===================================================================== CERT-Renater Note d'Information No. 2005/VULN710 _____________________________________________________________________ DATE : 15/11/2005 HARDWARE PLATFORM(S) : / OPERATING SYSTEM(S) : Solaris 9. ====================================================================== Sun(sm) Alert Notification * Sun Alert ID: 102030 * Synopsis: The in.named(1M) Process May Make Unnecessary Queries Causing a Denial of Service * Category: Security * Product: Solaris 9 Operating System * BugIDs: 6315143 * Avoidance: Patch, Workaround * State: Resolved * Date Released: 08-Nov-2005 * Date Closed: 08-Nov-2005 * Date Modified: 1. Impact An unprivileged remote user may be able to cause a Denial of Service (DoS) of the Domain Name System (DNS) by causing in.named(1M) to make unnecessary queries to root servers for address records. Applications, systems and devices relying on the Domain Name System may then fail. 2. Contributing Factors This issue can occur in the following releases: SPARC Platform * Solaris 9 without patch 112970-09 x86 Platform * Solaris 9 without patch 114354-08 Note: Solaris 8 and Solaris 10 are not affected by this issue. The described issue only occurs on systems configured as an Internet Domain Name System (DNS) server. A system is configured to be a DNS server if the configuration file "/etc/named.conf" exists, (see named.conf(4)). 3. Symptoms The DNS server receives a magnitude of requests for domains that the server is not authoritative for. Subsequently the DNS server makes queries to root servers for IPv6 address records which are already cached by the server. In order to verify that in.named(1M) is experiencing this issue, a network monitoring tool such as snoop(1M) can be used from either the specific system or another system on the same network. Run the following command as "root": # snoop -o port 53 DNS-server-address Afterwards, the snoop(1M) utility can display the packets captured in the "output-file" using the "-i" option, as in: # snoop -i output-file Inspect the output for sequences of repetative DNS packets to root servers which will look similar to the following: # snoop -o snoop.out2 port 53 dns-server Using device /dev/dmfe0 (promiscuous mode) 52 ^C # snoop -i snoop.out 1 0.00000 dns-server -> E.ROOT-SERVERS.NET DNS C B.ROOT-SERVERS.NET. I nternet Unknown (28) ? 2 0.00030 dns-server -> E.ROOT-SERVERS.NET DNS C B.ROOT-SERVERS.NET. I nternet Unknown (38) ? 3 0.00028 dns-server -> E.ROOT-SERVERS.NET DNS C J.ROOT-SERVERS.NET. I nternet Unknown (28) ? 4 0.00024 dns-server -> E.ROOT-SERVERS.NET DNS C J.ROOT-SERVERS.NET. I nternet Unknown (38) ? 5 0.00024 dns-server -> E.ROOT-SERVERS.NET DNS C K.ROOT-SERVERS.NET. I nternet Unknown (28) ? 6 0.00023 dns-server -> E.ROOT-SERVERS.NET DNS C K.ROOT-SERVERS.NET. I nternet Unknown (38) ? 7 0.00025 dns-server -> E.ROOT-SERVERS.NET DNS C L.ROOT-SERVERS.NET. I nternet Unknown (28) ? 8 0.00024 dns-server -> E.ROOT-SERVERS.NET DNS C L.ROOT-SERVERS.NET. I nternet Unknown (38) ? 9 0.00025 dns-server -> E.ROOT-SERVERS.NET DNS C M.ROOT-SERVERS.NET. I nternet Unknown (28) ? 10 0.00038 dns-server -> E.ROOT-SERVERS.NET DNS C M.ROOT-SERVERS.NET. I nternet Unknown (38) ? 11 0.00027 dns-server -> E.ROOT-SERVERS.NET DNS C I.ROOT-SERVERS.NET. I nternet Unknown (28) ? 12 0.00024 dns-server -> E.ROOT-SERVERS.NET DNS C I.ROOT-SERVERS.NET. I nternet Unknown (38) ? 13 0.17107 E.ROOT-SERVERS.NET -> dns-server DNS R 14 0.00055 E.ROOT-SERVERS.NET -> dns-server DNS R 15 0.00006 E.ROOT-SERVERS.NET -> dns-server DNS R 16 0.00018 E.ROOT-SERVERS.NET -> dns-server DNS R 17 0.00007 E.ROOT-SERVERS.NET -> dns-server DNS R 18 0.00008 E.ROOT-SERVERS.NET -> dns-server DNS R 19 0.00004 E.ROOT-SERVERS.NET -> dns-server DNS R 20 0.00004 E.ROOT-SERVERS.NET -> dns-server DNS R 21 0.00018 E.ROOT-SERVERS.NET -> dns-server DNS R 22 0.00003 E.ROOT-SERVERS.NET -> dns-server DNS R 23 0.00006 E.ROOT-SERVERS.NET -> dns-server DNS R 24 0.00010 E.ROOT-SERVERS.NET -> dns-server DNS R 25 13.26216 dns-server -> d.root-servers.net DNS C B.ROOT-SERVERS.NET. I nternet Unknown (28) ? 26 0.00029 dns-server -> d.root-servers.net DNS C B.ROOT-SERVERS.NET. I nternet Unknown (38) ? 