DNS BIND Security Advisory: RRSIG Queries Can Trigger Server Crash When Using Response Policy Zones
larissas at isc.org
Fri May 6 00:06:05 UTC 2011
-----BEGIN PGP SIGNED MESSAGE-----
Note: https://www.isc.org/CVE-2011-1907 is the authoritative source
for this Security Advisory. Please check the source for any updates.
Summary: When a name server is configured with a response policy zone
(RPZ), queries for type RRSIG can trigger a server crash.
Posting date: 05 May 2011
Program Impacted: BIND
Versions affected: 9.8.0
Description: This advisory only affects BIND users who are using the
RPZ feature configured for RRset replacement. BIND 9.8.0 introduced
Response Policy Zones (RPZ), a mechanism for modifying DNS responses
returned by a recursive server according to a set of rules which are
either defined locally or imported from a reputation provider. In
typical configurations, RPZ is used to force NXDOMAIN responses for
untrusted names. It can also be used for RRset replacement, i.e.,
returning a positive answer defined by the response policy. When RPZ
is being used, a query of type RRSIG for a name configured for RRset
replacement will trigger an assertion failure and cause the name
server process to exit.
Workarounds: Install 9.8.0-P1 or higher.
Active exploits: None. However, some DNSSEC validators are known to
send type=RRSIG queries, innocently triggering the failure.
Solution: Use RPZ only for forcing NXDOMAIN responses and not for
CVSS Score: Base 6.1, adjusted for lack of targets, score is 1.5
For more information on the Common Vulnerability Scoring System and to
obtain your specific environmental score please visit:
Thank you to Mitsuru Shimamura at Internet Initiative Japan for
finding this defect.
For more information on support and other services for ISC's software
products, please visit
For more information about DNS RPZ, please check security advisory @
Questions about this Security Advisory should be sent to the ISC
Security Officer <security-officer at isc.org>.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG/MacGPG2 v2.0.14 (Darwin)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/
-----END PGP SIGNATURE-----
More information about the bind-users