Cert-In - Home Page

CERT-In Advisory CIAD-2020-0032

DNS Protocol Vulnerability(NXNSAttack)

Original Issue Date: May 21, 2020

Severity Rating: High

Software Affected

BIND 9.16.x versions from 9.16.0 to 9.16.2
BIND 9.14.x versions from 9.14.0 to 9.14.11
BIND 9.11.x versions from 9.11.0 to 9.11.18
BIND Supported Preview Edition from 9.9.3-S1 to 9.11.18-S1
BIND 9 versions prior to 9.10.x, 9.12.x, 9.13.x and 9.15.x (non-supported), and development branch versions 9.17.x
NLnet Labs Unbound up to 1.10.0
NIC.CZ Knot Resolver before 5.1.1
PowerDNSRecursor from 4.1.0 through 4.3.0

Other products implementing the vulnerable DNS protocol may also be affected.

Overview

A vulnerability has been reported in the DNS protocol, which could be exploited by a remote attacker to amplify network traffic (1620x) by sending DNS queries to a vulnerable resolver, which queries an authoritative server controller by the attacker (NXNSAttack).

Description

This vulnerability abuses DNS delegation mechanism to force DNS resolvers to generate more DNS queries to authoritative servers controlled by attacker. This attack, known as NoneXistentNameServers Attack (NXNSAttack), can result in an amplification factor of over 1620. The attack also saturates the �NS� resolver caches.

The attacker sends such a request multiple times over a long period of time, which generates huge quantity of requests between the DNS servers, which are subsequently overwhelmed and unable to respond to the legitimate requests of actual legitimate users.

Solution

Apply appropriate patches/updates as recommended by respective vendors.

Vendor Information

PowerDNS
https://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-2020-01.html
ISC BIND
https://kb.isc.org/docs/cve-2020-8616
NLnet Labs
https://nlnetlabs.nl/downloads/unbound/CVE-2020-12662_2020-12663.txt
Knot Resolver
https://www.knot-resolver.cz/2020-05-19-knot-resolver-5.1.1.html
Microsoft
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/ADV200009

References

https://en.blog.nic.cz/2020/05/19/nxnsattack-upgrade-resolvers-to-stop-new-kind-of-random-subdomain-attack/
https://www.knot-resolver.cz/2020-05-19-knot-resolver-5.1.1.html
https://kb.isc.org/docs/cve-2020-8616
http://www.nxnsattack.com/
https://nlnetlabs.nl/downloads/unbound/CVE-2020-12662_2020-12663.txt
https://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-2020-01.html

CVE Name
CVE-2020-8616
CVE-2020-10995
CVE-2020-12662
CVE-2020-12663
CVE-2020-12667

Disclaimer

The information provided herein is on "as is" basis, without warranty of any kind.

Contact Information

Email: info@cert-in.org.in
Phone: +91-11-24368572

Postal address

Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India