BIND Vulnerability: Performance Degradation Due to Flawed Response Processing
Summary
ALPINE-CVE-2021-25219: In BIND 9.3.0 -> 9.11.35, 9.12.0 -> 9.16.21, and versions 9.9.3-S1 -> 9.11.35-S1 and 9.16.8-S1 -> 9.16.21-S1 of BIND Supported Preview Edition, as well as release versions 9.17.0 -> 9.17.18 of the BIND 9.17 development b... Affects bind versions < 9.16.27-r0. Fixed in 9.16.27-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
BIND (Berkeley Internet Name Domain) is a widely used DNS server software that provides a range of functionalities including DNS resolution and authoritative DNS services. It is known for its robustness and flexibility, making it a popular choice for both small and large organizations. However, certain versions of BIND are vulnerable to a flaw in response processing, which can lead to performance degradation in DNS resolution, impacting the overall efficiency of network operations.
Vulnerability Detail
The vulnerability, identified as CVE-2021-25219, affects BIND versions 9.3.0 to 9.11.35, 9.12.0 to 9.16.21, and specific versions of the BIND Supported Preview Edition and the BIND 9.17 development branch. The flaw lies in the way the lame cache is designed, allowing its internal data structures to grow almost infinitely. This can result in significant delays in client query processing, ultimately degrading the performance of BIND resolvers. Exploitation of this vulnerability can lead to a denial of service, affecting the availability of DNS services.
How To Fix
Minimum fixed version
9.16.27-r0
This is the first release that contains the fix.
sudo apk add --upgrade bindTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate patching is not feasible, consider implementing rate limiting on DNS queries to mitigate the impact of the vulnerability. This can help control the load on the DNS server and prevent performance degradation.
Conclusion
The vulnerability CVE-2021-25219 in BIND poses a risk of performance degradation in DNS resolution due to flawed response processing. It is crucial to update to the patched versions to mitigate this risk and ensure the reliability of DNS services.
See every vulnerability recorded for bind →
FAQ
CVE-2021-25219 is a vulnerability in BIND that can cause performance degradation in DNS resolution due to flawed response processing.
Affected versions include BIND 9.3.0 to 9.11.35, 9.12.0 to 9.16.21, and specific versions of BIND Supported Preview Edition and BIND 9.17 development branch.
Exploitation of this vulnerability can lead to significant delays in client query processing, resulting in degraded DNS resolver performance and potential denial of service.
You can use Vulert, which monitors open-source vulnerabilities in your software using a manifest file like package-lock.json. Visit Vulert Scanner to check without signup.
The CVSS score for this vulnerability is 5.3, indicating a moderate level of severity.
References
Related vulnerabilities
Recent vulnerabilities recorded for bind.
