Penetration Test Report (X41 D-Sec): X41 ISC BIND9 Code Audit Public Report 2024 02 13

SourceCodeAuditofBIND9
forInternetSystemsCorporation
FinalReportandManagementSummary
2024-02-02
PUBLIC
X41 D-SEC GmbH
Krefelder Str. 123
D-52070 Aachen
Amtsgericht Aachen: HRB19989
https://x41-dsec.de/
info@x41-dsec.de
SourceCodeAuditofBIND9 InternetSystemsCorporation
Revision Date Change Author(s)
1 2023-06-30 ReportFirstSprint E.Sesterhenn,M.Vervier
2 2023-12-05 FinalReportandManagement E.Sesterhenn,M.Vervier
Summary
3 2024-02-13 PublicRelease E.Sesterhenn,M.Vervier
X41D-SecGmbH PUBLIC Page1of98
SourceCodeAuditofBIND9 InternetSystemsCorporation
Contents
1 ExecutiveSummary 4
2 Introduction 6
2.1 Methodology . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6
2.2 FindingsOverview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8
2.3 Scope . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
2.4 Coverage . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
2.5 RecommendedFurtherTests . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
3 RatingMethodologyforSecurityVulnerabilities 13
4 Results 15
4.1 Findings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15
4.2 InformationalNotes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35
5 AboutX41D-SecGmbH 75
A Appendix 77
A.1 FuzzTesting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 77
A.2 CodeQLQueries . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 92
X41D-SecGmbH PUBLIC Page2of98
SourceCodeAuditofBIND9 InternetSystemsCorporation
Dashboard
Target
Customer InternetSystemsCorporation
Name BIND9
Type DNSServer
Version 9.19.13and9.19.17
Engagement
Type SecuritySourceCodeAudit
Consultants 2:EricSesterhennandMarkusVervier
EngagementEffort 60person-days,2023-05-29to2023-11-30
Totalissuesfound 8
Critical - 0
High - 0 CWE-789(1)
CWE-401(1) CWE-190(3)
Medium - 2
CWE-1325(1)
Low - 6
CWE-617(C1W)E-121(1)
None - 23
0 2 4 6 8 10 12 14 16 18 20 22
Figure1:IssueOverview(l:Severity,r:CWEDistribution)
X41D-SecGmbH PUBLIC Page3of98
SourceCodeAuditofBIND9 InternetSystemsCorporation
1 Executive Summary
FromJunetoNovember2023,X41D-SecGmbHperformedasecuritysourcecodeauditagainst
ISCBIND9toidentifyvulnerabilitiesandweaknessesintheDNSserver,toolsandlibraries.
AtotalofeightvulnerabilitieswerediscoveredduringthetestbyX41.Nonewereratedascritical,
none were classified as high severity, two as medium, and six as low. Additionally, 23 issues
withoutadirectsecurityimpactwereidentified.
Low - 6
Medium - 2
Figure1.1:IssuesandSeverity
BIND 9 is an open source DNS server accompanied by libraries and tools that enable users to
resolve domain names. It is a critical part of the current Internet infrastructure and therefore
subjecttoscrutiny. VulnerabilitiescouldhavealargeimpactontheworldwideInternet. Dueto
this,thecodebasewasregularlytestedbeforewithvariousfuzzingharnessesandinspectedwith
variousstaticanalyzersandanalysistoolsbeforethisauditandseemstobeingoodshape.
Thetestwasperformedbytwoexperiencedsecurityexpertsbetween2023-05-29and2023-11-
X41D-SecGmbH PUBLIC Page4of98
SourceCodeAuditofBIND9 InternetSystemsCorporation
30. ISCprovidedthesourcecodeandacommunicationchannelwithselecteddeveloperswith
whomthecommunicationduringtheprojectwasflawless.
The most severe issue discovered allows an attacker to crash the named DNS server on some
setups by sending maliciously formatted data to the command channel, which will exhaust the
availablestackmemorywhenparsed. Thiscanbetriggeredpre-authenticationbutinstallations
mightprotectthatserviceusingnetworklevelaccesscontrolandistrackedasCVE-2023-3341.
Othersecurityrelevantissuesarerelatedtothehandlingofintegerssuchastruncationorover-
flowoflengthvalues.Itisrecommendedtoalsoreviewtheinformationalissuesthatarerelated
tohardeningorissuesthatmightbecomesecurityrelevantinthefuture.
Thecodewasauditedinafirstphasetoverifythemostobviousattacksurfaceandtovalidate
theabsenceofcommonlypresentvulnerabilityclassesthatareoftenfoundincomplexCcode.
Inasecondphaseadeeperinvestigationoccuredformoreobscurebugsandlogicissues.
