CVE-2015-4620: Specially Constructed Zone Data Can Cause a Resolver to Crash when Validating

Chuck Aurora <[email protected]> Tue, 07 Jul 2015 14:05:35 -0500

Newsgroups	gmane.network.dns.bind.announce
Organization	Internet Systems Consortium, Inc.
Message-ID	<[email protected]>

CVE-2015-4620: Specially Constructed Zone Data Can Cause a Resolver to
Crash when Validating

An attacker who can cause a validating resolver to query a zone
containing specifically constructed contents can cause that resolver to
fail an assertion and terminate due to a defect in validation code.

CVE: CVE-2015-4620
Document Version: 2.0
Posting date: 7 July 2015
Program Impacted: BIND
Versions affected:
BIND 9.7.1 -> 9.7.7, 9.8.0 -> 9.8.8, 9.9.0 -> 9.9.7, 9.10.0 -> 9.10.2-P1.

Severity: Critical
Exploitable: Remotely

Description:

A very uncommon combination of zone data has been found that triggers a
bug in BIND, with the result that named will exit with a "REQUIRE"
failure in name.c when validating the data returned in answer to a
recursive query.

This means that a recursive resolver that is performing DNSSEC
validation can be deliberately stopped by an attacker who can cause the
resolver to perform a query against a maliciously-constructed zone.

Impact:

A recursive resolver that is performing DNSSEC validation can be
deliberately terminated by any attacker who can cause a query to be
performed against a maliciously constructed zone. This will result in
a denial of service to clients who rely on that resolver.

DNSSEC validation is only performed by a recursive resolver if it has
"dnssec-validation auto;" in its configuration or if it has a root
trust anchor defined and has "dnssec-validation yes;" set (either by
accepting the default or via an explicitly set value of "yes".) By
default ISC BIND recursive servers will not validate. (However, ISC
defaults may have been changed by your distributor.)

CVSS Score: 7.8

CVSS Vector: (AV:N/AC:L/Au:N/C:N/I:N/A:C)

For more information on the Common Vulnerability Scoring System and to
obtain your specific environmental score please visit:
https://nvd.nist.gov/cvss.cfm?calculator&adv&version=2&vector=(AV:N/AC:L/Au:N/C:N/I:N/A:C)

Workarounds:

Disabling DNSSEC validation prevents exploitation of this defect but is
not generally recommended. The recommended solution is to upgrade to a
patched version.

Active exploits:

There are no known active exploits at this time.

Solution: Upgrade to the patched release most closely related to your
current version of BIND:

BIND 9 version 9.9.7-P1
BIND 9 version 9.10.2-P2

Acknowledgements: ISC would like to thank Breno Silveira Soares of
Serviço Federal de Processamento de Dados (SERPRO) for discovering and
reporting this defect.

Document Revision History:

1.0 Phase One: Advance Notification 23 June, 2015
1.1 Phase Two: Notification to BIND Packagers 29 June, 2015
1.2 Revised public release date (to 7 July 2015) and re-notified
Phase One and Phase Two recipients: 30 June, 2015
2.0 Phase Three: Public Disclosure, 7 July 2015