Amplification vulnerabilities via self-pointed glue records
BIND resolvers are vulnerable to an amplified resource consumption/exhaustion attack. If a victim resolver makes a query to a specially crafted zone, the resolver will consume disproportionate resources.
This issue affects BIND 9 versions 9.11.0 through 9.16.50, 9.18.0 through 9.18.48, 9.20.0 through 9.20.22, 9.21.0 through 9.21.21, 9.11.3-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.48-S1, and 9.20.9-S1 through 9.20.22-S1.
Problem Types
| Type | CWE ID | Description |
|---|
| CWE | CWE-408 | CWE-408 Incorrect Behavior Order - Early Amplification |
Type: CWE
Description: CWE-408 Incorrect Behavior Order - Early Amplification
Metrics
| Version | Base score | Base severity | Vector |
|---|
| 3.1 | 5.3 | MEDIUM | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L |
Version: 3.1
Base score: 5.3
Base severity: MEDIUM
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Impacts
| CAPEC ID | Description |
|---|
| N/A | An attacker may be able to cause the resolver to consume disproportionate amounts of bandwidth in the attempt to resolve the name. Impairment of TCP may also be seen.
The issue predominately affects recursive resolvers. Authoritative-only servers containing only trustworthy zones and names should be unaffected. If an authoritative server can be induced to look up an attack domain (e.g., if loading a zone from an untrusted source), it may be possible to trigger the issue. |
CAPEC ID: N/A
Description: An attacker may be able to cause the resolver to consume disproportionate amounts of bandwidth in the attempt to resolve the name. Impairment of TCP may also be seen.
The issue predominately affects recursive resolvers. Authoritative-only servers containing only trustworthy zones and names should be unaffected. If an authoritative server can be induced to look up an attack domain (e.g., if loading a zone from an untrusted source), it may be possible to trigger the issue.