Internet Systems Consortium Security Advisory.
BIND: EVP_VerifyFinal() and DSA_do_verify() return checks.
7 January 2009
Versions affected:
BIND 9.0 (all versions)
BIND 9.1 (all versions)
BIND 9.2 (all versions)
BIND 9.3.0, 9.3.1, 9.3.2, 9.3.3, 9.3.4, 9.3.5, 9.3.6
BIND 9.4.0, 9.4.1, 9.4.2, 9.4.3
BIND 9.5.0, 9.5.1
BIND 9.6.0
Severity: Low.
Description:
Return values from OpenSSL library functions EVP_VerifyFinal()
and DSA_do_verify() were not checked properly.
Impact:
It is theoretically possible to spoof answers returned from
zones using the DNSKEY algorithms DSA (3) and NSEC3DSA (6).
Workaround:
BIND 9.3, 9.4, 9.5 and 9.6:
Disable the affected algorithms in named.conf. This
will cause answers from zones signed only with DSA (3)
and/or NSEC3DSA (6) to be treated as insecure.
BIND 9.3, 9.4, 9.5:
disable-algorithms . { DSA; };
BIND 9.6:
disable-algorithms . { DSA; NSEC3DSA; };
Fix:
Upgrade to 9.3.6-P1, 9.4.3-P1, 9.5.1-P1, 9.6.0-P1.
There are no fixes planned for BIND 9.1 or BIND 9.2, as those
releases do not implement the current DNSSEC protocol.
Questions should be addressed to bind9-b...@isc.org.
CVE: CVE-2009-0025
Also see CVE-2008-5077 for the corresponding OpenSSL issue
Acknowledgement:
Credit: Google Security Team (for the original OpenSSL issue),
Florian Weimer for spotting that BIND9 was vulnerable.
Revision History:
2009-01-05 Initial pre-release text
2009-01-07 Public release with corrected CVE
_______________________________________________
bind-users mailing list
bind-users@lists.isc.org
https://lists.isc.org/mailman/listinfo/bind-users
