{"id":6520,"date":"2017-02-06T10:54:04","date_gmt":"2017-02-06T18:54:04","guid":{"rendered":"http:\/\/www.palada.net\/index.php\/2017\/02\/06\/news-348\/"},"modified":"2017-02-06T10:54:04","modified_gmt":"2017-02-06T18:54:04","slug":"news-348","status":"publish","type":"post","link":"http:\/\/www.palada.net\/index.php\/2017\/02\/06\/news-348\/","title":{"rendered":"The Analysis of ISC BIND Response Authority Section RRSIG Missing DoS (CVE-2016-9444)"},"content":{"rendered":"

Credit to Author: Dehui Yin<\/span>Dehui Yin<\/span> | Date: Mon, 06 Feb 2017 09:46:31 -0800<\/strong><\/p>\n

\n

Domain Name System Security Extensions (DNSSEC) secures the Domain Name System (DNS), right?<\/p>\n

Yes, but that’s not the whole story. DNSSEC can also introduce troubles into your DNS server.<\/p>\n

Recently, a BIND bug caused by a missing RRSIG record, which is a part of DNSSEC, was fixed by a patch<\/a> from the Internet Systems Consortium (ISC). This bug affects all versions of BIND recursive servers, and can cause a denial of service (DoS.)<\/p>\n

This potential DoS vulnerability is caused by a RUNTIME CHECK error in Resolver.c when handling the DNS query response AUTHORITY section without covering RRSIG. In this post we will examine the BIND source codes and expose the root cause of this vulnerability.<\/p>\n

The RRSIG record (record type 46) holds a DNSSEC signature for records with the same name and type. DNS Resolvers use this cryptographic signature to verify that a zone has signed these records.<\/p>\n

