There was a post elsewhere that using BIND 9 as a forwarder will negate this threat as BIND 9 reconnstructs all DNS queries/replies, hence dismantling the buffer overflow. So if you can't upgrade everything's libc, just forcing everything to send/receive DNS stuff through a BIND 9 named will provide protection from this attack.