CERT-In Advisory
CIAD-2024-0012
Denial of Service Vulnerability in DNS servers (KeyTrap+ NSEC3)
Original Issue Date: February 26, 2024
Severity Rating: High
Overview
Two vulnerabilities have been reported in DNS protocol which could allow a remote attacker to cause Denial of Service (DoS) condition on the target DNS server.
Description
Domain Name System (DNS) is a protocol that allows us to use human readable names to communicate over networks, rather than having to manage and memorize IP addresses.
The Domain Name System Security Extensions (DNSSEC) is a feature of the Domain Name System (DNS) that authenticates responses to domain name lookups.
These vulnerabilities exist due to improper input validation while processing DNSSEC related records. A remote attacker could exploit these vulnerabilities to cause denial of service (through CPU consumptions) via DNSSEC responses due to NSEC3 issue or Key Trap issue.
Successful exploitation of these vulnerabilities could allow a remote attacker to perform Denial of Service (DoS) condition on the targeted DNS server.
Solution
Apply appropriate security updates to the latest product versions immediately or once they are released by the respective vendors and other mitigation techniques as applicable.
Vendor Information
PowerDNS
https://doc.powerdns.com/recursor/security-advisories/powerdns-advisory-2024-01.html
NLnet Labs
https://nlnetlabs.nl/projects/unbound/security-advisories/
Microsoft
https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2023-50387
Red Hat
https://access.redhat.com/security/cve/CVE-2023-50387
https://access.redhat.com/security/cve/CVE-2023-50868
ISC BIND
https://kb.isc.org/v1/docs/cve-2023-50387
https://kb.isc.org/v1/docs/cve-2023-50868
https://www.isc.org/blogs/2024-bind-security-release/
OpenWall
https://www.openwall.com/lists/oss-security/2024/02/16/2
https://www.openwall.com/lists/oss-security/2024/02/16/3
References
https://doc.powerdns.com/recursor/security-advisories/powerdns-advisory-2024-01.html
https://nlnetlabs.nl/projects/unbound/security-advisories/
https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2023-50387
https://access.redhat.com/security/cve/CVE-2023-50387
https://access.redhat.com/security/cve/CVE-2023-50868
https://www.isc.org/blogs/2024-bind-security-release/
https://www.openwall.com/lists/oss-security/2024/02/16/2
https://www.openwall.com/lists/oss-security/2024/02/16/3
https://www.bleepingcomputer.com/news/security/keytrap-attack-internet-access-disrupted-with-one-dns-packet/
https://www.akamai.com/blog/security/dns-exploit-keytrap-posed-major-internet-threat
CVE Name
CVE-2023-50387
CVE-2023-50868
Disclaimer
The information provided herein is on "as is" basis, without warranty of any kind.
Contact Information
Email: info@cert-in.org.in Phone: +91-11-22902657
Postal address
Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India
|