{"id":100059,"date":"2021-04-29T10:22:42","date_gmt":"2021-04-29T08:22:42","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/obnovlenie-dns-servera-bind-c-ustraneniem-uyazvimosti-dopuskayushhej-udalyonnoe-vypolnenie-koda"},"modified":"2021-04-29T10:22:42","modified_gmt":"2021-04-29T08:22:42","slug":"obnovlenie-dns-servera-bind-c-ustraneniem-uyazvimosti-dopuskayushhej-udalyonnoe-vypolnenie-koda","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/obnovlenie-dns-servera-bind-c-ustraneniem-uyazvimosti-dopuskayushhej-udalyonnoe-vypolnenie-koda","title":{"rendered":"BIND DNS Server Update Addressing Vulnerability Allowing Remote Code Execution","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Corrective updates have been released for stable branches of BIND DNS Server versions 9.11.31 and 9.16.15, as well as the experimental branch 9.17.12 currently in development. These new releases fix three vulnerabilities, one of which (CVE-2021-25216) leads to buffer overflow. On 32-bit systems, this vulnerability can be exploited for remote code execution by sending a specially crafted GSS-TSIG request. On 64-bit systems, the issue is limited to the crash of the named process. <\/p>\n

The problem occurs only when the GSS-TSIG mechanism is enabled, which is activated through the tkey-gssapi-keytab and tkey-gssapi-credential settings. GSS-TSIG is disabled in the default configuration and is generally used in mixed environments where BIND works with Active Directory domain controllers or when integrated with Samba. <\/p>\n

The vulnerability is caused by an error in the implementation of the SPNEGO (Simple and Protected GSSAPI Negotiation Mechanism), used in GSSAPI to negotiate the methods employed by the client and protection mechanisms. GSSAPI is used as a high-level protocol for secure key exchange using the GSS-TSIG extension during DNS zone dynamic update authentication. proxy server<\/a> Given that critical vulnerabilities in the embedded SPNEGO implementation have been found previously, this protocol's implementation has been removed from the BIND 9 codebase. For users requiring SPNEGO support, it's recommended to use an external implementation provided by the GSSAPI system library (available in MIT Kerberos and Heimdal Kerberos). <\/p>\n

Users of older BIND versions can circumvent the issue by disabling GSS-TSIG in the settings (with the tkey-gssapi-keytab and tkey-gssapi-credential parameters) or by rebuilding BIND without SPNEGO support (using the '--disable-isc-spnego' option in the 'configure' script). Updates in distributions can be tracked on the following pages: Debian, SUSE, Ubuntu, Fedora, Arch Linux, FreeBSD, NetBSD. RHEL and ALT Linux packages are built without embedded SPNEGO support. <\/p>\n

Users of older BIND versions can circumvent the issue by disabling GSS-TSIG in the settings (parameters tkey-gssapi-keytab and tkey-gssapi-credential) or by rebuilding BIND without SPNEGO support (the option \u2018\u2013disable-isc-spnego\u2019 in the \u2018configure\u2019 script). Updates in distributions can be tracked on the following pages: Debian, SUSE, Ubuntu, Fedora, Arch Linux, FreeBSD, NetBSD. RHEL and ALT Linux packages are built without integrated SPNEGO support. <\/p>\n

Additionally, two more vulnerabilities have been addressed in the discussed updates for BIND: <\/p>\n