BIND Security Advisory (CVE-2009-0025; Severity: Low)

[Rob_A...@isc.org]

Internet Systems Consortium Security Advisory.
BIND: EVP_VerifyFinal() and DSA_do_verify() return checks.
7 January 2009

Versions affected:

BIND 9.0 (all versions)
BIND 9.1 (all versions)
BIND 9.2 (all versions)
BIND 9.3.0, 9.3.1, 9.3.2, 9.3.3, 9.3.4, 9.3.5, 9.3.6
BIND 9.4.0, 9.4.1, 9.4.2, 9.4.3
BIND 9.5.0, 9.5.1
BIND 9.6.0

Severity: Low.

Description:

Return values from OpenSSL library functions EVP_VerifyFinal()
and DSA_do_verify() were not checked properly.

Impact:

It is theoretically possible to spoof answers returned from
zones using the DNSKEY algorithms DSA (3) and NSEC3DSA (6).

Workaround:

BIND 9.3, 9.4, 9.5 and 9.6:
Disable the affected algorithms in named.conf. This
will cause answers from zones signed only with DSA (3)
and/or NSEC3DSA (6) to be treated as insecure.

BIND 9.3, 9.4, 9.5:
disable-algorithms . { DSA; };
BIND 9.6:
disable-algorithms . { DSA; NSEC3DSA; };

Fix:

Upgrade to 9.3.6-P1, 9.4.3-P1, 9.5.1-P1, 9.6.0-P1.

There are no fixes planned for BIND 9.1 or BIND 9.2, as those
releases do not implement the current DNSSEC protocol.

Questions should be addressed to bind9...@isc.org.

CVE: CVE-2009-0025

Also see CVE-2008-5077 for the corresponding OpenSSL issue

Acknowledgement:

Credit: Google Security Team (for the original OpenSSL issue),
Florian Weimer for spotting that BIND9 was vulnerable.

Revision History:

2009-01-05 Initial pre-release text

2009-01-07 Public release with corrected CVE
_______________________________________________
bind-users mailing list
bind-...@lists.isc.org
https://lists.isc.org/mailman/listinfo/bind-users