srv bug
Summary:
A bug in the handling of the compression pointer tables can result in the name server entering an infinite loop.
CVE:
CVE-2000-0888
CERT:
VU#198355
Posting date:
07 Nov 2000
Program Impacted:
BIND
Versions affected:
8.2.1, 8.2 - 8.2.2-p6
Severity:
Serious
Exploitable:
Remotely Description:
This vulnerability can cause affected DNS servers running named to go into an infinite loop, thus preventing further name requests to be handled. This can happen if an SRV record (defined in RFC2782) is sent to the vulnerable server.
Microsoft's Windows 2000 Active Directory service makes extensive use of SRV records and is reportedly capable of triggering this bug in the course of normal operations. This is not, however, a vulnerability in Microsoft Active Directory. Any network client capable of sending SRV records to vulnerable name server systems can exercise this vulnerability.
Workarounds:
None.
Active exploits:
None known at this time.
Solution:
Upgrade to BIND 8.2.2-p7 or later
