Nameserver Traffic Amplification and NS Route Discovery Vulnerability
BID:983
Info
Nameserver Traffic Amplification and NS Route Discovery Vulnerability
| Bugtraq ID: | 983 |
| Class: | Configuration Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Feb 14 2000 12:00AM |
| Updated: | Feb 14 2000 12:00AM |
| Credit: | This vulnerability was posted to the Bugtraq mailing list on February 14, 2000. It was posted by Sebastian <[email protected]>, for a group calling themselves TESO. |
| Vulnerable: |
ISC BIND 8.2.2 ISC BIND 8.2.1 ISC BIND 8.2 ISC BIND 8.1.2 ISC BIND 8.1.1 ISC BIND 8.1 ISC BIND 4.9.7 -T1B ISC BIND 4.9.7 |
| Not Vulnerable: | |
Discussion
Nameserver Traffic Amplification and NS Route Discovery Vulnerability
A potential denial of service (hence forth referred to as DoS) attack exists in the default configuration of many popular DNS servers. If a server allows for remote hosts to query it for hosts other than those it serves, causing recursion, it may be possible to cause traffic amplification. While the numbers of packets amplified by a single server will not be likely to cause a denial of service, by exploiting the hierarchical nature of DNS, it becomes possible to cause large amounts of traffic to be directed to a single site.
The vulnerability exists in the way name servers will behave in the event that they are unable to receive replies for a domain from a nameserver they consider authoritative. When a nameserver receives a query, it is typically forwarded up a chain of DNS server. If the query cannot be resolved because there is no nameserver listening on the remote host, every forwarding nameserver will attempt to resolve the nameserver themselves. These are typically retried three times, at 0, 12 and 24 seconds. In this case, the traffic is significantly multiplied. By abusing multiple nameservers, it becomes possible to send a large quantity of data to a given network, with packet sizes as large as 500 bytes.
A potential denial of service (hence forth referred to as DoS) attack exists in the default configuration of many popular DNS servers. If a server allows for remote hosts to query it for hosts other than those it serves, causing recursion, it may be possible to cause traffic amplification. While the numbers of packets amplified by a single server will not be likely to cause a denial of service, by exploiting the hierarchical nature of DNS, it becomes possible to cause large amounts of traffic to be directed to a single site.
The vulnerability exists in the way name servers will behave in the event that they are unable to receive replies for a domain from a nameserver they consider authoritative. When a nameserver receives a query, it is typically forwarded up a chain of DNS server. If the query cannot be resolved because there is no nameserver listening on the remote host, every forwarding nameserver will attempt to resolve the nameserver themselves. These are typically retried three times, at 0, 12 and 24 seconds. In this case, the traffic is significantly multiplied. By abusing multiple nameservers, it becomes possible to send a large quantity of data to a given network, with packet sizes as large as 500 bytes.
Exploit / POC
Nameserver Traffic Amplification and NS Route Discovery Vulnerability
An exploit has been made available.
An exploit has been made available.
Solution / Fix
Nameserver Traffic Amplification and NS Route Discovery Vulnerability
Solution:
This vulnerability is, in essence, a failing in the default configuration of popular name servers. As is the case with most other amplification problems, if configured properly, a name server cannot be used to conduct this attack. Administrators should take care to not allow recursive queries from their nameservers, except from trusted hosts or networks. For bind, the option to set is the "allow-query" option. By setting this to a list of hosts or networks allowed to query recursively, one can prevent their servers from being used as an amplification site.
There is no easy way to prevent your network from being targeted in this manner. Filtering packets destined for port 53 on hosts which do not run a name server will only prevent traffic of this type from getting behind your firewall or router; it can still potentially affect your bandwidth. A possible method to combat in progress attacks would be to set up a dummy nameserver on the host being targeted, which will respond to all queries with bogus information. This will prevent some of the bandwidth amplification from being effective.
The post detailing this vulnerability makes special note that having even one nameserver capable of being used to conduct this attack can still allow an attacker to utilize your other nameservers, assuming the vulnerable nameserver can query the other nameservers.
Solution:
This vulnerability is, in essence, a failing in the default configuration of popular name servers. As is the case with most other amplification problems, if configured properly, a name server cannot be used to conduct this attack. Administrators should take care to not allow recursive queries from their nameservers, except from trusted hosts or networks. For bind, the option to set is the "allow-query" option. By setting this to a list of hosts or networks allowed to query recursively, one can prevent their servers from being used as an amplification site.
There is no easy way to prevent your network from being targeted in this manner. Filtering packets destined for port 53 on hosts which do not run a name server will only prevent traffic of this type from getting behind your firewall or router; it can still potentially affect your bandwidth. A possible method to combat in progress attacks would be to set up a dummy nameserver on the host being targeted, which will respond to all queries with bogus information. This will prevent some of the bandwidth amplification from being effective.
The post detailing this vulnerability makes special note that having even one nameserver capable of being used to conduct this attack can still allow an attacker to utilize your other nameservers, assuming the vulnerable nameserver can query the other nameservers.
References
Nameserver Traffic Amplification and NS Route Discovery Vulnerability
References:
References:
- ISC BIND Homepage (ISC)
- Teso Security Team Home Page (Teso)