Bug 1466189 (CVE-2017-3142) - CVE-2017-3142 bind: An error in TSIG authentication can permit unauthorized zone transfers
Summary: CVE-2017-3142 bind: An error in TSIG authentication can permit unauthorized z...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2017-3142
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1466201 1466202 1466203 1466204 1466611 1466612 1466805
Blocks: 1466195
TreeView+ depends on / blocked
 
Reported: 2017-06-29 08:42 UTC by Adam Mariš
Modified: 2019-09-29 14:15 UTC (History)
12 users (show)

Fixed In Version: bind 9.9.10-P2, bind 9.10.5-P2,bind 9.11.1-P2
Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in the way BIND handled TSIG authentication of AXFR requests. A remote attacker, able to communicate with an authoritative BIND server, could use this flaw to view the entire contents of a zone by sending a specially constructed request packet.
Clone Of:
Environment:
Last Closed: 2017-07-06 08:26:01 UTC


Attachments (Terms of Use)


Links
System ID Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2017:1679 normal SHIPPED_LIVE Important: bind security and bug fix update 2017-07-05 13:26:32 UTC
Red Hat Product Errata RHSA-2017:1680 normal SHIPPED_LIVE Important: bind security and bug fix update 2017-07-05 13:16:26 UTC

Description Adam Mariš 2017-06-29 08:42:20 UTC
An attacker able to send and receive messages to an authoritative DNS server may be able to circumvent TSIG authentication of AXFR requests via a carefully constructed request packet. A server that relies solely on TSIG keys for protection with no other ACL protection could be manipulated into:

* providing an AXFR of a zone to an unauthorized recipient
* accepting bogus Notify packets

An unauthorized AXFR (full zone transfer) permits an attacker to view the entire contents of a zone.  Protection of zone contents is often a commercial or business requirement.

If accepted, a Notify sets the zone refresh interval to 'now'. If there is not already a refresh cycle in progress then named will initiate one by asking for the SOA RR from its list of masters.  If there is already a refresh cycle in progress, then named will queue the new refresh request.  If there is already a queued refresh request, the new Notify will be discarded. Bogus notifications can't be used to force a zone transfer from a malicious server, but could trigger a high rate of zone refresh cycles.


Workarounds:

The effects of this vulnerability can be mitigated by using Access Control Lists (ACLs) that require both address range validation and use of TSIG authentication in parallel. For information on how to configure this type of compound authentication control, please see:

https://kb.isc.org/article/AA-00723/0/Using-Access-Control-Lists-ACLs-with-both-addresses-and-keys.html.

(Note that this technique will not be effective against bogus Notify packets if an attacker is able to reach the target DNS server whilst using a spoofed sending address).


Upstream patch:

https://source.isc.org/cgi-bin/gitweb.cgi?p=bind9.git;a=commitdiff;h=581c1526ab

Comment 1 Adam Mariš 2017-06-29 08:42:26 UTC
Acknowledgments:

Name: Internet Systems Consortium
Upstream: Clement Berthaux (Synacktiv)

Comment 3 Dhiru Kholia 2017-06-30 04:23:01 UTC
External References:

https://kb.isc.org/article/AA-01504

Comment 4 Dhiru Kholia 2017-06-30 04:26:23 UTC
Created bind tracking bugs for this issue:

Affects: fedora-all [bug 1466611]


Created bind99 tracking bugs for this issue:

Affects: fedora-all [bug 1466612]

Comment 7 Dhiru Kholia 2017-07-03 10:28:12 UTC
Mitigation:

The effects of this vulnerability can be mitigated by using Access Control Lists (ACLs) that require both address range validation and use of TSIG authentication in parallel. For information on how to configure this type of compound authentication control, please see:

https://kb.isc.org/article/AA-00723/0/Using-Access-Control-Lists-ACLs-with-both-addresses-and-keys.html

Comment 8 errata-xmlrpc 2017-07-05 09:17:03 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2017:1680 https://access.redhat.com/errata/RHSA-2017:1680

Comment 9 errata-xmlrpc 2017-07-05 09:27:10 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 6

Via RHSA-2017:1679 https://access.redhat.com/errata/RHSA-2017:1679


Note You need to log in before you can comment on or make changes to this bug.