MoinQ: DNS/実装/BIND/キャッシュサーバ/bug

DNS/キャッシュサーバ/BIND/bugについて、ここに記述してください。

DNS/BIND/bug http://www.isc.org/software/bind/security/matrix (bind9)

• https://www.isc.org/software/bind8/security/matrix (bind8)

1. CVE-2008-1447

29      2008-1447       DNS cache poisoning issue

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1447

• (1) BIND 8 and 9 before 9.5.0-P1, 9.4.2-P1, and 9.3.5-P1;

2. CVE-2009-4022

security matrix より

32      2009-4022       Cache Update From Additional Section

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-4022

DNSSECを使っていなくても、影響がありそう。 (それが分かるか）

Unspecified vulnerability in ISC BIND 9.0.x through 9.3.x, 9.4 before 9.4.3-P4, 9.5 before 9.5.2-P1, 9.6 before 9.6.1-P2, and 9.7 beta before 9.7.0b3, with DNSSEC validation enabled and checking disabled (CD), allows remote attackers to conduct DNS cache poisoning attacks by receiving a recursive client query and sending a response that contains an Additional section with crafted data, which is not properly handled when the response is processed "at the same time as requesting DNSSEC records (DO)," aka Bug 20438. 

--- 9.6.1-P2 released ---

2772.   [security]      When validating, track whether pending data was from
                        the additional section or not and only return it if
                        validates as secure. [RT #20438]

-- ToshinoriMaeno 2011-08-17 00:03:36

説明には間違いや誤誘導される記述が含まれているので、動作確認が必要だと思われる。