The Internet Systems Consortium (ISC), the organization that develops and maintains the widely used BIND DNS (Domain Name System) software, has patched a publicly disclosed vulnerability that can be used to remotely crash DNS servers running recent releases of BIND 9.
The vulnerability affects DNS servers that use BIND 9.6-ESV-R9, 9.8.5, and 9.9.3 and are configured to run as recursive resolvers—a very common DNS server configuration. Older versions of the BIND 9 software, including versions 9.6.0 through 9.6-ESV-R8, 9.8.0 through 9.8.4-P2, and 9.9.0 through 9.9.2-P2 are not affected.
“By sending a recursive resolver a query for a record in a specially malformed zone, an attacker can cause BIND 9 to exit with a fatal ‘RUNTIME_CHECK’ error in resolver.c,” ISC said in an advisory published Tuesday. The organization rates this vulnerability as highly severe.
There are no known cases of intentional exploitation of this flaw, ISC said. However, the vulnerability was disclosed on an open mailing list with enough details that would allow attackers to develop an exploit, it said.
New versions of BIND 9 that contain a fix for this bug have been released. These are: BIND 9 version 9.9.3-P1, BIND 9 version 9.8.5-P1 and BIND 9 version 9.6-ESV-R9-P1.
There are no known workarounds, so “the recommended solution is to upgrade to the patched release most closely related to your current version of BIND,” ISC said.
DNS servers have been increasingly targeted in distributed denial-of-service (DDoS) attacks recently, either to directly affect their owners or as part of DNS amplification attacks against third-party victims.
BIND is the most widely used DNS server software on the Internet and is the standard DNS software on many Unix-like systems, including Linux, Solaris, various BSD variants and Mac OS X.