CVE: CVE-2014-8500 
Document Version:         2.0
Posting date: 08 December 2014
Program Impacted: BIND 9
Versions affected: 9.0.x -> 9.8.x, 9.9.0 -> 9.9.6, 9.10.0 -> 9.10.1
Severity: Critical
Exploitable: Remotely
Description:

By making use of maliciously-constructed zones or a rogue server, an attacker can exploit an oversight in the code BIND 9 uses to follow delegations in the Domain Name Service, causing BIND to issue unlimited queries in an attempt to follow the delegation.  This can lead to resource exhaustion and denial of service (up to and including termination of the named server process.)

Impact:

All recursive resolvers are affected.  Authoritative servers can be affected if an attacker can control a delegation traversed by the authoritative server in servicing the zone.

CVSS Score:  7.8

CVSS Vector:  (AV:N/AC:L/Au:N/C:N/I:N/A:C)

For more information on the Common Vulnerability Scoring System and to obtain your specific environmental score please visit: http://nvd.nist.gov/cvss.cfm?calculator&version=2&vector=(AV:N/AC:L/Au:N/C:N/I:N/A:C)

Workarounds:

No workarounds exist.  Vulnerable versions of BIND 9 should be upgraded.

Active exploits: 

No known active exploits.

Solution:  Upgrade to the patched release most closely related to your current version of BIND.  Patched builds of currently supported branches of BIND (9.9 and 9.10) can be downloaded via http://www.isc.org/downloads

BIND 9 version 9.9.6-P1
BIND 9 version 9.10.1-P1

Regarding older versions:
BIND 9.6-ESV and BIND 9.8 have been officially designated "end of life" (EOL) and no longer receive support.  All organizations running EOL branches should be planning transition to currently supported branches.  However, due to the severity of this particular issue, source code diffs which can be applied to BIND 9.8 and BIND 9.6-ESV will be made available on request to [email protected].

Acknowledgements: 
ISC would like to thank Florian Maury (ANSSI) for discovering and reporting this vulnerability.

Copyright ©2023 Exploitalert.

All trademarks used are properties of their respective owners. By visiting this website you agree to Terms of Use.