when malicious or misleading data received from
 a remote name server is saved (cached) by another name server. This
 "bad" data is then made available to programs that request the cached
 data through the client interface.
 Analysis of recent incidents reported to the CERT Coordination Center
 has shown that the cache poisoning technique is being used to adversely
 affect the mapping between host names and IP addresses. Once this
 mapping has been changed, any information sent between hosts on a
 network may be subjected to inspection, capture, or corruption.
 Although the new BIND distributions do address important security
 problems, not all known problems are fixed. In particular, several
 problems can be fixed only with the use of cryptographic authentication
 techniques. Implementing and deploying this solution is non-trivial;
 work on this task is currently underway within the Internet community.
II. Impact
 The mapping between host names and IP addresses may be changed. As
 a result, attackers can inspect, capture, or corrupt the information
 exchanged between hosts on a network.
III. Solution
 A. Obtain and install a patch for this problem.
 Information from vendors can be found in Appendix A of this advisory;
 we will update the appendix as we receive more information.
 B. Until you are able to install the appropriate patch, we recommend
 the following workaround.
 The "best practice" for operating the publicly available BIND
 system can be either:
 * a heterogeneous solution that involves first installing BIND
 release 4.9.6 and then release 8.1.1, or
 * a homogeneous solution that involves installing only BIND release
 8.1.1.
 In the paragraphs below, we describe how to determine which solution
 you should use.
 1. Shared Object Client Subroutine Library
 If your system and its programs rely on the shared object client
 subroutine library that comes with some releases of BIND, probably
 named libresolv.so, then you need the shared object subroutine
 library and other client software from release 4.9.6. (As of
 this writing, BIND version 8 does not yet support the client
 part as a shared object library.) This client software is
 available at
 ftp://ftp.isc.org/isc/bind/src/4.9.6/bind-4.9.6-REL.tar.gz
 MD5 (bind-4.9.6-REL.tar.gz) = 76dd66e920ad0638c8a37545a6531594
 Follow the instructions in the file named INSTALL in the top-level
 directory.
 After installing this client part, install the server and tool
 parts from release 8.1.1. This software is available at
 ftp://ftp.isc.org/isc/bind/src/8.1.1/bind-src.tar.gz
 MD5 (bind-src.tar.gz) = 7487b8d647edba2053edc1cda0c6afd0
 Follow the instructions in the src/INSTALL file. Note that
 this version will install the client libraries and header files
 in a non-standard place, /usr/local/lib and /usr/local/include.
 The src/INSTALL file describes what is being installed and
 where.
 When you install release 4.9.6 first, its client, server, and
 tools parts will be installed in the production locations. When
 you then install release 8.1.1, the server and tools parts will be
 overwritten by that release's versions, but the 4.9.6 client part
 will not.
 2. No Shared Object Client Subroutine Library
 If you do not need the shared object client subroutine library,
 then you need only upgrade to release 8.1.1. This software is
 available at
 ftp://ftp.isc.org/isc/bind/src/8.1.1/bind-src.tar.gz
 MD5 (bind-src.tar.gz) = 7487b8d647edba2053edc1cda0c6afd0
 Follow the instructions in src/INSTALL. Note that the client
 subroutine library and header files are installed in
 /usr/local/lib and /usr/local/include respectively. To use
 these when building other systems, you will need to refer to
 their installed locations.
 Note: ftp://ftp.isc.org/isc/bind/src/ is mirrored in
 Germany at ftp://ftp.cert.dfn.de/pub/tools/net/bind/src/
 As new versions of BIND are released in the future, you will be able
 to find them at these sites, as well as other mirrors. You can also
 check ftp://info.cert.org/pub/latest_sw_versions/ for version
 information.
 C. Take additional precautions. 
 As good security practice in general, filter at a router all
 name-based authentication services so that you do not rely on DNS
 information for authentication. This includes the services rlogin, rsh
 (rcp), xhost, NFS, and any other locally installed services that
 provide trust based on domain name information.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Appendix A - Vendor Information
Below is a list of the vendors who have provided information for this
advisory. We will update this appendix as we receive additional information.
If you do not see your vendor's name, the CERT/CC did not hear from that
vendor. Please contact the vendor directly.
Cray Research - A Silicon Graphics Company
===========================================
 Cray Research has determined that the version of BIND shipped with all
 current releases of Unicos and Unicos/mk are susceptible to the problem
 described in this advisory. We are currently working on upgrading our
 version of BIND to the 4.9.6 release.
Digital Equipment Corporation
=============================
xref CASE ID: SSRT0494U
 At the time of writing this document, patches(binary kits) are in
 progress and final patch testing is expected to begin soon.
 Digital will provide notice of the completion/availability of the
 patches through AES services (DIA, DSNlink FLASH) and be
 available from your normal Digital Support channel.
