BIND – the most used DNS server on the internet

BIND (Berkeley Internet Name Domain) is the most commonly used DNS server on the Internet, especially on Unix systems, where it is a de facto Standard. It is sponsored by the Internet Systems Consortium.

Having said this, we must be careful since being one of the most used DNS servers, it is one of the most attacked and in the crosshairs of hackers and it has presented some vulnerabilities of this, Four of the vulnerabilities are of medium level and the fifth is low level. Four of them, the mid-level ones, can be used in denial of service attacks, so the entity urges all system administrators in which BIND is used to update their installations as soon as possible.

Identified with the codes CVE-2020-8620, CVE-2020-8621, CVE-2020-8622, CVE-2020-8623 and CVE-2020-8624, there is no possibility of resorting to a workaround to solve them. The good news is that there are already versions of BIND where this problem has been fixed, and therefore an update to one of those versions will solve the problem. These vulnerabilities, as mentioned above, can been solved and should be updated as soon as possible to the BIND 9.16.6 and BIND 9.17.4 versions.

In describing one of the vulnerabilities, the ISC states that versions of BIND that use the libuv network manager incorrectly adjust the maximum size of a buffer, which would allow a deliberately constructed payload to exploit this issue to flood the server and cause its drop. Other vulnerabilities that can cause the server to hang are based on incorrect settings and signatures attached to requests for addresses.

To date, no attacks based on these vulnerabilities have been identified, or are any exploits known. However, that does not mean that it could not have occurred on a miniscule scale, that it has not yet been detected. That is why administrators with BIND systems must update these versions to avoid such vulnerabilities.

---