Internet Systems Consortium has released BIND 9.20.29 with fixes for 14 security vulnerabilities affecting the widely used DNS server software.
BIND is software used by organizations, internet providers and other network operators to run Domain Name System, or DNS, services. DNS is the system that helps turn familiar website addresses such as example.com into the numerical addresses computers use to connect to one another.
The newly fixed vulnerabilities include issues that could cause a DNS server to crash, consume excessive CPU or memory, or incorrectly handle certain security checks.
Several Flaws Could Disrupt DNS Services
A number of the vulnerabilities could be used to interfere with the normal operation of an affected DNS server.
One issue could cause BIND to use excessive CPU while processing specially crafted DNSSEC responses. DNSSEC adds digital signatures to DNS information to help confirm that responses have not been altered.
Another vulnerability could cause a server to consume large amounts of CPU while processing certain HTTPS-related DNS records. Repeated requests could make the server slower or prevent it from responding normally to other users.
Other flaws could cause the BIND named service, the main process responsible for handling DNS requests, to terminate unexpectedly.
One of those issues involved a specially crafted DNS request sent over HTTPS, while another could be triggered by certain TKEY requests when the server used a particular configuration.
The update also fixes a memory-related problem in which certain cached DNS records could remain stored instead of being released, potentially allowing memory use to grow until the server could no longer handle unrelated requests.
Some Vulnerabilities Affected DNS Security Checks
Several of the fixes address the way BIND verifies DNS information.
In one case, a resolver could be tricked into treating a normally protected DNS delegation as unsigned under specific conditions. That could allow forged DNS information to be accepted if an attacker was also able to interfere with the resolver’s network traffic.
Another flaw could allow an incorrect “domain does not exist” response to be accepted as valid in certain DNSSEC situations.
These issues do not mean every BIND server could automatically be redirected to malicious websites. The vulnerabilities depend on specific configurations and attack conditions, but the fixes are important because DNS is responsible for directing users and applications to the correct internet destinations.
BIND 9.20.29 includes fixes for all 14 vulnerabilities disclosed with the release.
The update also contains a number of non-security bug fixes involving DNS configuration, caching, zone transfers and other server functions. Not every vulnerability affects every installation. Some apply only to DNS servers acting as recursive resolvers, while others require specific features or configurations to be enabled.
Administrators running BIND should check the version supplied by their operating system or software provider and install the available security update. For systems using the BIND 9.20 branch directly, version 9.20.29 contains the full set of fixes included in this security release.
Leave a Reply