DNS forwarders - cache poisoning vulnerability

CVE-2021-25220

6.8MEDIUM

Key Information

Vendor: Isc
Status: Bind
Vendor: CVE Published:; 23 March 2022

Summary

BIND 9.11.0 -> 9.11.36 9.12.0 -> 9.16.26 9.17.0 -> 9.18.0 BIND Supported Preview Editions: 9.11.4-S1 -> 9.11.36-S1 9.16.8-S1 -> 9.16.26-S1 Versions of BIND 9 earlier than those shown - back to 9.1.0, including Supported Preview Editions - are also believed to be affected but have not been tested as they are EOL. The cache could become poisoned with incorrect records leading to queries being made to the wrong servers, which might also result in false information being returned to clients.

Affected Version(s)

BIND = Open Source Branch 9.11 9.11.0 through versions before 9.11.37

BIND = Development Branch 9.17 BIND 9.17 all version

BIND = Open Source Branch 9.12-16 9.12.0 through versions before 9.16.27

CVSS V3.1

Score:

6.8

Severity:

MEDIUM

Confidentiality:

None

Integrity:

High

Availability:

None

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

High

User Interaction:

None

Scope:

Changed

Timeline

Vulnerability published.
Mar 23, 2022
Vulnerability Reserved.
Jan 15, 2021

Collectors

NVD DatabaseMitre Database

Credit

ISC would like to thank Xiang Li, Baojun Liu, and Chaoyi Lu from Network and Information Security Lab, Tsinghua University and Changgen Zou from Qi An Xin Group Corp. for discovering and reporting this issue.