A hole in the internet's address book

BIND, the software that answers DNS lookups for much of the internet, has a memory flaw that could let an attacker take over the server. There's a fix, and no workaround.

HARD JournalPrivate cybersecurity · 3 min read

Every time you open a website or send an email, your device first asks a DNS server where to go. Much of the internet's DNS is answered by one program, BIND, maintained by the nonprofit Internet Systems Consortium. On Wednesday, ISC disclosed a flaw in it that could let an attacker corrupt the server's memory and, potentially, run their own code on it.

ISC rates it high, 8.1 out of 10. It can be triggered over the network, by someone with no account on the server. There is no workaround, only the update.

What's wrong

The flaw is in how BIND handles messages signed with GSS-TSIG, a way for a DNS server to check that an update really came from a trusted machine. Organisations mostly use it to let computers in a Microsoft Active Directory network update their own DNS records. According to ISC, an attacker who captures one of these signed messages can replay it while its key is still valid and corrupt the server's memory. By sending crafted queries for a zone they control, they may be able to go further and run code on the server.

Affected: BIND 9.11.0 through 9.18.50, 9.20.0 through 9.20.29, and 9.21.0 through 9.21.26, plus the matching Supported Preview Edition releases. ISC's advisory doesn't say whether servers without GSS-TSIG set up are safe, so treat any server in those ranges as needing the update. It also lists no fix for the 9.18 line: if you're on 9.18 or older, the way out is 9.20.30.

Whoever runs your DNS decides where every one of your clicks really goes.

Why it matters to you

You almost certainly don't run BIND yourself. But your company might, and so might the family office, the school, the building's IT contractor, or the hosting company behind your website. A DNS server that's been taken over can quietly send people to the wrong place: a copy of the bank, a fake sign-in page, a mail server that isn't yours. The people affected never see a warning, because the address they typed was right.

ISC found the flaw in its own testing, and Dave Aitel of OpenAI found and reported it independently. Two separate teams arriving at the same bug is a reminder of how quickly these flaws are now being found, by defenders and attackers alike.

What to do

1. Ask whoever runs IT for you one question. Your company, the family office, your IT contractor: do any of our servers run BIND, and which version? If it's in the affected ranges, it should be on 9.20.30 or 9.21.27 now.
2. If you're on 9.18 or older, plan the move. ISC hasn't listed a fixed 9.18 release. Upgrading to 9.20.30 is the fix.
3. Ask your web host and email provider. If they run their own DNS on BIND, a short confirmation that they've updated is a reasonable thing to expect.
4. Keep your own devices on safe DNS. HARD's Secure DNS sends your lookups to Cloudflare, encrypted, rather than to whatever server the network you're on happens to use.

Or have someone check for you. Knowing which servers your family's email, websites and home network depend on, and making sure they're patched the week a flaw like this lands, is what private cybersecurity is for.

Sources