CVE-2012-5689: Input Validation
An error condition may occur when a nameserver which is configured to use DNS64 performs a AAAA lookup for a record with an A record rewrite rule in a Response Policy Zone (RPZ.) If the RPZ is unable to provide a AAAA record for the name, but does provide a rewritten A record, then the DNS64 processing code will attempt to remap that A record into a AAAA record. Due to a coding error, this interaction between the RPZ database and the DNS64 remapping code can cause the named process to terminate with an assertion failure.
This only affects BIND 9.8.0 through to 9.8.4-P1 and 9.9.0 through to 9.9.2-P1. It also requires the server to be using RPZ rewrite rules (specifically, A rewrite rules but not AAAA rewrite rules) and also using DNS64. Systems that only use RPZ to generate NXDOMAIN or CNAME or NOERROR/NODATA responses, or to rewrite other resources record types besides the A type, will not trigger this bug. In particular, this will only affect those systems using RPZ ro rewrite DNS records into A records, and then attempt to map those same A records into AAAA records via DNS64.
ISC has provided the following workaround that is effective against this bug:
If using DNS64 and Response Policy Zones together, make sure the RPZ contains a AAAA rewrite rule for every A rewrite rule. If the RPZ provides a AAAA answer without the assistance of DNS64, the bug is not triggered.
Other sources
ISC BIND 9.8.x through 9.8.4-P1 and 9.9.x through 9.9.2-P1, in certain configurations involving DNS64 with a Response Policy Zone that lacks an AAAA rewrite rule, allows remote attackers to cause a denial of service (assertion failure and named daemon exit) via a query for an AAAA record.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
When using DNS64 with RPZ, ensure the RPZ contains an AAAA rewrite rule for every A rewrite rule.
ISC BIND Response Policy Zone (RPZ) AAAA rewrite rules = Add an AAAA rewrite rule for every A rewrite rule
Event History
Frequently Asked Questions
What is the severity of CVE-2012-5689?
CVE-2012-5689 is classified as a high-severity vulnerability that can lead to a denial of service.
How do I fix CVE-2012-5689?
To fix CVE-2012-5689, upgrade to ISC BIND version 9.9.3 or later, which contains patches for this vulnerability.
What attack vectors are associated with CVE-2012-5689?
CVE-2012-5689 can be exploited remotely by sending specially crafted DNS queries for AAAA records.
Which versions of ISC BIND are affected by CVE-2012-5689?
ISC BIND versions 9.8.x through 9.8.4-P1 and 9.9.x through 9.9.2-P1 are affected by CVE-2012-5689.
What symptoms indicate exploitation of CVE-2012-5689?
Exploitation of CVE-2012-5689 may result in assertion failures that cause the named daemon to crash.