BIND vulnerabilities

An attacker can cause `named` to abort by sending a crafted DNS-over-HTTPS request with a cryptographically invalid SIG(0) record, and then closing the transport connection prematurely. This issue affects BIND 9 versions 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, and 9.20.9-S1 through 9.20.27-S1.

Malformed BRID/HHIT records can cause `named` to terminate unexpectedly. This vulnerability affects specific versions of BIND 9.

named in BIND 8.2 through 8.2.2-P6 allows remote attackers to cause a denial of service by sending an SRV record to the server, aka the "srv bug."

named in BIND 8.2 through 8.2.2-P6 allows remote attackers to cause a denial of service by making a compressed zone transfer (ZXFR) request and performing a name service query on an authoritative record that is not cached, aka the "zxfr bug."

CVE-1999-0024 vulnerability involves a malicious attack on DNS cache via BIND, exploiting predictable query IDs.

A recursive BIND server that receives a query with recursion desired (RD=1) followed by a non-recursive query (RD=0) may exit with an assertion failure, resulting in a denial of service. To be vulnerable, the BIND server must allow recursive queries and have at least two RPZ zones configured: one with the default setting of "recursive-only yes", and the other with "recursive-only no". This issue affects BIND 9 versions 9.16.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1.

A BIND resolver that is configured with both a "redirect" zone and "qname-minimization strict" may abort with an assertion failure while processing the redirect. This issue affects BIND 9 versions 9.16.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.16.8-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1.

Replaying GSS-TSIG signed UDP messages can result in memory corruption in "named". An attacker who can capture a previously signed UDP message can replay it while the negotiated TSIG key is still valid, and by also sending crafted queries to a zone the attacker controls, may potentially achieve remote code execution.

In a BIND resolver, inbound DNS protocol messages with a particular structure will result in additional processing, with no limit imposed by BIND. A DNS message with a maliciously large number of such structures will cause BIND to consume disproportionate amounts of CPU time and memory during processing. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1.

If a BIND resolver sends a query for a DNSSEC-signed authoritative zone, and the authoritative server replies with a valid wildcard answer and signed NSEC3 proof, followed by an unsigned NSEC at the same owner name, it will trigger an unexpected program exit. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.

In BIND 9, a validly signed NSEC3 record from an unrelated sibling zone may be accepted as an insecurity proof. This downgrades a secure delegation and allows a forged unsigned answer to pass through.

If BIND is loaded with a named.conf file that contains no global options block, an attacker can send a query of QTYPE TKEY which may cause an assertion failure and subsequent unexpected program exit. This issue affects BIND 9 versions 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, and 9.20.9-S1 through 9.20.27-S1.

In a query response, an attacker may send named multiple copies of a record that should only exist once (such as an SOA record). If the RDATA is identical on all copies, the record is appended to the in-memory RDATA set, increasing negative cache memory usage.

A BIND recursive resolver may experience excessive resource consumption if it encounters large numbers of a particular kind of invalid DNSSEC record. Default limits on max-records-per-type and max-types-per-name help mitigate the exposure.

On a resolver configured to use dns64, if an applicable answer from the authoritative server is malformed in a specific way, the resolver named process will exit unexpectedly. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.

For a secondary zone with transfers restricted by TSIG, named may start to serve the data provided in a zone transfer before the final message with the TSIG signature arrives. This could allow an attacker without a valid TSIG signature to send unauthorized zone contents to a secondary server, and named does not roll back to the pre-transfer state.

If a BIND resolver has cached a tree of SVCB/HTTPS AliasMode records, and is then queried for the root of that tree, the resolver will spend disproportionate CPU time constructing the response. This issue affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.18.11-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.

A BIND resolver encountering an SVCB/HTTPS AliasMode record referencing 14 or more SVCB/HTTPS ServiceMode records may fail to properly deallocate internal resources. If this happens repeatedly, resource exhaustion will eventually prevent the resolver from performing new recursive lookups. This issue affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.18.11-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.

