**************************************************************************

Security Bulletin 9722 DISA Defense Communications System

September 9, 1997 Published by: DISN Security Coordination Center

(SCC@NIC.MIL) 1-(800) 365-3642

DEFENSE INFORMATION SYSTEM NETWORK

SECURITY BULLETIN

The DISN SECURITY BULLETIN is distributed by the DISN SCC (Security Coordination Center) under DISA contract as a means of communicating information on network and host security exposures, fixes, and concerns to security and management personnel at DISN facilities. Back issues may be obtained via FTP from NIC.MIL [207.132.116.5] using login= "anonymous" and password="guest". The bulletin pathname is scc/sec-yynn (where "yy" is the year the bulletin is issued and "nn" is a bulletin number, e.g. scc/sec-9705.txt). These are also available at our WWW site, http://nic.mil.

**************************************************************************

+ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - +

! !

! The following important advisory was issued by the Automated !

! Systems Security Incident Support Team (ASSIST) and is being !

! relayed unedited via the Defense Information Systems Agency's !

! Security Coordination Center distribution system as a means !

! of providing DISN subscribers with useful security information. !

! !

+ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - +

<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>

Automated Systems Security Incident Support Team

_____

___ ___ _____ ___ _____ | /

/\ / \ / \ | / \ | | / Integritas

/ \ \___ \___ | \___ | | < et

/____\ \ \ | \ | | \ Celeritas

/ \ \___/ \___/ __|__ \___/ | |_____\

<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>

ADVISORY: 97-11

Release date: 08 Sep 1997

DESCRIPTION: Berkeley Internet Name Daemon (BIND) Vulnerability

PLATFORM: Mostly UNIX systems. See list below

IMPACT: Protocols relying on DNS resolution for authentication

purposes are unreliable. These protocols include, but not limited to rsh, rlogin, NFS, etc. This vulnerability is actively being exploited.

SOLUTIONS: Apply fixes mentioned in Section III as soon as possible.

[ Beginning of CERT Bulletin ]

=============================================================================

  • CERT* Advisory CA-97.22
  • Original issue date: August 13, 1997
  • Last revised: August 20, 1997
  • Introduction - Clarified that 4.9.6 is not vulnerable.

    Section III - Added a note why sites should upgrade to 8.1.1.

    Topic: BIND - the Berkeley Internet Name Daemon

    - -----------------------------------------------------------------------------

    *** This advisory supersedes CA-96.02. ***

    Several vulnerabilities in the Berkeley Internet Name Daemon (BIND) have been fixed in the current version of BIND. One of those vulnerabilities is now being exploited, a vulnerability that results in cache poisoning (malicious or misleading data from a remote name server is saved [cached] by another name server).

    The vulnerability has been fixed in BIND version 4.9.6; however, we recommend upgrading according to our instructions in Section III.B or installing vendor patches (see Appendix A). We also urge you to take the additional precautions described in Section III.C.

    We will update this advisory as we receive additional information. Please check our advisory files regularly for updates that relate to your site.

    - -----------------------------------------------------------------------------

    I. Description

    The Berkeley Internet Name Daemon (BIND) is an implementation of the Domain Name Service (DNS) written primarily for UNIX Systems. BIND consists of three parts:

  • As BIND has matured, several vulnerabilities in the client, server, and tools parts have been fixed. Among these is server cache poisoning. Cache poisoning occurs when malicious or misleading data received from a remote name server is saved (cached) by another name server. This "bad" data is then made available to programs that request the cached data through the client interface.
  • Analysis of recent incidents reported to the CERT Coordination Center has shown that the cache poisoning technique is being used to adversely affect the mapping between host names and IP addresses. Once this mapping has been changed, any information sent between hosts on a network may be subjected to inspection, capture, or corruption.
  • Although the new BIND distributions do address important security problems, not all known problems are fixed. In particular, several problems can be fixed only with the use of cryptographic authentication techniques. Implementing and deploying this solution is non-trivial; work on this task is currently underway within the Internet community.
  • II. Impact

    The mapping between host names and IP addresses may be changed. As a result, attackers can inspect, capture, or corrupt the information exchanged between hosts on a network.

    III. Solution

    Install a patch from your vendor or implement the "best practice" workaround we recommend in Section III.B. In either case, take the extra precautions described in Section III.C.

    A. Obtain and install a patch for this problem.

    Information from vendors can be found in Appendix A of this advisory; we will update the appendix as we receive more information.

    B. Until you are able to install the appropriate patch, we recommend the following workaround.

    The "best practice" for operating the publicly available BIND

    system can be either:

  • In the paragraphs below, we describe how to determine which solution
  • you should use.
  • Note: Although the security posture in BIND version 8.1.1 is
  • identical to that of version 4.9.6, version 8.1.1 is the version that will continue to undergo changes and improvements, hence our selection of its use as the "best practice."

