CVE-2025-13878

CVE-1999-0024 vulnerability involves a malicious attack on DNS cache via BIND, exploiting predictable query IDs.

The BIND resolver accepts validly-signed NSEC records where the "Next Domain Name" field points outside the signer's zone. Affected versions include BIND 9.11.0-9.18.50, 9.20.0-9.20.24, 9.21.0-9.21.23, and S1 versions.

BIND 9 in certain versions may exit unexpectedly with an assertion while validating proof if a domain is covered by both NSEC and NSEC3 records and an RRSIG exists for only one type.

BIND 9 contains a vulnerability that causes unexpected termination of the named process. The issue occurs with specific ordering of responses to queries for CNAME, DNAME, and A records when the authoritative server delays the response.

In BIND 9, an attacker can respond to a query with an RRSIG having fewer labels than the zone, causing a wildcard name for a shorter zone, leading to cache poisoning. This requires synth-from-dnssec yes (default).

A DNSSEC validating resolver under a random subdomain attack can suffer from runaway memory usage, exceeding the max-cache-size limit. The attacker needs to send queries faster than the resolver can validate.

Resource exhaustion vulnerability in BIND related to DNSSEC validation. The server always validates all RRSIG records in a response, even if unnecessary, leading to excessive CPU usage.

BIND 9 has a vulnerability in RPZ processing with wildcard CNAME policies. An attacker can send a query with a long name triggering a NAMETOOLONG error, which may lead to bypassing RPZ rules or an unexpected exit of BIND 9.

A flaw in BIND 9: accepting an invalid data structure in a DNS record (PRIVATEDNS algorithm with incorrect length) can cause the server to abort when rendering the record to text.

BIND may accept incorrect child-zone NSEC3 records as valid, allowing an attacker to forge authenticated NXDOMAIN responses. This affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, and corresponding -S1 versions.