A malformed zone may contain an NS or DNAME node above its origin, which `named` treats as a zone cut. If an attacker inserts a malformed zone into a BIND authoritative server (e.g., via zone transfer), queries for names inside the configured zone then lose authoritative status and return an out-of-zone delegation. On a server that also provides recursion BIND can follow this locally sourced cut and cache attacker-supplied data, affecting names outside the configured zone. This situation persists as long as the malformed zone remains in the zone database. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.

An inapplicable NSEC record may be accepted by a `named` resolver as proof that no wildcard exists, which could allow an attacker at the same or an upstream level of the zone name to mask the existence of a victim's wildcard record. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.

If an attacker-controlled authoritative server can produce a negative answer that is exactly 65536 bytes, then a flaw in named results in a negative cache entry of 0 bytes. When this entry is subsequently read, named aborts.

An attacker may be able to cause a `named` resolver to abort. The attack requires inducing the victim resolver to send multiple queries for a DNSSEC-signed zone hosted by an authoritative server under the control of the attacker. If the auth responds with a particular sequence of crafted answers, and those answers arrive in a particular order with particular timing, the `named` resolver will encounter a use-after-free bug, and abort. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.

The BIND resolver accepts validly-signed NSEC records where the "Next Domain Name" field points outside the signer's zone. Affected versions include BIND 9.11.0-9.18.50, 9.20.0-9.20.24, 9.21.0-9.21.23, and S1 versions.

BIND 9 in certain versions may exit unexpectedly with an assertion while validating proof if a domain is covered by both NSEC and NSEC3 records and an RRSIG exists for only one type.

BIND 9 contains a vulnerability that causes unexpected termination of the named process. The issue occurs with specific ordering of responses to queries for CNAME, DNAME, and A records when the authoritative server delays the response.

In BIND 9, an attacker can respond to a query with an RRSIG having fewer labels than the zone, causing a wildcard name for a shorter zone, leading to cache poisoning. This requires synth-from-dnssec yes (default).

A DNSSEC validating resolver under a random subdomain attack can suffer from runaway memory usage, exceeding the max-cache-size limit. The attacker needs to send queries faster than the resolver can validate.

Resource exhaustion vulnerability in BIND related to DNSSEC validation. The server always validates all RRSIG records in a response, even if unnecessary, leading to excessive CPU usage.

BIND 9 has a vulnerability in RPZ processing with wildcard CNAME policies. An attacker can send a query with a long name triggering a NAMETOOLONG error, which may lead to bypassing RPZ rules or an unexpected exit of BIND 9.

A flaw in BIND 9: accepting an invalid data structure in a DNS record (PRIVATEDNS algorithm with incorrect length) can cause the server to abort when rendering the record to text.

BIND may accept incorrect child-zone NSEC3 records as valid, allowing an attacker to forge authenticated NXDOMAIN responses. This affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, and corresponding -S1 versions.

An unbounded resend loop in the BIND 9 resolver state machine during bad-server handling. A remote unauthenticated attacker can cause severe resource exhaustion by sending queries that trigger specific retry conditions.

A use-after-free vulnerability due to a race condition exists in BIND 9 versions 9.20.0 through 9.20.22, 9.21.0 through 9.21.21, and 9.20.9-S1 through 9.20.22-S1. During SIG(0) signature validation, if the 'recursive-clients' limit is reached and the message is discarded, validation may attempt to read the discarded message. Versions 9.18.28-9.18.49 and 9.18.28-S1-9.18.49-S1 are not affected.

Multiple flaws in `named` related to handling DNS messages with non-IN classes (e.g., CHAOS, HESIOD) or meta-classes (ANY, NONE). Specially crafted requests can cause assertion failures in `named`.

A use-after-free vulnerability in the DNS-over-HTTPS implementation in BIND 9 versions 9.20.0-9.20.22, 9.21.0-9.21.21, and 9.20.9-S1-9.20.22-S1. Versions 9.18.x are not affected.

