ISC fixed high-severity flaws in DNS software suite BIND

Abilene city, Texas, takes systems offline following a cyberattack Bind

The latest BIND updates patch multiple remotely exploitable vulnerabilities that could lead to denial-of-service (DoS).

BIND is a suite of software for interacting with the Domain Name System (DNS) maintained by the Internet Systems Consortium (ISC).

The ISC released security patches to address multiple high-severity denial-of-service DoS vulnerabilities in the DNS software suite.

Threat actors can exploit the issue to remotely cause the BIND daemon named to crash or saturate the available memory.

Below are the descriptions of some vulnerabilities addressed by ISC:

CVE-2022-3094 (CVSS score 7.5): Sending a flood of dynamic DNS updates may cause the ‘named‘ daemon to allocate large amounts of memory. Then ‘named’ may exit due to a lack of free memory.

“Memory is allocated prior to the checking of access permissions (ACLs) and is retained during the processing of a dynamic update from a client whose access credentials are accepted. Memory allocated to clients that are not permitted to send updates is released immediately upon rejection.” reads the advisory published by ISC. “The scope of this vulnerability is limited therefore to trusted clients who are permitted to make dynamic zone changes.”

The issue impacts BIND 9.11 and earlier branches, however, it doesn’t cause the exhaustion of internal resources but only impacts performance.

CVE-2022-3736 (CVSS score 7.5): An attacker can trigger the issue by sending specific queries to the resolver causing the named daemon crash.

“BIND 9 resolver can crash when stale cache and stale answers are enabled, option stale-answer-client-timeout is set to a positive integer, and the resolver receives an RRSIG query. Impact: By sending specific queries to the resolver, an attacker can cause named to crash.” reads the advisory.

“By sending specific queries to the resolver, an attacker can cause named to crash.”

CVE-2022-3924 (CVSS score 7.5): named configured to answer from stale cache may terminate unexpectedly at recursive-clients soft quota

The issue affects the implementation of the stale-answer-client-timeout option, when the resolver receives too many queries that require recursion.

“If the resolver receives many queries that require recursion, there will be a corresponding increase in the number of clients that are waiting for recursion to complete. If there are sufficient clients already waiting when a new client query is received so that it is necessary to SERVFAIL the longest waiting client (see BIND 9 ARM recursive-clients limit and soft quota), then it is possible for a race to occur between providing a stale answer to this older client and sending an early timeout SERVFAIL, which may cause an assertion failure.” reads the advisory. “By sending specific queries to the resolver, an attacker can cause named to crash.”

ISC is not aware of any attacks in the wild exploiting this issue.

ISC addressed the above issues with the release of BIND versions 9.16.37, 9.18.11, and 9.19.9.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

[adrotate banner=”9″]

[adrotate banner=”12″]

Pierluigi Paganini

(SecurityAffairs – hacking, ISC)

[adrotate banner=”5″]

[adrotate banner=”13″]

Pierluigi Paganini

Pierluigi Paganini is member of the ENISA (European Union Agency for Network and Information Security) Threat Landscape Stakeholder Group and Cyber G7 Group, he is also a Security Evangelist, Security Analyst and Freelance Writer. Editor-in-Chief at "Cyber Defense Magazine", Pierluigi is a cyber security expert with over 20 years experience in the field, he is Certified Ethical Hacker at EC Council in London. The passion for writing and a strong belief that security is founded on sharing and awareness led Pierluigi to find the security blog "Security Affairs" recently named a Top National Security Resource for US. Pierluigi is a member of the "The Hacker News" team and he is a writer for some major publications in the field such as Cyber War Zone, ICTTF, Infosec Island, Infosec Institute, The Hacker News Magazine and for many other Security magazines. Author of the Books "The Deep Dark Web" and “Digital Virtual Currency and Bitcoin”.