7 results · Clear filters · Feed
-
Medium 5.3
Message parser retains every identical singleton RDATA, enabling wire-to-work amplification
In a query response, an attacker may send `named` multiple copies of a record that should only exist once (such as an SOA record). If the RDATA is the same on all the copies, the record is appended to the in-memory RDATA set, which can cause increased memory …
-
Medium 5.3
Resource Exhaustion via Excessive DNSSEC Cryptographic Material Matching
A BIND recursive resolver may experience excessive resource consumption if it encounters large numbers of a particular kind of invalid DNSSEC record. Default limits on "max-records-per-type" and "max-types-per-name" help mitigate the exposure. This issue affe…
-
Medium 6.5
Unauthenticated IXFR deltas are applied to the live zone before TSIG verification
For a secondary zone with transfers restricted by TSIG, `named` may start to serve the data provided in a zone transfer before the final message with the TSIG signature arrives. This could allow an attacker that does not actually possess a valid TSIG signatur…
-
Medium 5.8
Out-of-zone database nodes can become authoritative zone cuts
A malformed zone may contain an NS or DNAME node above its origin, which `named` treats as a zone cut. If an attacker inserts a malformed zone into a BIND authoritative server (e.g., via zone transfer), queries for names inside the configured zone then lose a…
-
Medium 5.9
checkwildcard() accepts an out-of-zone NSEC as a wildcard-nonexistence proof
An inapplicable NSEC record may be accepted by a `named` resolver as proof that no wildcard exists, which could allow an attacker at the same or an upstream level of the zone name to mask the existence of a victim's wildcard record. This issue affects BIND 9 …
-
Medium 5.9
qpcache NOQNAME proof use-after-free crashes recursive resolver
An attacker may be able to cause a `named` resolver to abort. The attack requires inducing the victim resolver to send multiple queries for a DNSSEC-signed zone hosted by an authoritative server under the control of the attacker. If the auth responds with a p…
-
Medium 5.3
Cleaning an ECS-enabled cache may cause excessive CPU load
If a resolver cache has a very large number of ECS records stored for the same name, the process of cleaning the cache database node for this name can significantly impair query performance. This issue affects BIND 9 versions 9.11.3-S1 through 9.11.37-S1, 9.1…