Denial of Service in ISC BIND 9

Reported June 5, 2002, byInternet Security Systems.

VERSIONS AFFECTED

·        Internet Software Consortium’s BIND 9.0 to 9.2.1

DESCRIPTION

ADenial of Service (DoS) condition exists in Internet Software Consortium’s BINDDNS software. This vulnerability stems from a logic error that exists in BIND that lets remoteattackers cause the DNS server running ISC BIND 9.0 to 9.2.1 to fail, shut down, and manuallyrestart. The dns_message_findtype() routine contains this DoS vulnerability.Under typical operating conditions, the rdataset variable is non-null.This exploit forces rdataset to be null, or empty, which causes an error andcalls abort(), which shuts down the server.

VENDOR RESPONSE

Thevendor, Internet Software Consortium, recommendsthat affected users either apply a patch supplied by an OEM or upgradeimmediately to version 9.2.1.

CREDIT
Discovered by Internet Software Consortium.