ISC patches denial-of-service vulnerability affecting BIND 9

Vulnerability affects recent versions of the widely used BIND 9 software and can be exploited by remote attackers to crash DNS servers

The Internet Systems Consortium (ISC), the organization that develops and maintains the widely used BIND DNS (Domain Name System) software, has patched a publicly disclosed vulnerability that can be used to remotely crash DNS servers running recent releases of BIND 9.

The vulnerability affects DNS servers that use BIND 9.6-ESV-R9, 9.8.5, and 9.9.3 and are configured to run as recursive resolvers -- a very common DNS server configuration. Older versions of the BIND 9 software, including versions 9.6.0 through 9.6-ESV-R8, 9.8.0 through 9.8.4-P2, and 9.9.0 through 9.9.2-P2 are not affected.

[ Also on InfoWorld: Teach your router new tricks with DD-WRT. | Get expert networking how-to advice from InfoWorld's Networking Deep Dive PDF special report. | Subscribe to InfoWorld's Data Center newsletter to stay on top of the latest developments. ]

"By sending a recursive resolver a query for a record in a specially malformed zone, an attacker can cause BIND 9 to exit with a fatal 'RUNTIME_CHECK' error in resolver.c," ISC said in an advisory published Tuesday. The organization rates this vulnerability as highly severe.

There are no known cases of intentional exploitation of this flaw, ISC said. However, the vulnerability was disclosed on an open mailing list with enough details that would allow attackers to develop an exploit, it said.

New versions of BIND 9 that contain a fix for this bug have been released. These are: BIND 9 version 9.9.3-P1, BIND 9 version 9.8.5-P1 and BIND 9 version 9.6-ESV-R9-P1.

There are no known workarounds, so "the recommended solution is to upgrade to the patched release most closely related to your current version of BIND," ISC said.

DNS servers have been increasingly targeted in distributed denial-of-service (DDoS) attacks recently, either to directly affect their owners or as part of DNS amplification attacks against third-party victims.

BIND is the most widely used DNS server software on the Internet and is the standard DNS software on many Unix-like systems, including Linux, Solaris, various BSD variants, and Mac OS X.

From CIO: 8 Free Online Courses to Grow Your Tech Skills
Join the discussion
Be the first to comment on this article. Our Commenting Policies