Critical Vulnerability in BIND: Cache Poisoning and Resource Exhaustion Risks
Summary
RLSA-2025:21034: Important: bind security update. Affects bind versions < 2:9.18.33-10.el10_1.2. Fixed in 2:9.18.33-10.el10_1.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Berkeley Internet Name Domain (BIND) is a widely used implementation of the Domain Name System (DNS) protocols, providing essential services such as DNS server functionality and resolver libraries for applications. BIND is critical for the operation of the internet, enabling domain name resolution and ensuring that users can access websites using human-readable addresses. However, recent vulnerabilities have been identified that could compromise the integrity and availability of DNS services.
Vulnerability Detail
This vulnerability arises from multiple issues within BIND, including cache poisoning attacks facilitated by unsolicited resource records (RRs) and weaknesses in the pseudo-random number generator (PRNG). Additionally, malformed DNSKEY handling can lead to resource exhaustion, potentially causing denial of service. The ramifications of these vulnerabilities are severe, as they can allow attackers to manipulate DNS responses, leading to redirection of users to malicious sites or complete service outages.
How To Fix
Minimum fixed version
2:9.18.33-10.el10_1.2
This is the first release that contains the fix.
sudo dnf update bindTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can restrict access to the DNS server and implement rate limiting on incoming requests to mitigate the risk of resource exhaustion. Additionally, disabling the use of unsolicited RRs can help prevent cache poisoning attacks.
Conclusion
The identified vulnerabilities in BIND pose significant risks to DNS integrity and availability. It is crucial for users to update to the latest patched version to mitigate these risks effectively. Implementing workarounds can provide temporary relief, but regular updates remain the best defense against potential exploits.
See every vulnerability recorded for bind →
FAQ
BIND is an implementation of the DNS protocols, providing DNS server and resolver library functionalities.
Cache poisoning attacks involve injecting false DNS records into a cache, leading to incorrect domain resolution.
You can use Vulert's playground at Vulert Scanner to check for vulnerabilities in your application without needing to sign up.
The CVSS score for this vulnerability is 8.6, indicating a high severity level.
It is recommended to regularly check for updates and apply them promptly to ensure security against vulnerabilities.
References
Related vulnerabilities
Recent vulnerabilities recorded for bind.
