A predictable PRNG in ISC BIND 9 allows unauthenticated remote attackers to spoof DNS responses, potentially leading to cache poisoning and traffic redirection.

This vulnerability involves a weakness in the Pseudo Random Number Generator (PRNG), categorized under CWE-341. It allows an unauthenticated remote attacker to predict the source port and query ID used by the DNS server, which facilitates the injection of fraudulent DNS data.

The ability to predict DNS query attributes poses a severe risk to network integrity. By successfully spoofing DNS responses, attackers can redirect users to malicious infrastructure, intercept sensitive traffic, or facilitate man-in-the-middle attacks. With a CVSS score of 8.6, this flaw represents a high risk to organizational security and data confidentiality, as it undermines the fundamental trust in DNS resolution.

Immediate Action: Upgrade to the patched versions provided by ISC: 9.18.41, 9.20.15, 9.21.14, 9.18.41-S1, or 9.20.15-S1.

Proactive Monitoring: Review DNS server logs for anomalous query patterns or a high frequency of failed DNSSEC validation attempts, which may indicate exploitation attempts.

Compensating Controls: Ensure DNSSEC is fully implemented and enforced to provide cryptographic validation of DNS records, which can mitigate the impact of cache poisoning attempts.

Public Exploit Available: No

Given the critical nature of DNS infrastructure and the potential for large-scale traffic redirection, administrators must prioritize patching affected BIND 9 instances immediately. Apply the vendor-supplied updates to the versions listed above to resolve the PRNG predictability issue and ensure the continued security of your DNS resolution services.