BIND DNS Software High-Severity Flaws Let Hackers Remotely Trigger the Attack

The ISC (Internet Systems Consortium) released a security patch this week in an attempt to address six vulnerabilities that could allow remote attackers to take control of BIND DNS servers.

In total, four of the six vulnerabilities were rated as ‘high severity’ due to their denial of service (DoS) nature.

Vulnerabilities

Here below we have mentioned all the high severity vulnerabilities:-

CVE-2022-2906, the first of these, is a memory leak vulnerability, which has been reported in multiple places. With OpenSSL 3.0.0 and later versions, this vulnerability using TKEY records primarily affects the key processing in Diffie-Hellman mode.

There was also a memory leak in the code for DNSSEC verification in the ECDSA DNSSEC authentication system, which was tracked as CVE-2022-38177. By mismatching a signature length, an attacker may be able to exploit the vulnerability.

An attacker can trigger a small memory leak by spoofing the target resolver to cause responses to be returned with an ECDSA signature that has been tampered with. If you gradually erode the amount of memory available to a named until a point when there is not enough memory there is a chance of named crashing.

Under particular conditions, when specially crafted queries are sent to the BIND 9 resolver, a third issue tracked as CVE-2022-3080 may lead to the resolver crashing as it is unable to resolve the query.

It has been identified that the ECDSA DNSSEC verification code contains a memory leak, which is tracked as CVE-2022-38178, and it’s the fourth high severity vulnerability.

Updates

It has been announced that updates have been released for the following:-

  • BIND 9.18 (stable branch)
  • BIND 9.19 (development version)
  • BIND 9.16 (Extended Support Version)

Moreover, all these vulnerabilities were not exploited in the wild nor any exploits are available publicly.

ISC has recently issued an advisory on these four security vulnerabilities. CISA has also called on users and administrators to review the advisory as soon as possible in order to fix these holes.

Download Free SWG – Secure Web Filtering – E-book

Gurubaran

Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Recent Posts

Threat Actors Leverage Email Bombing to Evade Security Tools and Conceal Malicious Activity

Threat actors are increasingly using email bombing to bypass security protocols and facilitate further malicious…

5 hours ago

Threat Actors Launch Active Attacks on Semiconductor Firms Using Zero-Day Exploits

Semiconductor companies, pivotal in the tech industry for their role in producing components integral to…

5 hours ago

Hackers Exploit Router Flaws in Ongoing Attacks on Enterprise Networks

Enterprises are facing heightened cyber threats as attackers increasingly target network infrastructure, particularly routers, following…

5 hours ago

Threat Actors Exploit Legitimate Crypto Packages to Deliver Malicious Code

Threat actors are using open-source software (OSS) repositories to install malicious code into trusted applications,…

5 hours ago

Tycoon 2FA Phishing Kit Uses Advanced Evasion Techniques to Bypass Endpoint Detection Systems

The notorious Tycoon 2FA phishing kit continues its evolution with new strategies designed to slip…

5 hours ago

Hands-On Labs: The Key to Accelerating CMMC 2.0 Compliance

INE Security Highlights How Practical, immersive training environments help defense contractors meet DoD cybersecurity requirements…

9 hours ago