Inconclusion,thequalityofthesourcecodeisfaraboveaverageincomparisonwithprojectsof
asimilarsize.Whilevulnerabilitieswerefoundduringthisaudit,thecodehasbeenhardenedand
couldserveasanexampleonhowtodevelopCcodewithsecurityinmind. X41attributesthe
usageofsafepatternsforconcurrencyandsafememoryaccesstobeamaincontributingfactorin
eleminationoratleastreductionoftheoccurenceofcertainbugclassesrelaedtounsafememory
operations.
Due to the constantly changing nature of such large code bases and the time-boxed nature of
securityreviews,X41recommendstoperformindependentreviewonaregularbasis. Thispre-
ventsthemanifestationofmorecomplexvulnerabilitiesandarchitecturalflawsorotherwiseun-
expectedbehaviors.
X41D-SecGmbH PUBLIC Page5of98
SourceCodeAuditofBIND9 InternetSystemsCorporation
2 Introduction
X41reviewedthesourcecodeoftheBIND9DNS1 daemonandassociatedlibrariesandtools,
whichperformDNSqueriesandparseresponsestoresolvehostnames.
They are considered sensitive because the DNS is a critical part of the Internet infrastructure
and several security mechanisms depend on DNS working correctly. Additionally, the libraries
andtoolsBIND9providesareusedinawiderangeofoperatingsystemsanddevices.
Attackers could try to abuse implementation-specific issues to gain RCE2 on the server. Logic
bugsmightbeusedforDoS3attacks,whichattackerscouldleveragetopreventaccesstoawide
rangeofsystemsbydisruptingnameresolution.
2.1 Methodology
Thereviewwasbasedonasourcecodereviewagainstthelatestdevelopmentversions(9.19.13
inthefirstphaseand9.19.17inthesecondphase)oftheBIND9DNSdaemon.
A manual approach for penetration tests and for code reviews is used by X41. This process is
supportedbytoolssuchasstaticcodeanalyzersandindustrystandardwebapplicationsecurity
tools4.
X41adherestoestablishedstandardsforsourcecodereviewingandpenetrationtesting. These
areinparticulartheCERTSecureCoding5 standardsandtheStudy-APenetrationTestingModel6
oftheGermanFederalOfficeforInformationSecurity.
The workflow of source code reviews is shown in figure 2.1. In an initial, informal workshop
1DomainNameSystem
2RemoteCodeExecution
3DenialofService
4https://portswigger.net/burp
5https://wiki.sei.cmu.edu/confluence/display/seccode/SEI+CERT+Coding+Standards
6https://www.bsi.bund.de/SharedDocs/Downloads/EN/BSI/Publications/Studies/Penetration/penetrati
on_pdf.pdf?__blob=publicationFile&v=1
X41D-SecGmbH PUBLIC Page6of98
SourceCodeAuditofBIND9 InternetSystemsCorporation
regardingthedesignandarchitectureoftheapplicationabasicthreatmodeliscreated. Thisis
used to explore the source code for interesting attack surface and code paths. These are then
auditedmanuallyandwiththehelpoftoolssuchasstaticanalyzersandfuzzers. Theidentified
issuesaredocumentedandcanbeusedinagapanalysistohighlightchangestopreviousaudits.
Ini�al Design Threat Code
Workshop Modelling Review
Fixing and GAP / Performance
Documenta�on
Mi�ga�on Analysis
Figure2.1:CodeReviewMethodology
X41D-SecGmbH PUBLIC Page7of98
SourceCodeAuditofBIND9 InternetSystemsCorporation
2.2 Findings Overview
DESCRIPTION SEVERITY ID GL REF
IntegerOverflowinhttp_calloc() LOW BND-CA-23-01 4120 4.1.1
IntegerOverflowinmallocx() LOW BND-CA-23-02 4121 4.1.2
IntegerOverflowinresize() LOW BND-CA-23-03 4122 4.1.3
BufferOverflowinprocess_request() LOW BND-CA-23-04 4124 4.1.4
NegativeContent-LengthLeadstoabort() LOW BND-CA-23-05 4125 4.1.5
StackExhaustioninCommandChannel MEDIUM BND-CA-23-06 4152 4.1.6
OpenSSLErrorQueueNotEmptied LOW BND-CA-23-07 4157 4.1.7
UnboundedTokenParsing MEDIUM BND-CA-23-08 4339 4.1.8
MemoryLeakDuetorealloc()Misuse NONE BND-CA-23-100 4174 4.2.1
ISCMemoryAPI NONE BND-CA-23-101 n/a 4.2.2
JournalFileHandlingMissingSanityChecks NONE BND-CA-23-102 4175 4.2.3
Uncheckedmalloc() NONE BND-CA-23-103 4077 4.2.4
StackExhaustioninConfigParser NONE BND-CA-23-104 4176 4.2.5
Connecti