Discovered by Florian Maury, at the French Network and Information Security Agency (ANSSI), it is called “infinite recursion“.
It only affects DNS resolvers (and in certain circumstances, BIND software, even when it is on an authoritative server). It is present in several software systems, at least BIND (CVE-2014-8500), PowerDNS (CVE-2014-8601) and Unbound (CVE-2014-8602).
It does not seem to be present in the Microsoft Windows DNS resolver.
The vulnerability enables easy denial of service attack, which stops the operation of the resolver without committing extensive resources. It is therefore necessary for all DNS resolver managers to quickly update their software.
For BIND, upgrade to versions 9.9.6-P1 and 9.10.1-P1
<https://kb.isc.org/article/AA-01224/81/BIND-9.9.6-P1-Release-Notes.html>
<https://kb.isc.org/article/AA-01223/81/BIND-9.10.1-P1-Release-Notes.html>
For Unbound, upgrade to 1.5.1 “Fix CVE-2014-8602: denial of service by making resolver chase endless series of delegations”.
<https://unbound.nlnetlabs.nl/pipermail/unbound-users/2014-December/003663.html>
For PowerDNS, upgrade to 3.6.2, which was released several weeks ago.
<http://mailman.powerdns.com/pipermail/pdns-users/2014-December/011009.html>
About Afnic
Afnic is the acronym for Association Française pour le Nommage Internet en Coopération, the French Network Information Centre. The registry has been appointed by the French government to manage domain names under the .fr Top Level Domain. Afnic also manages the .re (Reunion Island), .pm (Saint-Pierre and Miquelon), .tf (French Southern and Antarctic Territories), .wf (Wallis and Futuna) and .yt (Mayotte) French Overseas TLDs.
In addition to managing French TLDs, Afnic’s role is part of a wider public interest mission, which is to contribute on a daily basis, thanks to the efforts of its teams and its members, to a secure and stable internet, open to innovation and in which the French internet community plays a leading role. As part of that mission, Afnic, a non-profit organization, has committed to devoting 11% of its Revenues from managing .fr Top Level Domain to actions of general interest, in particular by transferring €1.3 million each year to the Afnic Foundation for Digital Solidarity.
Afnic is also the back-end registry for the companies as well as local and regional authorities that have chosen to have their own TLD, such as .paris, .bzh, .alsace, .corsica, .mma, .ovh, .leclerc and .sncf.
Established in 1997 and based in Saint-Quentin-en-Yvelines, Afnic currently has nearly 90 employees.
Featured
12/11/24
Régis Massé, Director of Information Systems and Chief Technical ...
Learn more
Internet security is currently a major concern for all online ...
Learn more