27 0.00025 dns-server -> d.root-servers.net DNS C J.ROOT-SERVERS.NET. I nternet Unknown (28) ? 28 0.00024 dns-server -> d.root-servers.net DNS C J.ROOT-SERVERS.NET. I nternet Unknown (38) ? 29 0.00024 dns-server -> d.root-servers.net DNS C K.ROOT-SERVERS.NET. I nternet Unknown (28) ? 30 0.00023 dns-server -> d.root-servers.net DNS C K.ROOT-SERVERS.NET. I nternet Unknown (38) ? 31 0.00024 dns-server -> d.root-servers.net DNS C L.ROOT-SERVERS.NET. I nternet Unknown (28) ? 32 0.00023 dns-server -> d.root-servers.net DNS C L.ROOT-SERVERS.NET. I nternet Unknown (38) ? 33 0.00027 dns-server -> d.root-servers.net DNS C M.ROOT-SERVERS.NET. I nternet Unknown (28) ? 34 0.00023 dns-server -> d.root-servers.net DNS C M.ROOT-SERVERS.NET. I nternet Unknown (38) ? 35 0.00024 dns-server -> d.root-servers.net DNS C I.ROOT-SERVERS.NET. I nternet Unknown (28) ? 36 0.00023 dns-server -> d.root-servers.net DNS C I.ROOT-SERVERS.NET. I nternet Unknown (38) ? 37 0.08847 d.root-servers.net -> dns-server DNS R 38 0.00006 d.root-servers.net -> dns-server DNS R 39 0.00005 d.root-servers.net -> dns-server DNS R 40 0.00002 d.root-servers.net -> dns-server DNS R 41 0.00002 d.root-servers.net -> dns-server DNS R 42 0.00008 d.root-servers.net -> dns-server DNS R 43 0.00019 d.root-servers.net -> dns-server DNS R 44 0.00003 d.root-servers.net -> dns-server DNS R 45 0.00004 d.root-servers.net -> dns-server DNS R 46 0.00002 d.root-servers.net -> dns-server DNS R 47 0.00003 d.root-servers.net -> dns-server DNS R 48 0.00003 d.root-servers.net -> dns-server DNS R 4. Relief/Workaround To work around the described issue, modify named.conf providing access control lists that only permit known clients to make queries. See named.conf(4) for further explanation of the following options. For example: // Define a named acl that lists our networks and clients // which are allowed to make queries for external data. // acl our-clients { address-match-list }; // By default only permit our-clients to make queries. options { allow-query { our-clients; }; allow-recursion { our-clients; }; // Add here any other options you require. }; // Turn on allow-query for all master/slave zone. zone example.net { type master; allow-query { any; }; // Add here any other zone options you require. }; 5. Resolution This issue is addressed in the following releases: SPARC Platform * Solaris 9 with patch 112970-09 or later x86 Platform * Solaris 9 with patch 114354-08 or later This Sun Alert notification is being provided to you on an "AS IS" basis. This Sun Alert notification may contain information provided by third parties. The issues described in this Sun Alert notification may or may not impact your system(s). Sun makes no representations, warranties, or guarantees as to the information contained herein. ANY AND ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING WITHOUT LIMITATION WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, OR NON-INFRINGEMENT, ARE HEREBY DISCLAIMED. BY ACCESSING THIS DOCUMENT YOU ACKNOWLEDGE THAT SUN SHALL IN NO EVENT BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, PUNITIVE, OR CONSEQUENTIAL DAMAGES THAT ARISE OUT OF YOUR USE OR FAILURE TO USE THE INFORMATION CONTAINED HEREIN. This Sun Alert notification contains Sun proprietary and confidential information. It is being provided to you pursuant to the provisions of your agreement to purchase services from Sun, or, if you do not have such an agreement, the Sun.com Terms of Use. This Sun Alert notification may only be used for the purposes contemplated by these agreements. Copyright 2000-2005 Sun Microsystems, Inc., 4150 Network Circle, Santa Clara, CA 95054 U.S.A. All rights reserved ====================================================================== ========================================================= Les serveurs de référence du CERT-Renater http://www.urec.fr/securite http://www.cru.fr/securite http://www.renater.fr ========================================================= + CERT-RENATER | tel : 01-53-94-20-44 + + 151 bd de l'Hopital | fax : 01-53-94-20-41 + + 75013 Paris | email: certsvp@renater.fr + =========================================================