Feeds

Upgrade bug causes awkward BIND

For some users

  • alert
  • submit to reddit

Build a business case: developing custom apps

A small number of users upgrading their Domain Name System (DNS) servers to guard against a major exploit in BIND have become entangled in a denial of service issue.

The problem in updating from BIND (Berkeley Internet Name Domain) 4.9.x or 8.2.x to 9.1.0 is more a case of getting your hair singed than of jumping from the frying pan into the fire. This is because the DoS problem, though irritating, is much less serious than the earlier flaw.

On updating to BIND 9.1.0, some BSD users have experienced intermittent failures when running nmap.

Deri Jones, security services director at security testing specialists NTA Monitor, said: "The root cause appears to be a flaw in certain operating systems only, and the cause is the kernel returning a routine successfully but without in fact setting the right parameters."

"This is a small issue, involving low level kernel stuff, and shouldn't put people off upgrading their DNS software," he added.

According to postings on security mailing list, BugTraq, the issue has been reported by Free- Open- and NetBSD sites, and "some Linux users".

When BIND 9.1.1 is released it will include a work around so that such kernel flaws do not stop BIND working.

BIND is an open-source software program which has become the de-facto standard for DNS servers on the Internet. Around 80 per cent of DNS servers run BIND.

In January, a notice outlining a series of severe security problems with BIND was posted by CERT. The advisory documents four vulnerabilities in BIND, including two buffer overflows that could allow attackers to remotely gain unrestricted access to machines running the program. ®

External link:
NTA Monitor

Related stories

BIND holes mean big trouble on the Net
Plan to charge for BIND security info
McHackers use DNS exploit to poke fun
Microsoft outsources some DNS servers to Linux

Next gen security for virtualised datacentres

More from The Register

next story
Goog says patch⁵⁰ your Chrome
64-bit browser loads cat vids FIFTEEN PERCENT faster!
e-Borders fiasco: Brits stung for £224m after US IT giant sues UK govt
Defeat to Raytheon branded 'catastrophic result'
Chinese hackers spied on investigators of Flight MH370 - report
Classified data on flight's disappearance pinched
NIST to sysadmins: clean up your SSH mess
Too many keys, too badly managed
Linux kernel devs made to finger their dongles before contributing code
Two-factor auth enabled for Kernel.org repositories
Attack flogged through shiny-clicky social media buttons
66,000 users popped by malicious Flash fudging add-on
prev story

Whitepapers

Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Endpoint data privacy in the cloud is easier than you think
Innovations in encryption and storage resolve issues of data privacy and key requirements for companies to look for in a solution.
Scale data protection with your virtual environment
To scale at the rate of virtualization growth, data protection solutions need to adopt new capabilities and simplify current features.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?