Bug 294497 (CVE-2009-4022) – <net-dns/bind-9.4.3_p4 DNSSEC Cache poisoning (CVE-2009-4022)

• Product: Gentoo Security
• Status: RESOLVED FIXED

[Description Stefan Behte (RETIRED) 2009-11-24 22:51:02 UTC]

References:
https://www.isc.org/node/504
http://www.kb.cert.org/vuls/id/418861
https://bugzilla.redhat.com/show_bug.cgi?id=538744

Quoting from the redhat bug:
"ISC reports a cache poisoning flaw reported by Michael Sinatra of UC Berkeley
that may cause bind to cache replies that were not properly DNSSEC validated
when recursive query was done based on uncommon client query.

  A nameserver with DNSSEC validation enabled may incorrectly add records
  to its cache from the additional section of responses received during
  resolution of a recursive client query. This behavior only occurs when
  processing client queries with checking disabled (CD) at the same time
  as requesting DNSSEC records (DO).

This issue was reported to affect all 9.x versions and should be fixed in
9.4.3-P4, 9.5.2-P1 and 9.6.1-P2."

Upgrade BIND to one of the following: 9.4.3-P4, 9.5.2-P1 or 9.6.1-P2.

[Comment 1 Stefan Behte (RETIRED) 2009-11-24 22:56:50 UTC]

Voxus, bind herd, can you provide new ebuilds?

[Comment 2 Hanno Böck 2009-11-25 14:36:55 UTC]

*** Bug 294570 has been marked as a duplicate of this bug. ***

[Comment 3 Alex Legler (RETIRED) 2009-11-26 08:26:24 UTC]

CVE-2009-4022 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2009-4022):
  Unspecified vulnerability in ISC BIND 9.4 before 9.4.3-P4, 9.5 before
  9.5.2-P1, 9.6 before 9.6.1-P2, 9.7 beta before 9.7.0b3, and 9.0.x
  through 9.3.x with DNSSEC validation enabled and checking disabled
  (CD), allows remote attackers to conduct DNS cache poisoning attacks
  via additional sections in a response sent for resolution of a
  recursive client query, which is not properly handled when the
  response is processed "at the same time as requesting DNSSEC records
  (DO)."

[Comment 4 Christian Ruppert (idl0r) 2009-11-26 17:59:02 UTC]

(In reply to comment #1)
> Voxus, bind herd, can you provide new ebuilds?
> 

Done.
net-dns/bind-9.4.3_p4 and net-dns/bind-9.6.1_p2 are in tree now.

[Comment 5 Robert Buchholz (RETIRED) 2009-12-02 20:45:25 UTC]

Arches, please test and mark stable:
=net-dns/bind-9.4.3_p4
Target keywords : "alpha amd64 arm hppa ia64 ppc ppc64 s390 sh sparc x86"

[Comment 6 Jeroen Roovers (RETIRED) 2009-12-03 02:19:41 UTC]

(In reply to comment #5)
> Arches, please test and mark stable:
> =net-dns/bind-9.4.3_p4
> Target keywords : "alpha amd64 arm hppa ia64 ppc ppc64 s390 sh sparc x86"

And =net-dns/bind-tools-9.4.3_p4 naturally.

[Comment 7 Jeroen Roovers (RETIRED) 2009-12-03 06:12:09 UTC]

Both stable for HPPA.

[Comment 8 Markus Meier 2009-12-03 10:56:45 UTC]

amd64/arm/x86 stable

[Comment 9 Brent Baude (RETIRED) 2009-12-08 14:36:33 UTC]

ppc64 done

[Comment 10 Jeroen Roovers (RETIRED) 2009-12-09 15:38:33 UTC]

Stable for PPC.

[Comment 11 Raúl Porcel (RETIRED) 2009-12-09 18:53:07 UTC]

alpha/ia64/s390/sh/sparc stable

[Comment 12 Stefan Behte (RETIRED) 2009-12-18 02:11:52 UTC]

GLSA vote: no.

[Comment 13 Jeroen Roovers (RETIRED) 2010-01-27 18:16:10 UTC]

ppc64 forgot about bind-tools.

[Comment 14 Brent Baude (RETIRED) 2010-01-27 18:41:12 UTC]

got -tools for ppc64 now

[Comment 15 Stefan Behte (RETIRED) 2010-01-27 19:26:42 UTC]

jer: why do need bind-tools to go stable for a bug in bind?

[Comment 16 Jeroen Roovers (RETIRED) 2010-01-29 04:11:46 UTC]

(In reply to comment #15)
> jer: why do need bind-tools to go stable for a bug in bind?

Because, if you happen to run a named, you would want the tools' version and patch level to match the server's. Both packages are compiled from the same source tarball too.

[Comment 17 Tobias Heinlein (RETIRED) 2010-01-29 11:06:14 UTC]

NO too, closing.

[Comment 18 Stefan Behte (RETIRED) 2010-01-29 11:38:32 UTC]

>Because, if you happen to run a named, you would want the tools' version and
>patch level to match the server's.

No, why would I?

diff -ur does not show differences in the tools (correct me, if I'm wrong), so why should we care to update them, too?