 DIGITAL EQUIPMENT CORPORATION AUG/97
 ----------------------------- ------
Hewlett-Packard Company
=======================
 HP is vulnerable. Patches in process.
IBM Corporation
===============
 IBM is currently working on the following APARs which will be
 available soon:
 AIX 4.1: IX70236
 AIX 4.2: IX70237
 To Order
 --------
 APARs may be ordered using Electronic Fix Distribution (via FixDist)
 or from the IBM Support Center. For more information on FixDist,
 reference URL:
 http://service.software.ibm.com/aixsupport/
 or send e-mail to aixserv@austin.ibm.com with a subject of "FixDist".
 IBM and AIX are registered trademarks of International Business Machines
 Corporation.
NEC Corporation
===============
 NEC is vulnerable. The systems affected by this problem
 are as follows:
 UX/4800
 UX/4800(64)
 EWS-UX/V(Rel4.2MP)
 EWS-UX/V(Rel4.2)
 UP-UX/V(Rel4.2MP)
 Patches are in progress and will be made available from
 ftp://ftp.meshnet.or.jp/pub/48pub/security.
Siemens-Nixdorf Informationssysteme AG
======================================
 We are investigating this problem and will provide updated information
 for this advisory when it becomes available.
The Santa Cruz Operation
========================
 The following SCO operating systems are vulnerable: 
 - SCO Open Desktop/Open Server 3.0, SCO UNIX 3.2v4
 - SCO OpenServer 5.0
 - SCO UnixWare 2.1
 SCO CMW+ 3.0 is not vulnerable as bind is not supported on CMW+ platforms.
 SCO has made an interim fix available for anonymous ftp:
 ftp://ftp.sco.com/SSE/sse008.ltr.Z - cover letter
 ftp://ftp.sco.com/SSE/sse008.tar.Z - replacement binaries
 The fix includes binaries for the following SCO operating systems:
 - SCO Open Desktop/Open Server 3.0, SCO UNIX 3.2v4
 - SCO OpenServer 5.0
 - SCO UnixWare 2.1
Sun Microsystems, Inc.
======================
 We are producing patches.
- -----------------------------------------------------------------------------
The CERT Coordination Center staff thanks Paul Vixie and Wolfgang Ley for
their contributions to this advisory.
- -----------------------------------------------------------------------------
If you believe that your system has been compromised, contact the CERT
Coordination Center or your representative in the Forum of Incident Response
and Security Teams (see http://www.first.org/team-info/).
CERT/CC Contact Information
- -----------------------------
Email cert@cert.org
Phone +1 412-268-7090 (24-hour hotline)
 CERT personnel answer 8:30-5:00 p.m. EST(GMT-5) / EDT(GMT-4)
 and are on call for emergencies during other hours.
Fax +1 412-268-6989
Postal address
 CERT Coordination Center
 Software Engineering Institute
 Carnegie Mellon University
 Pittsburgh PA 15213-3890
 USA
Using encryption
 We strongly urge you to encrypt sensitive information sent by email. We can
 support a shared DES key or PGP. Contact the CERT/CC for more information.
 Location of CERT PGP key
 ftp://info.cert.org/pub/CERT_PGP.key
Getting security information
 CERT publications and other security information are available from
 http://www.cert.org/
 ftp://info.cert.org/pub/
 CERT advisories and bulletins are also posted on the USENET newsgroup
 comp.security.announce
 To be added to our mailing list for advisories and bulletins, send
 email to
 cert-advisory-request@cert.org
 In the subject line, type
 SUBSCRIBE your-email-address
- ----------------------------------------------------------------------------
Copyright 1997 Carnegie Mellon University. Conditions apply; they can be found
in http://www.cert.org/legal_stuff.html and
ftp://info.cert.org/pub/legal_stuff. If you do not have FTP or web access,
send mail to cert@cert.org with "copyright" in the subject line.
*CERT is registered in the U.S. Patent and Trademark Office.
- ---------------------------------------------------------------------------
This file: ftp://info.cert.org/pub/cert_advisories/CA-97.22.bind
 http://www.cert.org
 click on "CERT Advisories"
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Revision history
[End CERT Advisory]
______________________________________________________________________________
CIAC wishes to acknowledge the contributions of CERT for the
information contained in this bulletin.
______________________________________________________________________________
CIAC, the Computer Incident Advisory Capability, is the computer
security incident response team for the U.S. Department of Energy
(DOE) and the emergency backup response team for the National
Institutes of Health (NIH). CIAC is located at the Lawrence Livermore
National Laboratory in Livermore, California. CIAC is also a founding
member of FIRST, the Forum of Incident Response and Security Teams, a
global organization established to foster cooperation and coordination
among computer security teams worldwide.
