IPA warns of BIND DNS vulnerabilities

19 May 2020 high vulnerability

IPA Japan warns of multiple BIND DNS server vulnerabilities enabling performance degradation, reflection attacks, and potential service disruption.

The Information-technology Promotion Agency (IPA) of Japan issued a security alert on May 20, 2020, regarding multiple vulnerabilities affecting ISC BIND DNS servers. These vulnerabilities, if exploited, could lead to increased server load causing performance degradation, abuse of affected servers as amplification vectors in reflection attacks, or unintended denial of service conditions. While no active exploitation has been observed at the time of publication, IPA emphasizes the potential for future attacks and urges DNS server administrators to apply updates immediately. ISC has released patched versions available through their official download portal at isc.org, and administrators are directed to obtain updates either from ISC directly or through their respective vendors. The advisory was initially published on May 20, 2020, with reference information added on May 21, 2020.

Detection guidance

Potential DNS Reflection Amplification Abuse via BIND Server

ATT&CK T1498.002

Detects a DNS server sending unusually large volume of large-sized DNS responses to numerous distinct external destinations on port 53, a pattern consistent with the server being abused as a reflection/amplification vector following exploitation of BIND vulnerabilities; investigate volume/uniqueness thresholds over a short time window as this rule only flags the qualifying traffic shape. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Potential DNS Reflection Amplification Abuse via BIND Server
id: f4b39674-ffce-5cd8-9f7e-f67ec9816bb4
status: experimental
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    DestinationPort: 53
    Protocol: UDP
    Initiated: 'false'
  large_response:
    NetworkBytes|gt: 1200
  filter:
    DestinationIp|cidr:
    - 10.0.0.0/8
    - 172.16.0.0/12
    - 192.168.0.0/16
  condition: selection and large_response and not filter
fields:
- SourceIp
- DestinationIp
- DestinationPort
- NetworkBytes
falsepositives:
- Legitimate DNS servers responding to large TXT/DNSSEC record queries
- CDN or DNS resolver infrastructure with naturally large response sizes
- Internal monitoring tools sending synthetic DNS probes
level: low
tags:
- attack.t1498.002
- attack.impact
author: Vorant

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.ipa.go.jp/archive/security/security-alert/2020/alert20200520.html

This is the public brief

Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.

Start free