BIND Vulnerability

(CVE-2009-0696, VU#725188)

ISC BIND 9 contains a vulnerability that may allow a remote attacker to create a denial-of-service condition. An exploit is currently available in the wild.

The Berkeley Internet Name Domain (BIND) is a popular Domain Name System (DNS) implementation from Internet Systems Consortium (ISC). It includes support for dynamic DNS updates. By sending a specially-crafted dynamic update packet to a BIND 9 server, a remote, unauthenticated attacker can cause a denial of service by causing BIND to crash.

This vulnerability affects all servers that are masters for one or more zones, it is not limited to servers that are configured to allow dynamic updates. DNS slave servers are not vulnerable unless they are configured to forward the updates to their masters.

Check Point protects against attacks that use this vulnerability through its IPS products, IPS Software Blade,

Check Point protects against attacks that use this vulnerability through its IPS products, IPS Software Blade, SmartDefense, and IPS-1. These protections work by detecting and blocking DNS update requests for resource records of type ANY. See CPAI-2009-219.