-----BEGIN PGP SIGNED MESSAGE-----

Hash: SHA1
		 NetBSD Security Advisory 2007-007

		 =================================
Topic:		BIND cryptographically weak query IDs
Version:	NetBSD-current:	source prior to July 24, 2007

		NetBSD 4.0_BETA2:	affected

		NetBSD 3.1:		affected

		NetBSD 3.0.*:		affected

		NetBSD 3.0:		affected

		NetBSD 2.1:		affected

		NetBSD 2.0.*:		affected

		NetBSD 2.0:		affected
Severity:	Remote DNS cache poisoning
Fixed:		NetBSD-current:		July 24, 2007

		NetBSD-4 branch:	July 31, 2007

			(4.0 will include the fix)

		NetBSD-3-1 branch:	August 14, 2007

			(3.1.1 will include the fix)

		NetBSD-3-0 branch:	August 14, 2007

			(3.0.3 will include the fix)

		NetBSD-3 branch:	August 14, 2007

		NetBSD-2-1 branch:	September 13, 2007

		NetBSD-2-0 branch:	September 13, 2007

		NetBSD-2 branch:	September 13, 2007

		pkgsrc:			bind-9.4.1pl1 corrects the issue

					bind-8.4.7pl1 corrects the issue
Abstract

========
Due to the use of cryptographically weak query IDs an attacker can predict

query IDs and poison the cache by injecting their own responses.
This vulnerability has been assigned CVE references CVE-2007-2926 for BIND 9.x

and CVE-2007-2930 for BIND 8.x.
Technical Details

=================
- From www.isc.org:
BIND 9.x:

"The DNS query id generation is vulnerable to cryptographic analysis which

provides a 1 in 8 chance of guessing the next query id for 50% of the query

ids. This can be used to perform cache poisoning by an attacker.
This bug only affects outgoing queries, generated by BIND 9 to answer

questions as a resolver, or when it is looking up data for internal uses,

such as when sending NOTIFYs to slave name servers."
BIND 8.x:

"This bug only affects outgoing queries, generated by BIND 8 to answer

questions as a resolver, or when it is looking up data for internal uses,

such as when sending NOTIFYs to slave name servers."
Solutions and Workarounds

=========================
It is recommended that NetBSD users of vulnerable versions update

their binaries.
The following instructions describe how to upgrade your bind

binaries by updating your source tree and rebuilding and

installing a new version of bind.
* NetBSD-current:
	Systems running NetBSD-current dated from before 2007-07-24

	should be upgraded to NetBSD-current dated 2007-07-25 or later.
	The following directories need to be updated from the

	netbsd-current CVS branch (aka HEAD):

		dist/bind
	To update from CVS, re-build, and re-install bind:
		# cd src

		# cvs update -d -P dist/bind

		# cd usr.sbin/bind

		# make USETOOLS=no cleandir dependall

		# make USETOOLS=no install
* NetBSD 3.*:
	Systems running NetBSD 3.* sources dated from before

	2007-08-14 should be upgraded from NetBSD 3.* sources dated

	2007-08-15 or later.
	The following files need to be updated from the

	netbsd-3, netbsd-3-0 or netbsd-3-1 branches:

		dist/bind/bin/named/client.c

		dist/bind/lib/dns/dispatch.c

		dist/bind/lib/dns/include/dns/dispatch.h
	To update from CVS, re-build, and re-install bind:
		# cd src

		# cvs update -r  dist/bind/bin/named/client.c

		# cvs update -r  dist/bind/lib/dns/dispatch.c

		# cvs update -r  \

			dist/bind/lib/dns/include/dns/dispatch.h

		# cd usr.sbin/bind

		# make USETOOLS=no cleandir dependall

		# make USETOOLS=no install
* NetBSD 2.*:
	Systems running NetBSD 2.* sources dated from before

	2007-09-12 should be upgraded from NetBSD 3.* sources dated

	2007-09-13 or later.
	The following files need to be updated from the

	netbsd-2, netbsd-2-0 or netbsd-2-1 branches:

		dist/bind/bin/named/ns_forw.c

		dist/bind/bin/named/ns_func.h

		dist/bind/bin/named/ns_main.c

		dist/bind/bin/named/ns_resp.c
	To update from CVS, re-build, and re-install bind:
		# cd src

		# cvs update -r  dist/bind/bin/named/ns_forw.c

		# cvs update -r  dist/bind/bin/named/ns_func.c

		# cvs update -r  dist/bind/bin/named/ns_main.c

		# cvs update -r  dist/bind/bin/named/ns_resp.c

		# cd usr.sbin/bind

		# make USETOOLS=no cleandir dependall

		# make USETOOLS=no install
Thanks To

=========
Amit Klein for discovering and reporting this problem.
Revision History

================
	2007-09-13	Initial release
More Information

================
Advisories may be updated as new information becomes available.

The most recent version of this advisory (PGP signed) can be found at

  ftp://ftp.NetBSD.org/pub/NetBSD/security/advisories/NetBSD-SA2007-007.tx...
Information about NetBSD and NetBSD security can be found at

http://www.NetBSD.org/ and http://www.NetBSD.org/Security/.
Copyright 2007, The NetBSD Foundation, Inc.  All Rights Reserved.

Redistribution permitted only in full, unmodified form.
$NetBSD: NetBSD-SA2007-007.txt,v 1.1 2007/09/12 21:45:39 adrianp Exp $
-----BEGIN PGP SIGNATURE-----

Version: GnuPG v1.4.7 (NetBSD)
iQCVAwUBRumhsT5Ru2/4N2IFAQLQiwP/aLkPFQuSa56XdfbgYEdtWYmMAOMBvvYf

+U5hSdDK3K/02jQCkcUeHKVDOPEb3Ls21H/mMwk1AgVvI6+YW0ycPLGIMpXxgY15

Zn5WlqQtTtHkvdFHB9d0kGYVSuUxSRq0LCBEfcvk3aOQi57wuwO77O5yT+2yZJwl

ZREyrWwp7Dc=

=Oije

-----END PGP SIGNATURE-----