dns/bind9* -- Heavy DNSSEC Validation Load Can Cause a 'Bad Cache' Assertion Failure

Description:

ISC reports:

High numbers of queries with DNSSEC validation enabled can cause an assertion failure in named, caused by using a 'bad cache' data structure before it has been initialized.

BIND 9 stores a cache of query names that are known to be failing due to misconfigured name servers or a broken chain of trust. Under high query loads when DNSSEC validation is active, it is possible for a condition to arise in which data from this cache of failing queries could be used before it was fully initialized, triggering an assertion failure.

This bug cannot be encountered unless your server is doing DNSSEC validation.

References:

• CVE name CVE-2012-3817
• URL: <https://kb.isc.org/article/AA-00729>

Affects:

• bind99 <9.9.1.2
• bind98 <9.8.3.2
• bind97 <9.7.6.2
• bind96 <9.6.3.1.ESV.R7.2

Disclaimer: The data contained on this page is derived from the VuXML document, please refer to the the original document for copyright information. The author of portaudit makes no claim of authorship or ownership of any of the information contained herein.

If you have found a vulnerability in a FreeBSD port not listed in the database, please contact the FreeBSD Security Team. Refer to "FreeBSD Security Information" for more information.