Critical Cache Poisoning Vulnerability in BIND Package
Summary
ALPINE-CVE-2021-25220: BIND 9.11.0 -> 9.11.36 9.12.0 -> 9.16.26 9.17.0 -> 9.18.0 BIND Supported Preview Editions: 9.11.4-S1 -> 9.11.36-S1 9.16.8-S1 -> 9.16.26-S1 Versions of BIND 9 earlier than those shown - back to 9.1.0, including Supported... Affects bind versions < 9.16.27-r0. Fixed in 9.16.27-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
BIND (Berkeley Internet Name Domain) is a widely used DNS server software that provides name resolution services for various applications and systems. It is known for its robustness and flexibility, supporting a range of DNS features. However, certain versions of BIND are vulnerable to cache poisoning attacks, where incorrect DNS records can be stored in the cache, leading to potential misdirection of queries and compromised data integrity.
Vulnerability Detail
The vulnerability identified as CVE-2021-25220 affects multiple versions of the BIND package, specifically versions prior to 9.16.27-r0. The flaw allows an attacker to poison the DNS cache with incorrect records, which can result in queries being directed to malicious servers. This could lead to clients receiving false information, potentially compromising sensitive data and disrupting services. The vulnerability is particularly concerning as it affects a wide range of BIND versions, including those that are no longer supported.
How To Fix
Minimum fixed version
9.16.27-r0
This is the first release that contains the fix.
sudo apk add --upgrade bindTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate updating is not feasible, consider implementing DNS security measures such as DNSSEC (Domain Name System Security Extensions) to help protect against cache poisoning attacks. Additionally, monitoring DNS queries for unusual patterns can help identify potential exploitation attempts.
Conclusion
The CVE-2021-25220 vulnerability in the BIND package poses significant risks due to its potential for cache poisoning attacks. Updating to the patched version 9.16.27-r0 is crucial for maintaining the integrity and security of DNS services. Users are encouraged to take immediate action to protect their systems.
See every vulnerability recorded for bind →
FAQ
CVE-2021-25220 is a critical vulnerability in the BIND DNS server software that allows for cache poisoning, potentially redirecting queries to malicious servers.
All versions of BIND prior to 9.16.27-r0 are affected by this vulnerability, including earlier versions back to 9.1.0.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without needing to sign up.
Exploitation of this vulnerability can lead to clients receiving false DNS information, potentially resulting in data breaches, service disruptions, and compromised security.
Implementing DNSSEC and monitoring DNS queries for anomalies can help mitigate the risks associated with this vulnerability until an update can be applied.
References
Related vulnerabilities
Recent vulnerabilities recorded for bind.