    1. Shared Object Client Subroutine Library

    If your system and its programs rely on the shared object client

    subroutine library that comes with some releases of BIND, probably

    named libresolv.so, then you need the shared object subroutine

    library and other client software from release 4.9.6. (As of

    this writing, BIND version 8 does not yet support the client

    part as a shared object library.) This client software is

    available at

    ftp://ftp.isc.org/isc/bind/src/4.9.6/bind-4.9.6-REL.tar.gz

    MD5 (bind-4.9.6-REL.tar.gz) = 76dd66e920ad0638c8a37545a6531594

    Follow the instructions in the file named INSTALL in the top-level

    directory.

    After installing this client part, install the server and tool

    parts from release 8.1.1. This software is available at

    ftp://ftp.isc.org/isc/bind/src/8.1.1/bind-src.tar.gz

    MD5 (bind-src.tar.gz) = 7487b8d647edba2053edc1cda0c6afd0

    Follow the instructions in the src/INSTALL file. Note that

    this version will install the client libraries and header files in a non-standard place, /usr/local/lib and /usr/local/include. The src/INSTALL file describes what is being installed and where.

    When you install release 4.9.6 first, its client, server, and

    tools parts will be installed in the production locations. When you then install release 8.1.1, the server and tools parts will be overwritten by that release's versions, but the 4.9.6 client part will not.

    2. No Shared Object Client Subroutine Library

    If you do not need the shared object client subroutine library,

    then you need only upgrade to release 8.1.1. This software is

    available at

    ftp://ftp.isc.org/isc/bind/src/8.1.1/bind-src.tar.gz

    MD5 (bind-src.tar.gz) = 7487b8d647edba2053edc1cda0c6afd0

    Follow the instructions in src/INSTALL. Note that the client

    subroutine library and header files are installed in /usr/local/lib and /usr/local/include respectively. To use these when building other systems, you will need to refer to their installed locations.

    Note: ftp://ftp.isc.org/isc/bind/src/ is mirrored in

    Germany at ftp://ftp.cert.dfn.de/pub/tools/net/bind/src/

    As new versions of BIND are released in the future, you will be able

    to find them at these sites, as well as other mirrors. You can also check ftp://info.cert.org/pub/latest_sw_versions/ for version information.

    C. Take additional precautions.

    As good security practice in general, filter at a router all

    name-based authentication services so that you do not rely on DNS information for authentication. This includes the services rlogin, rsh (rcp), xhost, NFS, and any other locally installed services that provide trust based on domain name information.

    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

    Appendix A - Vendor Information

    Below is a list of the vendors who have provided information for this advisory. We will update this appendix as we receive additional information. If you do not see your vendor's name, the CERT/CC did not hear from that vendor. Please contact the vendor directly.

    Cray Research - A Silicon Graphics Company

    Cray Research has determined that the version of BIND shipped with all current releases of Unicos and Unicos/mk are susceptible to the problem described in this advisory. We are currently working on upgrading our version of BIND to the 4.9.6 release.

    Digital Equipment Corporation

    xref CASE ID: SSRT0494U

    At the time of writing this document, patches(binary kits) are in progress and final patch testing is expected to begin soon.

    Digital will provide notice of the completion/availability of the patches through AES services (DIA, DSNlink FLASH) and be available from your normal Digital Support channel.

    DIGITAL EQUIPMENT CORPORATION AUG/97

    ----------------------------- ------

    Hewlett-Packard Company

    HP is vulnerable. Patches in process.

    IBM Corporation

    IBM is currently working on the following APARs which will be available soon:

    AIX 4.1: IX70236
    AIX 4.2: IX70237

    To Order

    APARs may be ordered using Electronic Fix Distribution (via FixDist) or from the IBM Support Center. For more information on FixDist, reference URL:

    http://service.software.ibm.com/aixsupport/

    or send e-mail to aixserv@austin.ibm.com with a subject of "FixDist".

    IBM and AIX are registered trademarks of International Business Machines Corporation.

    NEC Corporation

  • NEC is vulnerable. The systems affected by this problem
  • are as follows:
  • UX/4800
  • UX/4800(64)
  • EWS-UX/V(Rel4.2MP)
  • EWS-UX/V(Rel4.2)
  • UP-UX/V(Rel4.2MP)
  • Patches are in progress and will be made available from
  • ftp://ftp.meshnet.or.jp/pub/48pub/security.
  • Siemens-Nixdorf Informationssysteme AG

    We are investigating this problem and will provide updated information for this advisory when it becomes available.

