Bugzilla Bug 163691

From:     Mark_Andrews@isc.org
        Subject:        Internet Systems Consortium Security Advisory.
        Date:   January 24, 2007 7:22:47 PM EST
        To:       bind-announce@isc.org


                Internet Systems Consortium Security Advisory.
                        BIND 9: DNSSEC Validation
                             10 January 2007

Versions affected:

        BIND 9.0.x (all versions of BIND 9.0)   (at end-of-life)
        BIND 9.1.x (all versions of BIND 9.1)   (at end-of-life)
        BIND 9.2.0, 9.2.1, 9.2.2, 9.2.3, 9.2.4, 9.2.5, 9.2.6, 9.2.7
        BIND 9.3.0, 9.3.1, 9.3.2, 9.3.3
        BIND 9.4.0a1, 9.4.0a2, 9.4.0a3, 9.4.0a4, 9.4.0a5, 9.4.0a6, 9.4.0b1
             9.4.0b2, 9.4.0b3, 9.4.0b4, 9.4.0rc1 
        BIND 9.5.0a1 (Bind Forum only)

Severity: Low
Exploitable: Remotely

Description:

        When validating responses to type * (ANY) queries that return
        multiple RRsets in the answer section it is possible to trigger
        assertions checks.

        To be vulnerable you need to have enabled dnssec validation in
        named.conf by specifying trusted-keys.

Workaround:

        Disable / restrict recursion (to limit exposure).
        Disable DNSSEC validation (remove all trusted-keys from named.conf).

Fix:

        Upgrade to BIND 9.2.8, BIND 9.3.4 or BIND 9.4.0rc2.
        Additionally this will be fixed in the upcoming BIND 9.5.0a2.

Note:

        It is recommended that anyone using DNSSEC upgrade to BIND 9.3
        as the DNSSEC implementation in BIND 9.2 has been obsoleted.

Revision History:
-- 
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE:  +61 2 9871 4742                  INTERNET: Mark_Andrews@isc.org

CVE-2007-0493

bind and bind/tools 9.2.8, 9.3.4 and 9.4.0_rc2 have been committed to the tree.

Handled on bug 163692. Don't ask me why this way and not the contrary.

*** This bug has been marked as a duplicate of bug 163692 ***