DNS Server Vulnerability Could Enable Massive DDoS Attacks

Summary

A new domain name system (DNS) server vulnerability, dubbed NXNSAttack, has been discovered that can be exploited to enable damaging distributed denial-of-service (DDoS ) amplification attacks. The flaw resides in the DNS delegation process in which recursive queries are managed. A threat actor may exploit the flaw by transmitting DNS queries to recursive servers using an authoritative DNS server and an attacker-controlled domain. The NXNSAttack packet amplification factor (PAF) is capable of launching massive attacks using few devices and automated DNS queries causing wide-spread disruption, making this one of the most dangerous DDoS attack vectors to date. Several DNS providers and DNS recursive resolvers – including BIND, NLnet Labs Unbound, PowerDNS, and Knot – are impacted by this vulnerability.

Recommendations

The NJCCIC urges server administrators to apply patches immediately as they become available. Further information can be found in the Hack Reports article, and technical details can be found in the research team’s academic paper.