A small number of users upgrading their Domain Name System (DNS) servers to guard against a major exploit in BIND have become entangled in a denial of service issue.
The problem in updating from BIND (Berkeley Internet Name Domain) 4.9.x or 8.2.x to 9.1.0 is more a case of getting your hair singed than of jumping from the frying pan into the fire. This is because the DoS problem, though irritating, is much less serious than the earlier flaw.
On updating to BIND 9.1.0, some BSD users have experienced intermittent failures when running nmap.
Deri Jones, security services director at security testing specialists NTA Monitor, said: "The root cause appears to be a flaw in certain operating systems only, and the cause is the kernel returning a routine successfully but without in fact setting the right parameters."
"This is a small issue, involving low level kernel stuff, and shouldn't put people off upgrading their DNS software," he added.
According to postings on security mailing list, BugTraq, the issue has been reported by Free- Open- and NetBSD sites, and "some Linux users".
When BIND 9.1.1 is released it will include a work around so that such kernel flaws do not stop BIND working.
BIND is an open-source software program which has become the de-facto standard for DNS servers on the Internet. Around 80 per cent of DNS servers run BIND.
In January, a notice outlining a series of severe security problems with BIND was posted by CERT. The advisory documents four vulnerabilities in BIND, including two buffer overflows that could allow attackers to remotely gain unrestricted access to machines running the program. ®