BIND Security Advisory (CVE-2009-0025; Severity: Low)

Rob_Austein at Rob_Austein at
Wed Jan 7 19:32:11 UTC 2009

                Internet Systems Consortium Security Advisory.
	  BIND: EVP_VerifyFinal() and DSA_do_verify() return checks.
                              7 January 2009

Versions affected:

	BIND 9.0 (all versions)
	BIND 9.1 (all versions)
	BIND 9.2 (all versions)
	BIND 9.3.0, 9.3.1, 9.3.2, 9.3.3, 9.3.4, 9.3.5, 9.3.6
	BIND 9.4.0, 9.4.1, 9.4.2, 9.4.3
	BIND 9.5.0, 9.5.1
	BIND 9.6.0

Severity: Low.


	Return values from OpenSSL library functions EVP_VerifyFinal()
	and DSA_do_verify() were not checked properly.


	It is theoretically possible to spoof answers returned from
	zones using the DNSKEY algorithms DSA (3) and NSEC3DSA (6).


	BIND 9.3, 9.4, 9.5 and 9.6:
	Disable the affected algorithms in named.conf.  This
	will cause answers from zones signed only with DSA (3)
	and/or NSEC3DSA (6) to be treated as insecure.

	BIND 9.3, 9.4, 9.5:
		disable-algorithms . { DSA; };
	BIND 9.6:
		disable-algorithms . { DSA; NSEC3DSA; };


	Upgrade to 9.3.6-P1, 9.4.3-P1, 9.5.1-P1, 9.6.0-P1.

	There are no fixes planned for BIND 9.1 or BIND 9.2, as those
	releases do not implement the current DNSSEC protocol.

	Questions should be addressed to bind9-bugs at

CVE:	CVE-2009-0025

	Also see CVE-2008-5077 for the corresponding OpenSSL issue


	Credit: Google Security Team (for the original OpenSSL issue),
	Florian Weimer for spotting that BIND9 was vulnerable.

Revision History:

  2009-01-05	Initial pre-release text

  2009-01-07	Public release with corrected CVE

More information about the bind-announce mailing list