**************************************************************************
Security Bulletin 9721 DISA Defense Communications System
August 14, 1997 Published by: DISN Security Coordination Center
(SCC@NIC.MIL) 1-(800) 365-3642
The DISN SECURITY BULLETIN is distributed by the DISN SCC (Security Coordination Center) under DISA contract as a means of communicating information on network and host security exposures, fixes, and concerns to security and management personnel at DISN facilities. Back issues may be obtained via FTP from NIC.MIL [207.132.116.5] using login= "anonymous" and password="guest". The bulletin pathname is scc/sec-yynn (where "yy" is the year the bulletin is issued and "nn" is a bulletin number, e.g. scc/sec-9705.txt). These are also available at our WWW site, http://nic.mil.
**************************************************************************
+ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - +
! !
! The following important advisory was issued by the Computer !
! Emergency Response Team (CERT) and is being relayed unedited !
! via the Defense Information Systems Agency's Security !
! Coordination Center distribution system as a means of !
! providing DISN subscribers with useful security information. !
! !
+ - - - - - - - - - - - - - - - - - - - - - - - -
- - - - - - - - - - - +
- -----------------------------------------------------------------------------
Several vulnerabilities in the Berkeley Internet Name Daemon (BIND) have been fixed in the current version of BIND. One of those vulnerabilities is now being exploited, a vulnerability that results in cache poisoning (malicious or misleading data from a remote name server is saved [cached] by another name server). All versions of BIND before release 8.1.1 are vulnerable.
The CERT/CC team recommends installing a patch from your vendor (See Appendix A). Until you can install a vendor patch, we recommend the workaround described in Section III.B. We also urge you to take the additional precautions described in Section III.C.
We will update this advisory as we receive additional information. Please check our advisory files regularly for updates that relate to your site.
- -----------------------------------------------------------------------------
The Berkeley Internet Name Daemon (BIND) is an implementation of the Domain Name Service (DNS) written primarily for UNIX Systems. BIND consists of three parts:
The mapping between host names and IP addresses may be changed. As a result, attackers can inspect, capture, or corrupt the information exchanged between hosts on a network.
Information from vendors can be found in Appendix
A of this advisory; we will update the appendix as we receive
more information.
The "best practice" for operating the publicly available BIND system can be either:
ftp://ftp.isc.org/isc/bind/src/4.9.6/bind-4.9.6-REL.tar.gz
MD5 (bind-4.9.6-REL.tar.gz) = 76dd66e920ad0638c8a37545a6531594
Follow the instructions in the file named INSTALL in the top-level directory.
After installing this client part, install the server and tool
parts from release 8.1.1. This software is available at
ftp://ftp.isc.org/isc/bind/src/8.1.1/bind-src.tar.gz
MD5 (bind-src.tar.gz) = 7487b8d647edba2053edc1cda0c6afd0
Follow the instructions in the src/INSTALL file. Note that this version will install the client libraries and header files in a non-standard place, /usr/local/lib and /usr/local/include. The src/INSTALL file describes what is being installed and where.
When you install release 4.9.6 first, its client, server, and tools parts will be installed in the production locations. When you then install release 8.1.1, the server and tools parts will be overwritten by that release's versions, but the 4.9.6 client part will not.
2. No Shared Object Client Subroutine Library
If you do not need the shared object client subroutine library,
then you need only upgrade to release 8.1.1. This software is
available at
ftp://ftp.isc.org/isc/bind/src/8.1.1/bind-src.tar.gz
MD5 (bind-src.tar.gz) = 7487b8d647edba2053edc1cda0c6afd0
Follow the instructions in src/INSTALL. Note that
the client subroutine library and header files are installed in
/usr/local/lib and /usr/local/include respectively. To use these
when building other systems, you will need to refer to their installed
locations.
Note: ftp://ftp.isc.org/isc/bind/src/ is mirrored in
Germany at ftp://ftp.cert.dfn.de/pub/tools/net/bind/src/
As new versions of BIND are released in the future,
you will be able to find them at these sites, as well as other
mirrors. You can also check ftp://info.cert.org/pub/latest_sw_versions/
for version information.
C. Take additional precautions.
As good security practice in general, filter at a router all name-based authentication services so that you do not rely on DNS information for authentication. This includes the services rlogin, rsh (rcp), xhost, NFS, and any other locally installed services that provide trust based on domain name information.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Below is a list of the vendors who have provided
information for this advisory. We will update this appendix as
we receive additional information. If you do not see your vendor's
name, the CERT/CC did not hear from that vendor. Please contact
the vendor directly.
