Isc bind 9 DNS64 REQUIRE assertion failure Denial of Service Vulnerability

Release date: 2012-4 4
Updated on: 2012-12-07

Affected Systems:
Isc bind 9.9.0-> 9.9.2
Isc bind 9.8.0-> 9.8.4
Description:
--------------------------------------------------------------------------------
Bugtraq id: 56817
CVE (CAN) ID: CVE-2012-5688

BIND is a widely used DNS protocol.

Isc bind 9.8.0 and later support the DNS64 IPv6 conversion mechanism. If the dns64 configuration status is enabled, the BIND 9 Domain Name Server will trigger a REQUIRE assertion failure when parsing a specially crafted request, resulting in a server crash. This vulnerability can be remotely exploited. It is not affected if DNS64 is not enabled in versions earlier than 9.8.0.

<* Source: BlueCat Networks

Link: http://secunia.com/advisories/51484/
Https://www.isc.org/software/bind/advisories/cve-2012-5688
Https://kb.isc.org/article/AA-00828
*>

Suggestion:
--------------------------------------------------------------------------------
Temporary solution:

For BIND 9 servers with DNS64 enabled, requests from suspicious clients are prohibited. You can also disable DNS64 and upgrade it to a version with fixed patches.

Vendor patch:

ISC
---
ISC has released a Security Bulletin (AA-00828) and corresponding patches for this:

AA-00828: CVE-2012-5688: BIND 9 servers using DNS64 can be crashed by a crafted query

Link: https://kb.isc.org/article/AA-00828

Patch download: http://www.isc.org/downloads/all.

BIND 9 version 9.8.4-P1
BIND 9 version 9.9.2-P1