Industry News

BIND Flaw Exposes DNS Servers to Denial-of-Service Attacks

A recent flaw in the BIND open-source software used for DNS servers allows denial-of-service attacks on both authoritative and recursive DNS servers, by constructing a flawed UDP packet that exploits an error in the handling of queries for TKEY records.

Dubbed as critical by the CVE-2015-5477 advisory, affected BIND servers include versions 9.1.0 up to 9.8.x, 9.9.0 up to 9.9.7-P1, and 9.10.0 up to 9.10.2-P2.

“An error in the handling of TKEY queries can be exploited by an attacker for use as a denial-of-service vector, as a constructed packet can use the defect to trigger a REQUIRE assertion failure, causing BIND to exit,” reads the advisory. “Both recursive and authoritative servers are vulnerable to this defect.  Additionally, exposure is not prevented by either ACLs or configuration options limiting or denying service because the exploitable code occurs early in the packet handling, before checks enforcing those boundaries.”

Because DNS servers are a fundamental part of the internet infrastructure – converting domain names into numeric IP addresses – system administrators should plug the vulnerability by installing the latest BIND patch released by ISC.

“Almost all unpatched BIND servers are potentially vulnerable. We know of no configuration workarounds,” said ISC engineer Michael McNally. “Screening the offending packets with firewalls is likely to be difficult or impossible unless those devices understand DNS at a protocol level and may be problematic even then.”

The vulnerability hasreportedly been weaponized as part of a proof-of-concept, although no in-the-wild reports have been confirmed. Because patching is said to completely protect against the vulnerability, McNally believes it’s only a matter of time before real-world attacks occur.

“The practical effect of this is that this bug is difficult to defend against (except by patching, which is completely effective) and will not be particularly difficult to reverse-engineer,”wrote McNally. “I have already been told by one expert that they have successfully reverse-engineered an attack kit from what has been divulged and from analyzing the code changes, and while I have complete confidence that the individual who told me this is not intending to use his kit in a malicious manner, there are others who will do so who may not be far behind.”

About the author

Liviu ARSENE

Liviu Arsene is the proud owner of the secret to the fountain of never-ending energy. That's what's been helping him work his everything off as a passionate tech news editor for the past couple of years. He is the youngest and most restless member of the Bitdefender writer team and he covers mobile malware and security topics with fervor and a twist. His passions revolve around gadgets and technology, and he's always ready to write about what's hot and trendy out there in geek universe.