-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Note: https://www.isc.org/CVE-2011-1907 is the authoritative source for this Security Advisory. Please check the source for any updates.
Summary: When a name server is configured with a response policy zone (RPZ), queries for type RRSIG can trigger a server crash. CVE: CVE-2011-1907 Posting date: 05 May 2011 Program Impacted: BIND Versions affected: 9.8.0 Severity: High Exploitable: remotely Description: This advisory only affects BIND users who are using the RPZ feature configured for RRset replacement. BIND 9.8.0 introduced Response Policy Zones (RPZ), a mechanism for modifying DNS responses returned by a recursive server according to a set of rules which are either defined locally or imported from a reputation provider. In typical configurations, RPZ is used to force NXDOMAIN responses for untrusted names. It can also be used for RRset replacement, i.e., returning a positive answer defined by the response policy. When RPZ is being used, a query of type RRSIG for a name configured for RRset replacement will trigger an assertion failure and cause the name server process to exit. Workarounds: Install 9.8.0-P1 or higher. Active exploits: None. However, some DNSSEC validators are known to send type=RRSIG queries, innocently triggering the failure. Solution: Use RPZ only for forcing NXDOMAIN responses and not for RRset replacement. CVSS Score: Base 6.1, adjusted for lack of targets, score is 1.5 (AV:N/AC:L/Au:N/C:N/I:N/A:C/E:P/RL:O/RC:C/TD:L) For more information on the Common Vulnerability Scoring System and to obtain your specific environmental score please visit: http://nvd.nist.gov/cvss.cfm?calculator&adv&version=2 Thank you to Mitsuru Shimamura at Internet Initiative Japan for finding this defect. For more information on support and other services for ISC's software products, please visit https://www.isc.org/community/blog/201102/BIND-support For more information about DNS RPZ, please check security advisory @ https://www.isc.org/CVE-2011-1907 Questions about this Security Advisory should be sent to the ISC Security Officer <[email protected]>. -----BEGIN PGP SIGNATURE----- Version: GnuPG/MacGPG2 v2.0.14 (Darwin) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/ iQEcBAEBAgAGBQJNwzr0AAoJEBOIp87tasiULeIH/RIPpfCEHThoi+HlgplQWKnf t5V6nm5I3s3ycgpGbgOgD5408Hf9C19KGtYV/OFV9SmQeM/aZkOSVnK30UGrEqoR me3t+eFYHfte1uQOHACl3hB/019GKwPMxjN+xKtpaFkqJNU+T+R2hPk4GAQhH3QT QFrYPn7GpTtZQilqHt3yXEmyxnjVgmg4tBhlMkk7gW8o72OqoA9O9Ionw5VTNLbT SmhY0Z03wTs72XeMm6Q2+Ao40D8y8jAtNfB1DFpTh0/kI02KLp02jZiTnixLsAD9 SLRXm3LcWyIgWFm1MvZobR2YIn2r9ytj0uOpfiG6HkgxYIHPfOQg+23ViaeF490= =8wBI -----END PGP SIGNATURE----- _______________________________________________ bind-announce mailing list [email protected] https://lists.isc.org/mailman/listinfo/bind-announce
