CVE-2024-1737 details an issue with the performance of resolver caches and authoritative zone databases in BIND (Berkeley Internet Name Domain). This issue can lead to significant degradation of performance when adding or updating large numbers of Resource Records (RRs) for the same hostname. The problem also affects how client queries are handled for the affected names. In this long-read post, we will discuss the affected versions, a code snippet demonstrating the issue, links to original references, and details on the exploit.
Code Snippet
Consider a BIND configuration with a large number of Resource Records (RRs) for the same hostname. When a client queries the BIND server for this hostname, the server takes a considerable amount of time to process the request, demonstrating the degraded performance issue outlined in CVE-2024-1737.
...
example.com. 86400 IN A 192..2.1
example.com. 86400 IN A 192..2.2
example.com. 86400 IN A 192..2.3
...
(example.com with thousands or millions of RRs)
...
Original References
1. BIND 9 Security Vulnerability Matrix
2. CVE-2024-1737 - ISC BIND 9 Resolver Cache and Authoritative Zone Database Degradation
3. Upgrading BIND
Exploit Details
An attacker can exploit the vulnerability by creating a BIND server with a large number of RRs for a single hostname. This creates an enormous burden on the server and increases the time taken to process clients' queries. The increased response time can lead to poor performance for legitimate users and create a denial-of-service (DoS) situation.
Recommended Solutions
In order for BIND server administrators to mitigate the performance degradation issue in resolver caches and authoritative zone databases, it is advised to upgrade the affected BIND versions to the latest stable release. The latest stable release can be found on the official BIND website here.
Moreover, administrators can limit the number of RRs for a single hostname by implementing access controls or rate limits on updates and queries. This will minimize the performance degradation and stop an attacker from creating a large number of RRs for a single hostname.
Conclusion
CVE-2024-1737 sheds light on the performance degradation issue experienced in BIND resolver caches and authoritative zone databases. The vulnerability affects a wide range of BIND 9 versions and needs to be addressed by server administrators to alleviate the negative impact on performance. By understanding the affected versions, reviewing the code snippet, and identifying the exploit details, administrators can take the necessary steps to address this vulnerability and secure their BIND configurations.
Timeline
Published on: 07/23/2024 15:15:03 UTC
Last modified on: 08/01/2024 13:46:11 UTC