CERT/CC Vulnerability Note VU#264212

Overview

Recursive DNS resolvers may become stuck following an infinite chain of referrals due to a malicious authoritative server.

Description

RFC 1034 describes the standard technical issues of enabling domain delegations in DNS, but does not provide a specific implementation, leaving DNS servers to provide their own methods to implement RFC 1034. In some implementations of recursive resolvers, a query to a malicious authoritative server may cause the resolver to follow an infinite chain of referrals. Attempting to follow the infinite chain can cause a denial-of-service (DoS) situation on the DNS resolver due to resource exhaustion.

This issue primarily affects recursive resolvers. Additionally, as noted in ISC Security Advisory AA-01216: "Authoritative servers can be affected if an attacker can control a delegation traversed by the authoritative server in servicing the zone."

Depending on how the resolver handles out-of-bailiwick glue records and performs simultaneous queries, it may also be possible to cause the resolver to perform a DoS attack on a target using DNS traffic.

Impact

A recursive DNS resolver following an infinite chain of referrals can result in high process memory and CPU usage and eventually process termination. The effect can range from increased server response time to clients to complete interruption of the service.

Resolvers that follow multiple referrals at once can cause large bursts of network traffic.

Solution

Apply an update

These issues are addressed by limiting the maximum number of referrals followed and the number of simultaneous queries. See the Vendor Information section below for information about specific vendors.

Vendor Information

264212

Filter by status:

Filter by content: Additional information available

Sort by:

Expand all

EfficientIP Affected

Infoblox Affected

Internet Systems Consortium Affected

MaraDNS Affected

NEC Corporation Affected

NLnet Labs Affected

PowerDNS Affected

CZ NIC Not Affected

European Registry for Internet Domains Not Affected

GNU adns Not Affected

GNU glibc Not Affected

Microsoft Corporation Not Affected

Nominum Not Affected

OpenDNS Not Affected

Secure64 Software Corporation Not Affected

djbdns Not Affected

dnsmasq Not Affected

gdnsd Not Affected

Apple Unknown

Cisco Systems, Inc. Unknown

F5 Networks, Inc. Unknown

JH Software Unknown

View all 22 vendors View less vendors

CVSS Metrics

Group	Score	Vector
Base	4.3	AV:N/AC:M/Au:N/C:N/I:N/A:P
Temporal	3.4	E:POC/RL:OF/RC:C
Environmental	3.4	CDP:ND/TD:H/CR:ND/IR:ND/AR:ND

References

Acknowledgements

ISC would like to thank Florian Maury (ANSSI) for discovering and reporting this vulnerability.

This document was written by Garret Wassermann.

Other Information

CVE IDs:	CVE-2014-8601, CVE-2014-8500, CVE-2014-8602
Date Public:	2014-12-08
Date First Published:	2014-12-09
Date Last Updated:	2015-10-27 02:27 UTC
Document Revision:	58

Software Engineering Institute

CERT Coordination Center

Recursive DNS resolver implementations may follow referrals infinitely

Vulnerability Note VU#264212