Critical Security Flaws in BIND 9.18: Cache Poisoning and Resource Exhaustion Vulnerabilities
Summary
RLSA-2025:21111: Important: bind9.18 security update. Affects bind9.18 versions < 2:9.18.29-5.el9_7.2. Fixed in 2:9.18.29-5.el9_7.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
BIND (Berkeley Internet Name Domain) is a widely used implementation of the DNS (Domain Name System) protocols. It includes a DNS server (named) that resolves host names to IP addresses, a resolver library for application interfacing with DNS, and various tools for DNS server verification. BIND is crucial for the functionality of internet services, making its security paramount.
Vulnerability Detail
The vulnerabilities in BIND 9.18 stem from several critical issues: Cache poisoning attacks can occur due to unsolicited Resource Records (RRs), which can mislead DNS queries. Additionally, weak Pseudo-Random Number Generators (PRNG) can be exploited for cache poisoning, compromising the integrity of DNS responses. Lastly, malformed DNSKEY handling can lead to resource exhaustion, potentially causing denial of service. These vulnerabilities can have severe ramifications, including unauthorized access to sensitive data and disruption of services.
How To Fix
Minimum fixed version
2:9.18.29-5.el9_7.2
This is the first release that contains the fix.
sudo dnf update bind9.18Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
While waiting for the patch, consider implementing network-level protections such as firewalls to restrict access to the DNS server and monitoring DNS traffic for unusual patterns. Additionally, configuring DNSSEC can help mitigate some risks associated with cache poisoning.
Conclusion
The vulnerabilities in BIND 9.18 pose significant risks to DNS integrity and service availability. It is crucial for users to update to the patched version to mitigate these risks. Implementing additional security measures can further protect against potential exploits.
See every vulnerability recorded for bind9.18 →
FAQ
BIND is an implementation of the DNS protocols, providing a DNS server and resolver library for applications.
The main vulnerabilities include cache poisoning attacks, weak PRNG leading to cache poisoning, and resource exhaustion via malformed DNSKEY handling.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check your application without needing to sign up.
The CVSS score for this vulnerability is 8.6, indicating a high level of severity.
You can update BIND by running 'sudo dnf update bind9.18' in your terminal to install the latest patched version.
References
Related vulnerabilities
Recent vulnerabilities recorded for bind9.18.
