Bug 1315674 (CVE-2016-1285)

The following flaw, reported by ISC, was found in BIND:

Testing by ISC has uncovered a defect in control channel input handling which can cause named to exit due to an assertion failure in sexpr.c or alist.c when a malformed packet is sent to named's control channel (the interface which allows named to be controlled using the 'rndc" server control utility).

This assertion occurs before authentication but after network-address-based access controls have been applied. Or in other words: an attacker does not need to have a key or other authentication, but does need to be within the address list specified in the "controls" statement in named.conf which enables the control channel. If no "controls" statement is present in named.conf, named still defaults to listening for control channel information on loopback addresses (127.0.0.1 and ::1) if the file rndc.key is present in the configuration directory and contains a valid key.

A search for similar problems revealed an associated defect in the rndc server control utility whereby a malformed response from the server could cause the rndc program to crash. For completeness, it is being fixed at the same time even though this defect in the rndc utility is not in itself exploitable.

All servers are vulnerable if they accept remote commands on the control channel. Servers which are vulnerable can be stopped by an attacker sending the offending packet if the attacker is sending from a system listed within the address list specified in the "controls" statement (or from localhost if the control channel is using the default address list) resulting in denial of service to clients.

Mitigation:

Restrict access to the control channel (by using the "controls" configuration statement in named.conf) to allow connection only from trusted systems.

Note that if no "controls" statement is present, named defaults to allowing control channel connections only from localhost (127.0.0.1 and ::1) if and only if the file rndc.key exists in the configuration directory and contains valid key syntax. If rndc.key is not present and no "controls" statement is present in named.conf, named will not accept commands on the control channel.

External References:

https://kb.isc.org/article/AA-01352