    The Santa Cruz Operation

    The following SCO operating systems are vulnerable:

  • SCO CMW+ 3.0 is not vulnerable as bind is not supported on CMW+ platforms.
  • SCO has made an interim fix available for anonymous ftp:
  • ftp://ftp.sco.com/SSE/sse008.ltr.Z - cover letter

    ftp://ftp.sco.com/SSE/sse008.tar.Z - replacement binaries

    The fix includes binaries for the following SCO operating systems:

    Sun Microsystems, Inc.

    ======================

    We are producing patches.

    [ End of CERT Bulletin ]

    - -----------------------------------------------------------------------------

    The ASSIST staff would like to thank the CERT Coordination Center for this advisory, as well as Paul Vixie and Wolfgang Ley for their contributions to this advisory.

    - -----------------------------------------------------------------------------

    <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>

    ASSIST is an element of the Defense Information Systems Agency (DISA), Global Operations and Security Center (GOSC), which provides service to the entire DoD community. Constituents of the DoD with questions about ASSIST or computer security issues, can contact ASSIST using one of the methods listed below. Non-DoD organizations/institutions, contact the Forum of Incident Response and Security Teams (FIRST) representative. To obtain a list of FIRST member organizations and their constituencies send an email to docserver@first.org with an empty "subject" line and a message body containing the line "send first-contacts".

    ___________________________

    ASSIST CONTACT INFORMATION:

  • E-mail: assist@assist.mil
  • Phone: (800)-357-4231 (DSN 327-4700) 24 hour hotline
  • Fax: (703) 607-4735 (DSN 327-4735) Unclassified
  • ASSIST Bulletins, tools and other security related information are available from:

  • http://www.assist.mil/
  • ftp://ftp.assist.mil/
  • To be added to our mailing list for ASSIST bulletins, send your e-mail address to:

    assist-request@assist.mil In the subject line, type:

    SUBSCRIBE your-email-address

    ___________________________________

    OTHER DOD CERT CONTACT INFORMATION:

  • Air Force CERT Phone: (800) 854-0187
  • Air Force CERT Email: afcert@afcert.csap.af.mil
  • Navy CIRT Phone: (800) 628-8893
  • Navy CIRT Email: navcirt@fiwc.navy.mil
  • Army CERT Phone: (888) 203-6332
  • Army CERT Email: acert@vulcan.belvoir.army.mil
  • _________________

    ASSIST BULLETINS:

    Back issues of ASSIST bulletins, and other security related information, are available from the ASSIST BBS at 703-607-4710, 327-4710, and through anonymous FTP from ftp.assist.mil (IP address 199.211.123.12). Note: ftp.assist.mil will only accept anonymous FTP connections from Milnet addresses that are registered with the NIC or DNS. If your system is not registered, you must provide your MILNET IP address to ASSIST before access can be provided.

  • ASSIST uses Pretty Good Privacy (PGP) as the digital
  • signature mechanism for bulletins. PGP incorporates the
  • RSAREF™ Cryptographic Toolkit under license from RSA Data
  • Security, Inc. A copy of that license is available via anonymous
  • FTP from net-dist.mit.edu (IP 18.72.0.3) in the file
  • /pub/PGP/rsalicen.txt. In accordance with the terms of that
  • license, PGP may be used for non-commercial purposes only. Instructions for downloading the PGP software can also be obtained from net-dist.mit.edu in the pub/PGP/README file. PGP and RSAREF may be subject to the export control laws of the United States of America as implemented by the United States Department of State Office of Defense Trade Controls. The PGP signature information will be attached to the end of ASSIST bulletins.

    Reference herein to any specific commercial product, process, or service by trade name, trademark manufacturer, or otherwise, does not constitute or imply its endorsement, recommendation, or favoring by ASSIST. The views and opinions of authors expressed herein shall not be used for advertising or product endorsement purposes.

    ****************************************************************************

    * *

    * *

    * *

    * *

    * *

    * *

    * *

    * *

    ****************************************************************************

    PLEASE NOTE: Some users outside of the DOD computing communities may receive DISN Security Bulletins. If you are not part of the DOD community, please contact your agency's incident response team to report incidents. Your agency's team will coordinate with DOD. The Forum of Incident Response and Security Teams (FIRST) is a world-wide organization. A list of FIRST member organizations and their constituencies can be obtained by sending email to docserver@first.org with an empty subject line and a message body containing the line: send first-contacts.

    This document was prepared as an service to the DOD community. Neither the United States Government nor any of their employees, makes any warranty, expressed or implied, or assumes any legal liability or responsibility for the accuracy, completeness, or usefulness of any information, product, or process disclosed, or represents that its use would not infringe privately owned rights. Reference herein to any specific commercial products, process, or service by trade name, trademark manufacturer, or otherwise, does not necessarily constitute or imply its endorsement, recommendation, or favoring by the United States Government. The opinions of the authors expressed herein do not necessarily state or reflect those of the United States Government, and shall not be used for advertising or product endorsement purposes.