DNS: BIND SIG Overflow

This protocol anomaly is a TCP-based DNS transaction with a suspiciously small SIG resource record. Bind versions 8 to 8.3.3 are vulnerable to a heap overflow in the code that handles SIG resource records. Attackers can execute arbitrary code on the server.

Extended Description

It has been reported that DNS servers, running BIND with recursive DNS functionality enabled, are prone to a buffer overflow condition. An attacker-controlled authoritative DNS server may cause BIND to cache information into an internal database, when recursion is enabled. A buffer overflow vulnerability exists when the DNS server constructs a response to a client request for cached information. Exploitation of this issue could result in the execution of arbitrary attacker-supplied code with the privileges of the vulnerable BIND daemon. It should be noted that recursive DNS functionality is enabled by default.

Affected Products

Sun cobalt_raq_xtr,Isc bind

References

BugTraq: 6160

CVE: CVE-2002-1219

Short Name

DNS:OVERFLOW:SIG-OVERFLOW

Severity

Critical

Recommended

False

Recommended Action

Drop Packet

DNS: BIND SIG Overflow

Extended Description

Affected Products

References

Found a potential security threat?