The RDATA field of RRSIG record has the following format:<\/p>\n

                       1 1 1 1 1 1 1 1 1 1 2 2 2 2 2 2 2 2 2 2 3 3<\/strong><\/pre>\n
      0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1<\/strong><\/pre>\n
     +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+<\/strong><\/pre>\n
     |        Type Covered           |  Algorithm    |     Labels    |<\/strong><\/pre>\n
     +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+<\/strong><\/pre>\n
     |                         Original TTL                          |<\/strong><\/pre>\n
     +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+<\/strong><\/pre>\n
     |                      Signature Expiration                     |<\/strong><\/pre>\n
     +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+<\/strong><\/pre>\n
     |                      Signature Inception                      |<\/strong><\/pre>\n
     +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+<\/strong><\/pre>\n
     |            Key Tag            |                               \/<\/strong><\/pre>\n
     +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+         Signer's Name         \/<\/strong><\/pre>\n
     \/                                                               \/<\/strong><\/pre>\n
     +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+<\/strong><\/pre>\n
     \/                                                               \/<\/strong><\/pre>\n
     \/                            Signature                          \/<\/strong><\/pre>\n
     \/                                                               \/<\/strong><\/pre>\n
     +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+<\/strong><\/pre>\n
 <\/p>\n
The "Type Covered" field in the RDATA field above indicates the type of the record covered by the RRSIG record. It is important to know that there may be several records with the same name as the RRSIG record, which causes a problem for DNSSEC.<\/p>\n
If DNSSEC is enabled, an RRSIG record should cover every record in the DNS response ANSWER section and the AUTHORITY section. However, for records with the same name, BIND named fails to check the match in the AUTHORITY section between the record and the covering RRSIG, which causes a RUNTIME CHECK error in resolver.c and forces named to exit.  <\/p>\n
The following code snippet was taken from BIND version 9.10.4-P4. Comments added by me have been highlighted.<\/p>\n
 <\/p>\n
\n
resolver.c:<\/em><\/p>\n
\/\/cache the record name in the ANSWER section of DNS response<\/em><\/strong><\/span><\/p>\n
5246     static inline isc_result_t<\/em><\/p>\n
5247     cache_name(fetchctx_t *fctx, dns_name_t *name, dns_adbaddrinfo_t *addrinfo,<\/em><\/p>\n
5248                   isc_stdtime_t now)<\/em><\/p>\n
5249     {<\/em><\/p>\n
….<\/em><\/p>\n
5603                                        if (ANSWER(rdataset) &&<\/em><\/p>\n
5604                                           rdataset->type != dns_rdatatype_rrsig) {<\/em><\/p>\n
5605                                                    isc_result_t tresult;<\/em><\/p>\n
5606                                                    dns_name_t *noqname = NULL;<\/em><\/p>\n
                                                                  <\/span><\/em>\/\/extract the records from AUTHORITY section and store it in "noqname".<\/em><\/strong><\/span><\/p>\n
5607                                                    tresult = findnoqname(fctx, name,<\/em><\/p>\n
5608                                                                                  rdataset->type, &noqname);<\/em><\/p>\n<\/blockquote>\n
The malformed AUTHORITY section has the following form:<\/p>\n
     +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+<\/strong><\/pre>\n
     |                   NESC3 record                        |<\/strong><\/pre>\n
     +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+<\/strong><\/pre>\n
     |            covering RRSIG for NESC3 record            |<\/strong><\/pre>\n
     +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+<\/strong><\/pre>\n
     |           NESC record without covering RRSIG          |<\/strong><\/pre>\n
     +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+<\/strong>  <\/pre>\n
The BIND named links all the records with the same name in a list and manipulates them by checking the list in a loop. In the example above, three records in the AUTHORITY section have the same name and will be linked in one list. This list is used as "nsec->list" and "name->list" in the following codes.<\/p>\n
\n
resolver.c:<\/em><\/p>\n
5119      findnoqname(fetchctx_t *fctx, dns_name_t *name, dns_rdatatype_t type,<\/em><\/p>\n
5120                    dns_name_t **noqnamep)<\/em><\/p>\n
5121      {<\/em><\/p>\n
….<\/em><\/p>\n
5183                section = DNS_SECTION_AUTHORITY;<\/em><\/p>\n
                          \/\/check the records in AUTHORITY section one by one in a loop<\/em><\/strong><\/span><\/p>\n
5184                for (result = dns_message_firstname(fctx->rmessage, section);<\/em><\/p>\n
5185                     result == ISC_R_SUCCESS;<\/em><\/p>\n
5186                     result = dns_message_nextname(fctx->rmessage, section)) {<\/em><\/p>\n
5187                            dns_name_t *nsec = NULL;<\/em><\/p>\n
5188                            dns_message_currentname(fctx->rmessage, section, &nsec);<\/em><\/p>\n
5189                            for (nrdataset = ISC_LIST_HEAD(nsec->list);<\/em><\/p>\n
5190                                  nrdataset != NULL; nrdataset = next) {<\/em><\/p>\n
….<\/em><\/p>\n
5212 <\/em>                                          \/\/parse the NSEC3 record at first and return successfully, "noqname" will be set the "name" of the NSEC3 record.<\/strong><\/span><\/em><\/p>\n
5213                                        if (nrdataset->type == dns_rdatatype_nsec3 &&<\/em><\/p>\n
5214                                            NXND(dns_nsec3_noexistnodata(type, name, nsec,<\/em><\/p>\n
5215                                                                                         nrdataset, zonename,<\/em><\/p>\n
5216                                                                                         &exists, &data,<\/em><\/p>\n
5217                                                                                         &optout, &unknown,<\/em><\/p>\n
5218                                                                                         &setclosest,<\/em><\/p>\n
5219                                                                                         &setnearest,<\/em><\/p>\n
5220                                                                                         closest, nearest,<\/em><\/p>\n
5221                                                                                         fctx_log, fctx)))<\/em><\/p>\n
5222                                        {<\/em><\/p>\n
5223                                                    if (!exists && setnearest) {<\/em><\/p>\n
5224                                                                noqname = nsec;<\/em><\/p>\n
5225                                                                found = dns_rdatatype_nsec3;<\/em><\/p>\n
….<\/em><\/p>\n
