CyberRota Analysis
AI-GeneratedThe vulnerability allows an attacker to exploit the DNS resolver by responding with an RRSIG that has fewer labels than the legitimate zone, leading to potential cache poisoning. This issue primarily affects BIND 9 versions 9.11.0 through 9.18.50, among others, and is particularly critical for environments where the resolver has the default setting of `synth-from-dnssec yes;`. Organizations using affected BIND versions should prioritize patching to mitigate the risk of DNS cache poisoning attacks.
Original NVD Description
It is possible for an attacker's zone to respond to a query with an RRSIG that has a smaller number of labels than the zone in which the RRSIG is contained. This causes `named` to produce a wildcard name for a zone that is shorter than the attacker's zone, which can result in cache poisoning. For this attack to have any effect, the resolver under attack must have set `synth-from-dnssec yes;` (which is the default). This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.