CyberRota Analysis
AI-GeneratedThe BIND resolver is vulnerable due to its acceptance of validly-signed NSEC records that improperly reference domain names outside the signer's zone, potentially leading to DNS spoofing or cache poisoning attacks. This high-severity vulnerability affects multiple versions of BIND 9, and organizations using these versions should prioritize patching to mitigate the risk of unauthorized access or data manipulation. Network administrators and security teams managing DNS infrastructure should take immediate action to address this issue.
Original NVD Description
The BIND resolver accepts validly-signed NSEC records where the "Next Domain Name" field points outside the signer's zone. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.