ID: IRCNE2013061870
Date: 2013-06-08
According to "computerworld", the Internet Systems Consortium (ISC), the organization that develops and maintains the widely used BIND DNS (Domain Name System) software, has patched a publicly disclosed vulnerability that can be used to remotely crash DNS servers running recent releases of BIND 9.
The vulnerability affects DNS servers that use BIND 9.6-ESV-R9, 9.8.5, and 9.9.3 and are configured to run as recursive resolvers -- a very common DNS server configuration. Older versions of the BIND 9 software, including versions 9.6.0 through 9.6-ESV-R8, 9.8.0 through 9.8.4-P2, and 9.9.0 through 9.9.2-P2 are not affected.
There are no known cases of intentional exploitation of this flaw, ISC said. However, the vulnerability was disclosed on an open mailing list with enough details that would allow attackers to develop an exploit, it said.
New versions of BIND 9 that contain a fix for this bug have been released. These are: BIND 9 version 9.9.3-P1, BIND 9 version 9.8.5-P1 and BIND 9 version 9.6-ESV-R9-P1.
There are no known workarounds, so "the recommended solution is to upgrade to the patched release most closely related to your current version of BIND," ISC said.
BIND is the most widely used DNS server software on the Internet and is the standard DNS software on many Unix-like systems, including Linux, Solaris, various BSD variants and Mac OS X.
- 2