BIND 9 Update Fixes 14 Flaws, Including an Unauthenticated Crash Over DNS-over-HTTPS
-
The Internet Systems Consortium (ISC) has shipped BIND 9.20.29 and 9.21.26, addressing fourteen security flaws disclosed on 16 September in the open-source DNS server software.
The most serious concern for many operators involves any BIND server that answers DNS-over-HTTPS (DoH) queries. An unauthenticated sender can crash the named server process with a single request containing an invalid SIG record. No credentials are required, making this remotely triggerable by anyone who can reach the DoH endpoint.
Affected releases:
- BIND 9.20.29 and 9.21.26 contain the fixes
- Administrators running earlier versions in those branches should upgrade promptly
Given that the DoH crash needs only one malformed request, patching should be treated as high priority, particularly for any deployment exposing DoH to untrusted networks. There is no indication of a workaround in the advisory, so upgrading to the fixed versions is the recommended path.
Source: The Hacker News
Does your organization run BIND with DoH enabled, and are you planning to upgrade to 9.20.29 or 9.21.26 right away?
Hello! It looks like you're interested in this conversation, but you don't have an account yet.
Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.
With your input, this post could be even better 💗
Register Login