Hole found in DNS server

The Internet Software Consortium (ISC)has warned of a glitch in Bind 9, which has spoiled the Domain Name System (DNS) server's otherwise spotless security record.

A denial-of-service vulnerability in the latest version of the Bind software most commonly used to run DNS servers allows attackers to remotely shut down the domain name machines.

Servers running versions of Bind 9 prior to 9.2.1 are affected by this hole, while other services could be affected if the vulnerability is exploited.

Although sending a specifically crafted DNS packet designed to trigger an internal consistency check will force the server to shut down, the vulnerability will not allow an attacker to execute arbitrary code or write data to arbitrary locations in memory.

Along with the ISC release of Bind, various server software packages from Caldera, HP, Mandrake, Red Hat and SuSe also incorporate Bind 9 and are therefore vulnerable.