CIAC services are available to DOE, DOE contractors, and the NIH. CIAC
can be contacted at:
 Voice: +1 510-422-8193
 FAX: +1 510-423-8002
 STU-III: +1 510-423-2604
 E-mail: ciac@llnl.gov
For emergencies and off-hour assistance, DOE, DOE contractor sites,
and the NIH may contact CIAC 24-hours a day. During off hours (5PM -
8AM PST), call the CIAC voice number 510-422-8193 and leave a message,
or call 800-759-7243 (800-SKY-PAGE) to send a Sky Page. CIAC has two
Sky Page PIN numbers, the primary PIN number, 8550070, is for the CIAC
duty person, and the secondary PIN number, 8550074 is for the CIAC
Project Leader.
Previous CIAC notices, anti-virus software, and other information are
available from the CIAC Computer Security Archive.
 World Wide Web: http://ciac.llnl.gov/
 Anonymous FTP: ciac.llnl.gov (198.128.39.53)
 Modem access: +1 (510) 423-4753 (28.8K baud)
 +1 (510) 423-3331 (28.8K baud)
CIAC has several self-subscribing mailing lists for electronic
publications:
1. CIAC-BULLETIN for Advisories, highest priority - time critical
 information and Bulletins, important computer security information;
2. CIAC-NOTES for Notes, a collection of computer security articles;
3. SPI-ANNOUNCE for official news about Security Profile Inspector
 (SPI) software updates, new features, distribution and
 availability;
4. SPI-NOTES, for discussion of problems and solutions regarding the
 use of SPI products.
Our mailing lists are managed by a public domain software package
called Majordomo, which ignores E-mail header subject lines. To
subscribe (add yourself) to one of our mailing lists, send the
following request as the E-mail message body, substituting
ciac-bulletin, ciac-notes, spi-announce OR spi-notes for list-name:
E-mail to ciac-listproc@llnl.gov or majordomo@tholia.llnl.gov:
 subscribe list-name
 e.g., subscribe ciac-notes
You will receive an acknowledgment email immediately with a confirmation
that you will need to mail back to the addresses above, as per the
instructions in the email. This is a partial protection to make sure
you are really the one who asked to be signed up for the list in question.
If you include the word 'help' in the body of an email to the above address,
it will also send back an information file on how to subscribe/unsubscribe,
get past issues of CIAC bulletins via email, etc.
PLEASE NOTE: Many users outside of the DOE, ESnet, and NIH computing
communities receive CIAC bulletins. If you are not part of these
communities, please contact your agency's response team to report
incidents. Your agency's team will coordinate with CIAC. The Forum of
Incident Response and Security Teams (FIRST) is a world-wide
organization. A list of FIRST member organizations and their
constituencies can be obtained via WWW at http://www.first.org/.
This document was prepared as an account of work sponsored by an
agency of the United States Government. Neither the United States
Government nor the University of California nor any of their
employees, makes any warranty, express or implied, or assumes any
legal liability or responsibility for the accuracy, completeness, or
usefulness of any information, apparatus, product, or process
disclosed, or represents that its use would not infringe privately
owned rights. Reference herein to any specific commercial products,
process, or service by trade name, trademark, manufacturer, or
otherwise, does not necessarily constitute or imply its endorsement,
recommendation or favoring by the United States Government or the
University of California. The views and opinions of authors expressed
herein do not necessarily state or reflect those of the United States
Government or the University of California, and shall not be used for
advertising or product endorsement purposes.
LAST 10 CIAC BULLETINS ISSUED (Previous bulletins available from CIAC)
H-86: ld.so Vulnerability
H-87: HP-UX rlogin Vulnerability
H-88: SGI IRIX talkd Vulnerability
H-89: SunSO talkd Buffer Overrun Vulnerability
H-90: SunOS, Solaris NIS+ Vulnerability
H-91: HP-UX Large UID's and GID's Vulnerability
H-92: HP-UX X11/Motif Lib & Novell Netware Vulerabilities
H-93: SGI IRIX ordist Buffer Overrun Vulnerability
H-94: SunOS Vulnerability in ps
H-95: SunOS Vulnerability in x-lock
-----BEGIN PGP SIGNATURE-----
Version: 4.0 Business Edition
iQCVAwUBM/SEh7nzJzdsy3QZAQGg0AP+Nq1twg0ExWg/s0FuJ30Q3aA5f1rZ6H0/
hkWkIh6WMOlbkLhGstboRKpr+nn3Lm06mNlbKCGDrEEpL3gxWSldNRTapXHW2bJM
TlajsNj7idUhAtFZPtUQIJE1GzZpUEsoZG91k8oU4FgWO+FNNjEJxJW3WtGwGkW/
a3VHqySP93c=
=GZ5b
-----END PGP SIGNATURE-----