How to remediate – AIX bind Advisory : bind_advisory11.asc (IV81278) (IV81279) (I…

1. Introduction

The AIX bind Advisory : bind_advisory11.asc (IV81278) (IV81279) (I…) vulnerability affects versions of the BIND DNS server on AIX systems. This is a denial-of-service issue caused by improper handling of string formatting options, potentially leading to daemon crashes and service interruption. Systems running vulnerable versions of bind are at risk from remote attackers who can exploit this flaw via crafted network requests. Impact is likely to be availability focused, with potential for service outages.

2. Technical Explanation

The vulnerability stems from a failure to properly validate input when processing Address Prefix Lists (APL) records in bind. An authenticated attacker can send a malformed APL record that triggers an INSIST assertion failure within the bind daemon, resulting in its termination and denial of service. CVE-2015-8704 describes this issue.

• Root cause: Improper handling of string formatting options when parsing Address Prefix Lists (APL) records.
• Exploit mechanism: A remote attacker sends a specially crafted APL record to the vulnerable bind instance, causing an INSIST assertion failure and daemon exit.
• Scope: AIX systems running affected versions of bind.

3. Detection and Assessment

To determine if your system is vulnerable, check the installed version of bind. A thorough assessment involves reviewing logs for evidence of exploitation attempts.

• Quick checks: Use the following command to display the bind version: bind -v
• Scanning: Nessus plugin ID 81329 can be used as an example to detect this vulnerability.
• Logs and evidence: Check system logs (e.g., /var/log/messages) for messages related to bind crashes or INSIST assertion failures.

bind -v

4. Solution / Remediation Steps

Apply the fix available from IBM AIX website to address this vulnerability.

4.1 Preparation

• There are no known service dependencies that require stopping prior to patching, but it is good practice to schedule during a maintenance window. A roll back plan involves restoring from backup or snapshot.
• Change control procedures should be followed as per your organization’s policy.

4.2 Implementation

1. Step 1: Download the appropriate fix package for your AIX version from https://aix.software.ibm.com/aix/efixes/security/bind_advisory11.asc
2. Step 2: Install the fix package using the smitty apply command or equivalent method.
3. Step 3: Reboot the system if required by the patch instructions.

4.3 Config or Code Example

Before

# No specific configuration changes are required before applying the patch.  The vulnerability is in the bind code itself.

After

# After applying the patch, ensure the service restarts successfully and functions as expected. Check the version to confirm the update has been applied (bind -v).

4.4 Security Practices Relevant to This Vulnerability

Practices that can help mitigate this type of vulnerability include a robust patch management process and least privilege access control.

• Practice 1: Implement a regular patch cadence for all software, including bind, to ensure timely application of security fixes.
• Practice 2: Apply the principle of least privilege by restricting access to DNS services only to authorized users and systems.

4.5 Automation (Optional)

Automation is not directly applicable for this specific vulnerability due to the need for downloading and applying a patch package, which typically requires manual intervention or integration with existing patch management tools.

5. Verification / Validation

• Post-fix check: Run bind -v and confirm the version number reflects the patched version.
• Re-test: Execute the quick check command (bind -v) again; it should no longer report the vulnerable version.
• Smoke test: Verify that DNS resolution is functioning correctly by resolving a known domain name using nslookup example.com or similar tools.
• Monitoring: Monitor system logs for any errors related to bind, particularly crashes or assertion failures.

bind -v

6. Preventive Measures and Monitoring

Update security baselines to include the patched version of bind. Consider incorporating vulnerability scanning into your CI/CD pipelines.

• Baselines: Update your AIX system baseline or configuration policy to require the latest patched version of bind.
• Asset and patch process: Implement a regular asset inventory and patch management cycle for all systems, including DNS servers.

7. Risks, Side Effects, and Roll Back

Applying the patch may require a system reboot, potentially causing brief service interruption. In rare cases, compatibility issues with other software components could arise. A roll back involves restoring from backup or snapshot.

• Risk or side effect 1: System reboot required, leading to temporary service downtime.
• Risk or side effect 2: Potential for compatibility issues with other AIX packages (unlikely but possible).

8. References and Resources

Refer to the official IBM AIX security advisory for detailed information about this vulnerability.

• Vendor advisory or bulletin: https://aix.software.ibm.com/aix/efixes/security/bind_advisory11.asc
• NVD or CVE entry: CVE-2015-8704