FreeBSD-SA-05:12.bind9 "BIND 9 DNSSEC remote denial of service vulnerability"

! security

The FreeBSD Project よりセキュリティ勧告が出ました。要点を以下にまとめます。

  • 未稿

セキュリティ勧告は ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-05:12.bind9.asc にあります。
以下は上記のセキュリティ勧告の一部とその訳文です。ただし品質は保証致しません。

I. 背景 - Background

BIND 9 is an implementation of the Domain Name System (DNS) protocols. The named(8) daemon is the Internet domain name server. DNS Security Extensions (DNSSEC) are additional protocol options that add authentication and integrity to the DNS protocols.
DNSSEC is not enabled by default in any FreeBSD release. A system administrator must take special action to enable DNSSEC.

II. 問題の詳細 - Problem Description

A DNSSEC-related validator function in BIND 9.3.0 contains an inappropriate internal consistency test. When this test is triggered, named(8) will exit.

III. 影響範囲 - Impact

On systems with DNSSEC enabled, a remote attacker may be able to inject a specially crafted packet that will cause the internal consistency test to trigger, and named(8) to terminate. As a result, the name server will no longer be available to service requests.

IV. 回避方法 - Workaround

DNSSEC is not enabled by default, and the "dnssec-enable" directive is not normally present. If DNSSEC has been enabled, disable it by changing the "dnssec-enable" directive to "dnssec-enable no;" in the named.conf(5) configuration file.

><