BIND resolvers are vulnerable to an amplified resource consumption/exhaustion attack. If a victim resolver queries a specially crafted zone, it will consume disproportionate resources. Affects multiple BIND 9 versions.

Vulnerability in BIND servers configured to use TKEY authentication with GSS-API tokens. Receiving crafted packets can lead to excessive memory consumption, resulting in Denial of Service.

A specially crafted domain can cause a memory leak in a BIND resolver simply by querying this domain. This issue affects BIND 9 versions 9.20.0 through 9.20.20, 9.21.0 through 9.21.19, and 9.20.9-S1 through 9.20.20-S1.

Excessive CPU consumption vulnerability in BIND 9 resolver during DNSSEC validation when encountering a maliciously crafted zone. Authoritative servers are generally unaffected but may make recursive queries in some cases.

In specific circumstances, due to a weakness in the Pseudo Random Number Generator (PRNG) that is used, it is possible for an attacker to predict the source port and query ID that BIND will use. This issue affects BIND 9 versions 9.16.0 through 9.16.50, 9.18.0 through 9.18.39, 9.20.0 through 9.20.13, 9.21.0 through 9.21.12, and corresponding -S1 versions.

Under certain circumstances, BIND is too lenient when accepting records from answers, allowing an attacker to inject forged data into the cache. This issue affects multiple BIND 9 versions.

On a BIND 9 resolver configured with both stale-answer-enable yes and stale-answer-client-timeout 0, reaching the recursive-clients quota can cause named to loop and terminate unexpectedly due to a stack overflow.

A named instance running as a DNSSEC-validating recursive resolver with the synth-from-dnssec option (RFC 8198) enabled can be remotely terminated using a zone with a malformed NSEC record.

In BIND 9, a recursive resolver named maintains a cache database with a max-cache-size limit. It was discovered that the effectiveness of the cache-cleaning algorithm can be severely diminished by querying the resolver for specific RRsets in a certain order, effectively allowing the configured limit to be significantly exceeded.

By spoofing the target resolver with responses that have a malformed EdDSA signature, an attacker can trigger a small memory leak, potentially exhausting memory and causing named to crash.

By spoofing the target resolver with responses that have a malformed ECDSA signature, an attacker can trigger a small memory leak, potentially exhausting memory and causing named to crash.

By flooding the target resolver with queries exploiting this flaw an attacker can significantly impair the resolver's performance, effectively denying legitimate clients access to the DNS resolution service.

In ISC BIND9 versions BIND 9.11.14 -> 9.11.19, BIND 9.14.9 -> 9.14.12, BIND 9.16.0 -> 9.16.3, BIND Supported Preview Edition 9.11.14-S1 -> 9.11.19-S1: Unless a nameserver is providing authoritative service for one or more zones and at least one zone contains an empty non-terminal entry containing an asterisk ("*") character, this defect cannot be encountered. A would-be attacker who is allowed to change zone content could theoretically introduce such a record in order to exploit this condition to cause denial of service, though we consider the use of this vector unlikely because any such attack would require a significant privilege level and be easily traceable.

The "managed-keys" feature in BIND allows automatic maintenance of keys used by trust anchors. Due to an error in this feature, a BIND server using managed-keys can exit due to an assertion failure if, during key rollover, a trust anchor's keys are replaced with keys using an unsupported algorithm. Affected versions: BIND 9.9.0 -> 9.10.8-P1, 9.11.0 -> 9.11.5-P1, 9.12.0 -> 9.12.3-P1, and versions 9.9.3-S1 -> 9.11.5-S3 of BIND 9 Supported Preview Edition. Versions 9.13.0 -> 9.13.6 of the 9.13 development branch are also affected. Versions prior to BIND 9.9.0 have not been evaluated for vulnerability to CVE-2018-5745.

CVE-1999-0837 vulnerability affects BIND service, which can be subject to a denial of service (DoS) attack due to improper closing of TCP sessions via so_linger.