Feeds

Upgrade bug causes awkward BIND

For some users

  • alert
  • submit to reddit

Remote control for virtualized desktops

A small number of users upgrading their Domain Name System (DNS) servers to guard against a major exploit in BIND have become entangled in a denial of service issue.

The problem in updating from BIND (Berkeley Internet Name Domain) 4.9.x or 8.2.x to 9.1.0 is more a case of getting your hair singed than of jumping from the frying pan into the fire. This is because the DoS problem, though irritating, is much less serious than the earlier flaw.

On updating to BIND 9.1.0, some BSD users have experienced intermittent failures when running nmap.

Deri Jones, security services director at security testing specialists NTA Monitor, said: "The root cause appears to be a flaw in certain operating systems only, and the cause is the kernel returning a routine successfully but without in fact setting the right parameters."

"This is a small issue, involving low level kernel stuff, and shouldn't put people off upgrading their DNS software," he added.

According to postings on security mailing list, BugTraq, the issue has been reported by Free- Open- and NetBSD sites, and "some Linux users".

When BIND 9.1.1 is released it will include a work around so that such kernel flaws do not stop BIND working.

BIND is an open-source software program which has become the de-facto standard for DNS servers on the Internet. Around 80 per cent of DNS servers run BIND.

In January, a notice outlining a series of severe security problems with BIND was posted by CERT. The advisory documents four vulnerabilities in BIND, including two buffer overflows that could allow attackers to remotely gain unrestricted access to machines running the program. ®

External link:
NTA Monitor

Related stories

BIND holes mean big trouble on the Net
Plan to charge for BIND security info
McHackers use DNS exploit to poke fun
Microsoft outsources some DNS servers to Linux

Intelligent flash storage arrays

More from The Register

next story
Regin: The super-spyware the security industry has been silent about
NSA fingered as likely source of complex malware family
Why did it take antivirus giants YEARS to drill into super-scary Regin? Symantec responds...
FYI this isn't just going to target Windows, Linux and OS X fans
Privacy bods offer GOV SPY VICTIMS a FREE SPYWARE SNIFFER
Looks for gov malware that evades most antivirus
Home Office: Fancy flogging us some SECRET SPY GEAR?
If you do, tell NOBODY what it's for or how it works
Patch NOW! Microsoft slings emergency bug fix at Windows admins
Vulnerability promotes lusers to domain overlords ... oops
HACKERS can DELETE SURVEILLANCE DVRS remotely – report
Hikvision devices wide open to hacking, claim securobods
'Regin': The 'New Stuxnet' spook-grade SOFTWARE WEAPON described
'A degree of technical competence rarely seen'
Syrian Electronic Army in news site 'hack' POP-UP MAYHEM
Gigya redirect exploit blamed for pop-rageous ploy
prev story

Whitepapers

Designing and building an open ITOA architecture
Learn about a new IT data taxonomy defined by the four data sources of IT visibility: wire, machine, agent, and synthetic data sets.
Getting started with customer-focused identity management
Learn why identity is a fundamental requirement to digital growth, and how without it there is no way to identify and engage customers in a meaningful way.
5 critical considerations for enterprise cloud backup
Key considerations when evaluating cloud backup solutions to ensure adequate protection security and availability of enterprise data.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Driving business with continuous operational intelligence
Introducing an innovative approach offered by ExtraHop for producing continuous operational intelligence.