A cache-poisoning vulnerability in ISC BIND 9 resolvers configured with ECS options allows unauthenticated attackers to manipulate DNS responses and redirect traffic.

The flaw, categorized as CWE-349, occurs because the resolver fails to properly validate data when processing ECS options. This allows an unauthenticated remote attacker to inject malicious DNS records into the resolver cache.

Successful exploitation poses a significant risk to network integrity, as attackers can perform man-in-the-middle attacks by redirecting users to malicious infrastructure. Given the CVSS score of 8.6, this vulnerability is categorized as High severity, reflecting the ease of remote exploitation and the potential for large-scale impact on organizational communication and service availability.

Immediate Action: Upgrade BIND 9 instances to the patched releases, specifically version 9.18.38-S1 or 9.20.11-S1, depending on your current deployment branch.

Proactive Monitoring: Monitor DNS resolver logs for unusual cache update patterns or unexpected resolution results that deviate from expected traffic flows.

Compensating Controls: Disable ECS (EDNS Client Subnet) support in the BIND configuration if it is not strictly required for your operational environment, as this serves as the primary attack vector.

Public Exploit Available: No

Organizations utilizing BIND 9 as a caching resolver must treat this vulnerability with high priority. We recommend immediate verification of your current BIND versions against the affected list and the application of the vendor-provided patches during the next maintenance window. If patching is not immediately feasible, disabling the ECS feature is a critical temporary mitigation to prevent potential traffic interception.