                                                        \/\/parse the NSEC record <\/span><\/em><\/strong><\/p>\n
5201                                        if (nrdataset->type == dns_rdatatype_nsec &&<\/em><\/p>\n
5202                                            NXND(dns_nsec_noexistnodata(type, name, nsec,<\/em><\/p>\n
5203                                                                                        nrdataset, &exists,<\/em><\/p>\n
5204                                                                                        &data, NULL, fctx_log,<\/em><\/p>\n
5205                                                                                        fctx)))<\/em><\/p>\n
5206                                        {<\/em><\/p>\n
                     \/\/craft the NSEC record and make "exists" return "true", noqname will not change, it is still the "name" of the NSEC3 record.<\/span><\/em><\/strong><\/p>\n
5207                                                    if (!exists) {<\/em><\/p>\n
5208                                                                noqname = nsec;<\/em><\/p>\n
5209                                                                found = dns_rdatatype_nsec;<\/em><\/p>\n
….<\/em><\/p>\n<\/blockquote>\n
 <\/p>\n
\n
resolver.c:<\/em><\/p>\n
                                                                 \/\/return to "cache_name()" function <\/strong><\/span><\/em><\/p>\n
5609                                                    if (tresult == ISC_R_SUCCESS &&<\/em><\/p>\n
5610                                                        noqname != NULL) {<\/em><\/p>\n
                                                                         <\/span>\/\/associate the NSEC3 record and the NSEC record with the current record received from the ANSWER section. "rdataset" points to this record.<\/span><\/em><\/strong><\/p>\n
5611                                                                tresult = dns_rdataset_addnoqname(<\/em><\/p>\n
5612                                                                                            rdataset, noqname);<\/em><\/p>\n
                                                                        \/\/do the RUNTIME CHECK, if function "dns_rdataset_addnoqname()" doesn't return "ISC_R_SUCCESS", RUNTIME_CHECK fails and makes BIND named exit.<\/em><\/strong><\/span><\/p>\n
5613                                                                RUNTIME_CHECK(tresult == ISC_R_SUCCESS);<\/em><\/p>\n
 <\/p>\n<\/blockquote>\n
\n
rdataset.c:<\/em><\/p>\n
637    isc_result_t<\/em><\/p>\n
638    dns_rdataset_addnoqname(dns_rdataset_t *rdataset, dns_name_t *name) {<\/em><\/p>\n
639    <\/em><\/p>\n
640      REQUIRE(DNS_RDATASET_VALID(rdataset));<\/em><\/p>\n
641      REQUIRE(rdataset->methods != NULL);<\/em><\/p>\n
642      if (rdataset->methods->addnoqname == NULL)<\/em><\/p>\n
643                  return (ISC_R_NOTIMPLEMENTED);<\/em><\/p>\n
             \/\/call the callback function. In this case, it is "isc__rdatalist_addnoquname()". <\/strong><\/span><\/em><\/p>\n
644      return((rdataset->methods->addnoqname)(rdataset, name));<\/em><\/p>\n
645    }<\/em><\/p>\n<\/blockquote>\n
 <\/p>\n
\n
rdatalist.c:<\/em><\/p>\n
190    isc_result_t<\/em><\/p>\n
191    isc__rdatalist_addnoqname(dns_rdataset_t *rdataset, dns_name_t *name) {<\/em><\/p>\n
192      dns_rdataset_t *neg = NULL;<\/em><\/p>\n
193      dns_rdataset_t *negsig = NULL;<\/em><\/p>\n
194      dns_rdataset_t *rdset;<\/em><\/p>\n
195      dns_ttl_t ttl;<\/em><\/p>\n
196    <\/em><\/p>\n
197      REQUIRE(rdataset != NULL);<\/em><\/p>\n
198    <\/em><\/p>\n
199      for (rdset = ISC_LIST_HEAD(name->list);<\/em><\/p>\n
200           rdset != NULL;<\/em><\/p>\n
201           rdset = ISC_LIST_NEXT(rdset, link))<\/em><\/p>\n
202      {<\/em><\/p>\n
203                  if (rdset->rdclass != rdataset->rdclass)<\/em><\/p>\n
204                              continue;<\/em><\/p>\n
                          \/\/because the NSEC3 record and the NSEC record have the same name, they are linked in one list, which is "name->list" here, but the NSEC record is after the NSEC3 record in the list. As a result, neg points to the NSEC record but not the NSEC3 record. <\/strong><\/span><\/em><\/p>\n
205                  if (rdset->type == dns_rdatatype_nsec ||<\/em><\/p>\n
206                      rdset->type == dns_rdatatype_nsec3)<\/em><\/p>\n
207                              neg = rdset;<\/em><\/p>\n
208      }<\/em><\/p>\n
….<\/em><\/p>\n
212      for (rdset = ISC_LIST_HEAD(name->list);<\/em><\/p>\n
213           rdset != NULL;<\/em><\/p>\n
214           rdset = ISC_LIST_NEXT(rdset, link))<\/em><\/p>\n
215      {<\/em><\/p>\n
                          \/\/the NSEC record doesn't have a covering RRSIG, so nesig cannot be set value. <\/span><\/em><\/strong><\/p>\n
216                  if (rdset->type == dns_rdatatype_rrsig &&<\/em><\/p>\n
217                      rdset->covers == neg->type)<\/em><\/p>\n
218                              negsig = rdset;<\/em><\/p>\n
219      }<\/em><\/p>\n
220    <\/em><\/p>\n
             \/\/negsig cannot be set value and is nul., ISC_R_NOTFOUND is returned, which triggers the RUNTIME_CHECK error.<\/em><\/strong><\/span><\/p>\n
221      if (negsig == NULL)<\/em><\/p>\n
222                  return (ISC_R_NOTFOUND)<\/em><\/p>\n<\/blockquote>\n
 <\/p>\n
The following image shows the abortion of the affected DNS server:<\/p>\n
\"crash<\/p>\n
Please note that authentication is NOT required to exploit this vulnerability.<\/p>\n
Remedey <\/strong><\/h2>\n
Fortinet released IPS signature ISC.BIND.Response.Authority.Section.RRSIG.Missing.DoS to address this vulnerability.<\/p>\n<\/div
https:\/\/blog.fortinet.com\/feed<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

Domain Name System Security Extensions (DNSSEC) secures the Domain Name System (DNS), right?    Yes, but that&rsquo;s not the whole story. DNSSEC can also introduce troubles into your DNS server.    Recently, a BIND bug caused by a missing RRSIG record, which is a part of DNSSEC, was fixed by a patch from the Internet Systems Consortium (ISC). This bug affects all versions of BIND recursive servers, and can cause a denial of service (DoS.)    This potential DoS vulnerability is caused by a RUNTIME CHECK error in Resolver.c when handling the DNS…<\/p>\n","protected":false},"author":4,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"colormag_page_container_layout":"default_layout","colormag_page_sidebar_layout":"default_layout","footnotes":""},"categories":[10424,10378],"tags":[],"class_list":["post-6520","post","type-post","status-publish","format-standard","hentry","category-fortinet","category-security"],"_links":{"self":[{"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts\/6520","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/comments?post=6520"}],"version-history":[{"count":0,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts\/6520\/revisions"}],"wp:attachment":[{"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/media?parent=6520"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/categories?post=6520"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/tags?post=6520"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}