Operational Notification: Segmentation Fault in resolver.c Affects BIND 9.6-ESV-R6, 9.7.5, 9.8.2, & 9.9.0
  • 06 Jun 2019
  • 2 Minutes to read
  • Contributors
  • PDF

Operational Notification: Segmentation Fault in resolver.c Affects BIND 9.6-ESV-R6, 9.7.5, 9.8.2, & 9.9.0

  • PDF

Article summary

BIND 9.6.x, 9.7.x, 9.8.x, and 9.9.x are EOL
The BIND 9 versions described in this article are End of Life. Please visit https://www.isc.org/downloads/ to download a currently supported version, or contact us at https://www.isc.org/contact/ with questions.

Summary

ISC has discovered a race condition in the resolver code that can cause a recursive nameserver running BIND 9.6-ESV-R6, 9.7.5, 9.8.2, or 9.9.0 to crash with a segmentation fault. Authoritative-only servers are not affected, but recursive-only or recursive-authoritative hybrid servers are at risk of crashing because of this bug.

Posting date: 30 April 2012, updated solution on May 24th

Program Impacted: BIND

Versions affected: 9.6-ESV-R6, 9.7.5, 9.8.2, 9.9.0.

Description

ISC is issuing an operational notification for users running ISC BIND 9.6-ESV-R6, 9.7.5, 9.8.2 or 9.9.0.

A race condition has been discovered in resolver.c that can result in a recursive nameserver running one of these versions to crash with a segmentation fault.

This defect is not considered a security issue, as no known method for deliberately triggering it exists. It depends on a matter of random timing between multiple threads executing the resolver code. However, the nature of the bug is such that the probability of encountering the crash condition eventually increases in proportion to the number of queries being resolved as well as the number of queries being resolved simultaneously. Consequently, busy recursing nameservers and nameservers with more threads processing simultaneously are at higher risk of encountering this bug.

This defect was introduced accidentally in change #3241 which appeared for the first time in the specified release versions. Prior release versions (9.6-ESV-R5-P1, 9.7.4-P1, and 9.8.1-P1, and any earlier versions) are not affected by this bug.

ISC issued replacement release versions in May 2012.

Solution

  • Authoritative-only servers do not need to address this issue.

  • Upgrade to one of these releases published on May 21: 9.6-ESV-R7, 9.7.6, 9.8.3, or 9.9.1

  • If you have already upgraded a recursive server to one of the affected versions, you have the option of reverting to a prior release version, using one of the superseding packages including the fix, or applying the source code patch from ISC and rebuilding BIND.

Do you still have questions? Questions regarding this advisory should go to security-officer@isc.orgTo report a new issue, please encrypt your message using security-officer@isc.org's PGP key which can be found here: https://www.isc.org/downloads/software-support-policy/openpgp-key/. If you are unable to use encrypted email, you may also report new issues at: https://www.isc.org/community/report-bug/.

Note: ISC patches only currently supported versions. When possible we indicate EOL versions affected.  (For current information on which versions are actively supported, please see https://www.isc.org/downloads/).

ISC Security Vulnerability Disclosure Policy: Details of our current security advisory policy and practice can be found here: ISC Software Defect and Security Vulnerability Disclosure Policy.

This Knowledgebase article is the complete and official security advisory document.

Legal Disclaimer:

Internet Systems Consortium (ISC) is providing this notice on an "AS IS" basis. No warranty or guarantee of any kind is expressed in this notice and none should be implied. ISC expressly excludes and disclaims any warranties regarding this notice or materials referred to in this notice, including, without limitation, any implied warranty of merchantability, fitness for a particular purpose, absence of hidden defects, or of non-infringement. Your use or reliance on this notice or materials referred to in this notice is at your own risk. ISC may change this notice at any time. A stand-alone copy or paraphrase of the text of this document that omits the document URL is an uncontrolled copy. Uncontrolled copies may lack important information, be out of date, or contain factual errors.