-----BEGIN PGP SIGNED MESSAGE-----
FreeBSD-SA-01:10 Security Advisory
Topic: bind remote denial of service
Category: core, ports
Credits: Fabio Pietrosanti <fabio@TELEMAIL.IT>
Affects: FreeBSD 3.x prior to the correction date.
Ports collection prior to the correction date.
Corrected: 2000-11-27 (FreeBSD 3.5-STABLE)
2001-01-05 (Ports collection)
Vendor status: Updated version released
FreeBSD only: NO
bind is an implementation of the Domain Name System (DNS) protocols.
II. Problem Description
A vulnerability exists with the bind nameserver dealing with
compressed zone transfers. Due to a problem with the compressed zone
transfer (ZXFR) implementation, if named is configured for zone
transfers and recursive resolving, it will crash after a ZXFR for the
authoritative zone and a query of a remote hostname. Since named is
not configured under a watchdog process which will automatically
restart it after a failure, this will lead to the denial of DNS
service on the server.
All versions of FreeBSD 3.x prior to the correction date including
3.5.1-RELEASE are vulnerable to this problem. In addition, the bind8
port in the ports collection is also vulnerable. FreeBSD 4.x is not
affected since it contains versions of BIND 8.2.3.
Malicious remote users can cause the named daemon to crash, if it is
configured to allow zone transfers and recursive queries.
A partial workaround can be implemented by disallowing zone transfers
except from trusted hosts. Note that if the trusted hosts are
compromised or contain malicious users, name servers with this bug
will be vulnerable to the denial of service attack.
Upgrade your vulnerable FreeBSD system to 3.5.1-STABLE after the
If you have chosen to install BIND from the ports collection and are
using it instead of the version in the base system, perform one of the
1) Upgrade your entire ports collection and rebuild the bind8 port.
2) Deinstall the old package and install a new package dated after the
correction date, obtained from:
Packages are not automatically generated for the alpha architecture at
this time due to lack of build resources.
3) download a new port skeleton for the bind8 port from:
and use it to rebuild the port.
4) Use the portcheckout utility to automate option (3) above. The
portcheckout port is available in /usr/ports/devel/portcheckout or the
package can be obtained from:
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.4 (FreeBSD)
Comment: For info see http://www.gnupg.org
-----END PGP SIGNATURE-----