Cray Research has determined that the version of
BIND shipped with all current releases of Unicos and Unicos/mk
are susceptible to the problem described in this advisory. We
are currently working on upgrading our version of BIND to the
4.9.6 release.
xref CASE ID: SSRT0494U
At the time of writing this document, patches(binary kits) are in progress and final patch testing is expected to begin soon.
Digital will provide notice of the completion/availability of the patches through AES services (DIA, DSNlink FLASH) and be available from your normal Digital Support channel.
DIGITAL EQUIPMENT CORPORATION AUG/97
----------------------------- ------
HP is vulnerable. Patches in process.
IBM is currently working on the following APARs which will be available soon:
APARs may be ordered using Electronic Fix Distribution (via FixDist) or from the IBM Support Center. For more information on FixDist, reference URL:
http://service.software.ibm.com/aixsupport/
or send e-mail to aixserv@austin.ibm.com with a subject of "FixDist".
IBM and AIX are registered trademarks of International
Business Machines Corporation.
We are investigating this problem and will provide
updated information for this advisory when it becomes available.
The following SCO operating systems are vulnerable:
ftp://ftp.sco.com/SSE/sse008.ltr.Z - cover letter
ftp://ftp.sco.com/SSE/sse008.tar.Z - replacement binaries
The fix includes binaries for the following SCO operating systems:
Sun Microsystems, Inc.
======================
We are producing patches.
- -----------------------------------------------------------------------------
The CERT Coordination Center staff thanks Paul Vixie and Wolfgang Ley for their contributions to this advisory.
- -----------------------------------------------------------------------------
If you believe that your system has been compromised,
contact the CERT Coordination Center or your representative in
the Forum of Incident Response and Security Teams (see http://www.first.org/team-info/).
- ----------------------------
Email cert@cert.org
Phone +1 412-268-7090 (24-hour hotline)
CERT personnel answer 8:30-5:00 p.m. EST(GMT-5) / EDT(GMT-4)
and are on call for emergencies during other hours.
Fax +1 412-268-6989
We strongly urge you to encrypt sensitive information sent by email. We can support a shared DES key or PGP. Contact the CERT/CC for more information.
ftp://info.cert.org/pub/CERT_PGP.key
CERT publications and other security information are available from
CERT advisories and bulletins are also posted on the USENET newsgroup
comp.security.announce
To be added to our mailing list for advisories and bulletins, send
email to
cert-advisory-request@cert.org
In the subject line, type
SUBSCRIBE your-email-address
- ---------------------------------------------------------------------------
Copyright 1997 Carnegie Mellon University. Conditions apply; they can be found in http://www.cert.org/legal_stuff.html and ftp://info.cert.org/pub/legal_stuff. If you do not have FTP or web access, send mail to cert@cert.org with "copyright" in the subject line.
*CERT is registered in the U.S. Patent and Trademark Office.
- ---------------------------------------------------------------------------
This file: ftp://info.cert.org/pub/cert_advisories/CA-97.22.bind
click on "CERT Advisories"
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
****************************************************************************
* *
* *
* *
* *
* *
* *
* *
* *
****************************************************************************
PLEASE NOTE: Some users outside of the DOD computing communities may receive DISN Security Bulletins. If you are not part of the DOD community, please contact your agency's incident response team to report incidents. Your agency's team will coordinate with DOD. The Forum of Incident Response and Security Teams (FIRST) is a world-wide organization. A list of FIRST member organizations and their constituencies can be obtained by sending email to docserver@first.org with an empty subject line and a message body containing the line: send first-contacts.
This document was prepared as an service to the DOD
community. Neither the United States Government nor any of their
employees, makes any warranty, expressed or implied, or assumes
any legal liability or responsibility for the accuracy, completeness,
or usefulness of any information, product, or process disclosed,
or represents that its use would not infringe privately owned
rights. Reference herein to any specific commercial products,
process, or service by trade name, trademark manufacturer, or
otherwise, does not necessarily constitute or imply its endorsement,
recommendation, or favoring by the United States Government. The
opinions of the authors expressed herein do not necessarily state
or reflect those of the United States Government, and shall not
be used for advertising or product endorsement purposes.