BIND 9 Emergency Patches: ISC Fixes High-Severity Cache Poisoning and DoS Flaws

Daily Security Review

Content provided by Daily Security Review. All podcast content including episodes, graphics, and podcast descriptions are uploaded and provided directly by Daily Security Review or their podcast platform partner. If you believe someone is using your copyrighted work without your permission, you can follow the process outlined here https://podcastplayer.com/legal.

12d ago 20:19

MP3•Episode home

The Internet Systems Consortium (ISC) has released a series of critical BIND 9 updates to fix multiple high-severity vulnerabilities affecting DNS resolver systems worldwide. The flaws—tracked as CVE-2025-40780, CVE-2025-40778, and CVE-2025-8677—pose serious threats ranging from cache poisoning to denial-of-service (DoS) attacks. These vulnerabilities collectively endanger one of the internet’s most foundational components: the Domain Name System (DNS).

The two most severe issues, both scoring 8.6 on the CVSS scale, expose BIND resolvers to cache poisoning. One of them, CVE-2025-40780, originates from a weakness in the Pseudo Random Number Generator (PRNG) used for DNS queries, allowing attackers to predict critical identifiers like source ports and query IDs. The second, CVE-2025-40778, involves overly lenient acceptance of DNS records, which can enable attackers to inject forged or spoofed entries into the cache. Once poisoned, the resolver could redirect users to malicious domains, enabling phishing, credential theft, and data interception across entire organizations.

The third flaw, CVE-2025-8677, rated 7.5 (High), introduces a DoS risk that allows adversaries to overwhelm DNS resolvers by sending specially crafted malformed DNSKEY records, consuming CPU resources until DNS services become unavailable. Because nearly all internet-dependent systems rely on DNS resolution, such attacks can lead to massive service disruptions, cutting off critical applications, communications, and business operations.

The ISC emphasizes that no workarounds exist for these vulnerabilities — patching is the only mitigation. Updated versions, including BIND 9.18.41, 9.20.15, and 9.21.14, are now available and must be deployed immediately. Though the consortium reports no confirmed in-the-wild exploitation so far, the public disclosure of technical details drastically increases the likelihood of attackers developing weaponized exploits in the near term.

For enterprises, this serves as an urgent reminder that DNS security is infrastructure security. Any delay in applying the ISC’s patches exposes networks to redirection attacks, service outages, and data breaches. Immediate updates are critical to maintaining service integrity, preventing manipulation of DNS traffic, and ensuring business continuity.

#BIND9 #DNS #ISCSecurity #CVE202540780 #CVE202540778 #CVE20258677 #CachePoisoning #DNSAttack #PRNGFlaw #DenialOfService #CyberSecurity #Vulnerability #PatchNow #DNSResolver #InternetSecurity #ISCVulnerability #SystemAdmin

410 episodes

#Tech #News #Tech News #Daily Security Review