Bug 873618 – CVE-2006-0987 bind: DDoS (traffic amplification) via DNS queries with spoofed IP addresses due to additional information delegation to arbitrary IP addresses

Bugzilla will be upgraded to version 5.0 on a still to be determined date in the near future. The original upgrade date has been delayed.

Bug 873618 - (CVE-2006-0987) CVE-2006-0987 bind: DDoS (traffic amplification) via DNS queries with spoofed IP addresses due to additional information delegation to arbitrary IP addresses

Summary:	CVE-2006-0987 bind: DDoS (traffic amplification) via DNS queries with spoofed...

Status:	CLOSED NOTABUG

Aliases:	CVE-2006-0987

Product:	Security Response
Classification:	Other
Component:	vulnerability (Show other bugs)
Sub Component:
Version:	unspecified
Hardware:	All Linux

Priority	medium Severity medium
Target Milestone:	---
Target Release:	---
Assigned To:	Red Hat Product Security
QA Contact:
Docs Contact:

URL:
Whiteboard:	impact=moderate,public=20060303,repor...
Keywords:	Security

Depends On:
Blocks:
	Show dependency tree / graph

Reported:	2012-11-06 05:31 EST by Jan Lieskovsky
Modified:	2015-12-18 09:33 EST (History)
CC List:	3 users (show)

See Also:
Fixed In Version:
Doc Type:	Bug Fix
Doc Text:
Story Points:	---
Clone Of:
Environment:
Last Closed:	2012-11-06 06:13:07 EST
Type:	---
Regression:	---
Mount Type:	---
Documentation:	---
CRM:
Verified Versions:
Category:	---
oVirt Team:	---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---

Attachments	(Terms of Use)
Add an attachment (proposed patch, testcase, etc.)

Groups: None (edit)

Description Jan Lieskovsky 2012-11-06 05:31:23 EST

Common Vulnerabilities and Exposures assigned an identifier CVE-2006-0987 to the following vulnerability:

The default configuration of ISC BIND, when configured as a caching name server, allows recursive queries and provides additional delegation information to arbitrary IP addresses, which allows remote attackers to cause a denial of service (traffic amplification) via DNS queries with spoofed source IP addresses.

References:
[1] http://www.securityfocus.com/archive/1/archive/1/426368/100/0/threaded
[2] http://dns.measurement-factory.com/surveys/sum1.html
[3] http://www.us-cert.gov/reading_room/DNS-recursion121605.pdf
[4] http://marc.theaimsgroup.com/?t=114184133900001
[5] http://isotf.org/news/DNS-Amplification-Attacks.pdf

Comment 1 Jan Lieskovsky 2012-11-06 05:37:14 EST

As noted in referenced DNS Amplification Attacks PDF article [5], a recursive name server should only accept queries from a local or authorized clients not to be vulnerable to the distributed denial of service (traffic amplification / Smurf) attack.

In the default configuration the named service, as shipped within bind package with Red Hat Enterprise Linux 5 and 6, listens only for DNS queries from localhost. Relevant named.conf configuration file settings being:

named.conf:
  ..
  allow-query     { localhost; };
  ..

Therefore as such (in the default configuration) it is NOT vulnerable to the CVE-2006-0987 flaw.

Comment 2 Adam Tkac 2012-11-06 05:43:44 EST

This is issue is inherited from DNS design and cannot be fixed on DNS protocol level. However there is a "rate-limiting" patch for BIND which effectively prevents amplification attacks. It is available on http://www.redbarn.org/dns/ratelimits

We can consider to backport the patch.

Comment 3 Jan Lieskovsky 2012-11-06 06:00:48 EST

(In reply to comment #2)
> This is issue is inherited from DNS design and cannot be fixed on DNS
> protocol level. However there is a "rate-limiting" patch for BIND which
> effectively prevents amplification attacks. It is available on
> http://www.redbarn.org/dns/ratelimits
> 
> We can consider to backport the patch.

Thank you for the suggestion, Adam. The request for backport the security hardening patch for non-default bind configurations is tracked now under bug #873624.

Comment 4 Jan Lieskovsky 2012-11-06 06:03:37 EST

This issue did NOT affect the versions of the bind package, as shipped with Red Hat Enterprise Linux 5 and 6.

--

This issue did NOT affect the version of the bind97 package, as shipped with Red Hat Enterprise Linux 5.

--


This issue did NOT affect the versions of the bind package, as shipped with Fedora 16 and Fedora 17.

Comment 5 Jan Lieskovsky 2012-11-06 06:08:51 EST

Statement:

Not vulnerable. This issue did not affect the versions of bind as shipped with Red Hat Enterprise Linux 5 and 6 and version of bind97 as shipped with Red Hat Enterprise Linux 5 as in the default configuration the named service accept DNS queries only from localhost.

Note You need to log in before you can comment on or make changes to this bug.