DNS flaw puts users in Bind

The discovery of a vulnerability in the DNS (Domain Name System) Resolver Library last week has been labelled a "serious threat" to a variety of Unix-flavoured systems.

An advisory issued by the Computer Emergency Response Team (Cert) warns of a buffer overflow vulnerability recently discovered in multiple implementations of Unix-based DNS Resolver Libraries. A remote attacker could send malicious DNS responses that could potentially exploit this vulnerability to execute arbitrary code or cause a denial-of-service attack.

Cert also warned that an attacker could cause one of the victim's network services to make a DNS request to a server under the attacker's control.

Microsoft maintains that its products are not affected by the bug, but a number of Unix versions running Bind domain-naming software have been confirmed as vulnerable.

Pete Philips, security consultant for Integralis S3, the security firm's ethical hacking unit, said that the discovery of the DNS Resolver Library vulnerability represented a "serious threat" to any Unix system using Bind.

"All clients and servers on a network need to resolve DNS references. The response from the DNS server can cause a buffer overflow, which can be exploited by malicious code," he said. "Unlike recent buffer overflow vulnerabilities, which have been restricted to specific platforms, the very nature of Unix's multiplatform capabilities multiplies the number of machines that are potential hosts for a dangerous payload."

According to Philips, the nature of this problem means that there is no easy fix except to undertake the enormous task of updating each piece of flawed software. Updated Resolver Libraries are already available from the major distributors.

"The Resolver Library performs such a central role in networking that manufacturers may need to make substantial changes to OS binaries, but IT departments will have a mammoth task in administering these upgrades and protecting themselves in the event of their network becoming compromised," Philips added.

More details are available here.