Some vulnerabilities have been reported in ISC BIND, which can be exploited by malicious people to poison the DNS cache.

1) A vulnerability is caused due to BIND caching CNAME or DNAME records of a response without proper DNSSEC verification when processing recursive client requests with checking disabled (CD) or internally triggered queries for missing records for recursive name resolution.

Successful exploitation requires that recursive queries are enabled and that the nameserver performs DNSSEC validation for its clients. Authoritative-only nameservers are not affected.

This is related to:
SA37426

2) An error within the DNSSEC NSEC/NSEC3 validation mechanism could lead to bogus NXDOMAIN responses being cached as correctly validated, resulting in later queries to the resolver returning the bogus NXDOMAIN with the AD flag set.

Note: Successful exploitation requires that attackers are able to bypass traditional protection mechanisms like source port randomization and transaction IDs.

The vulnerabilities are reported in versions prior to 9.4.3-P5, 9.5.2-P2, and 9.6.1-P3.

Note: This also fixes a regression introduced by the fix for CVE-2009-4022.

Solution
Update to 9.4.3-P5, 9.5.2-P2, or 9.6.1-P3.
Further details available in Customer Area

Provided and/or discovered by
1) The vendor credits Alexander Gall
2) Reported by the vendor.

Changelog
Further details available in Customer Area

Original Advisory
1) https://www.isc.org/advisories/CVE-2009-4022v6
2) https://www.isc.org/advisories/CVE2010-0097

BIND 9.4-ESV:
ftp://ftp.isc.org/isc/bind9/9.4-ESV/9.4-ESV

Other references
Further details available in Customer Area

Deep Links
Links available in Customer Area