How to remediate – DNS Server Cache Snooping Remote Information Disclosure

1. Introduction

The DNS Server Cache Snooping Remote Information Disclosure vulnerability allows attackers to determine which domains have recently been resolved by a DNS server. This can reveal information about an organisation’s internet usage, including business partners and services used. Affected systems are typically public-facing or internal DNS servers. A successful attack could compromise the confidentiality of network activity.

2. Technical Explanation

The vulnerability occurs when a DNS server responds to queries for third-party domains without verifying the recursion bit is set. This allows an attacker to query the server and infer which domains have been recently resolved by it, building a statistical model of network activity. This can be used to identify B2B partners or internal services.

• Root cause: The DNS server does not enforce recursion bit checking on incoming queries.
• Exploit mechanism: An attacker sends DNS queries for domains they control and monitors the responses from the target server. If a response is received, it indicates that the domain has been recently resolved by the server.
• Scope: All DNS software versions that do not properly validate recursion requests are affected.

3. Detection and Assessment

You can confirm vulnerability by checking if your DNS server responds to queries for domains with the recursion bit unset, or by using a network scanner.

• Quick checks: Check the DNS software version using the command appropriate for your operating system (e.g., `named -v` on Linux).
• Scanning: Nessus plugin ID 10429 can detect this vulnerability. This is an example only and may require updates.
• Logs and evidence: Examine DNS server logs for queries originating from unknown sources requesting domains that should not be resolved.

dig +trace example.com

4. Solution / Remediation Steps

To fix this issue, contact the vendor of your DNS software for a patch or update that enforces recursion bit checking on incoming queries.

4.1 Preparation

• Consider stopping the DNS service during the patching process to avoid conflicts. A roll back plan is to restore from the previous backup.
• A change window may be required depending on the size and complexity of your environment, with approval from the IT Security team.

4.2 Implementation

1. Step 1: Download and install the latest patch or update for your DNS software from the vendor’s website.
2. Step 2: Restart the DNS service to apply the changes.

4.3 Config or Code Example

This vulnerability is typically addressed through a software update, not a configuration change.

Before

After

4.4 Security Practices Relevant to This Vulnerability

Implementing a patch management process and network segmentation can help mitigate this vulnerability. Least privilege access reduces the impact if exploited.

• Practice 1: Patching DNS servers promptly with security updates is crucial to address known vulnerabilities.
• Practice 2: Network segmentation limits the scope of potential attacks by isolating vulnerable systems.

4.5 Automation (Optional)

Automation scripts are not directly applicable for this vulnerability, as it requires a software update. However, automated patch management tools can be used to streamline the patching process.

5. Verification / Validation

• Post-fix check: Use `dig +trace example.com` and confirm no responses are received for non-existent domains.
• Re-test: Re-run the initial detection scan (e.g., Nessus plugin 10429) to verify that the vulnerability is no longer detected.

dig +trace example.com

6. Preventive Measures and Monitoring

Regularly update security baselines to include this vulnerability, and add checks in your CI/CD pipeline for known vulnerabilities. A sensible patch review cycle is recommended.

• Baselines: Update your DNS server baseline configuration to ensure proper recursion bit checking is enabled.
• Asset and patch process: Implement a regular patch review cycle for all critical systems, including DNS servers.

7. Risks, Side Effects, and Roll Back

Patching may cause temporary service disruption. A roll back plan is to restore the previous backup of your DNS server configuration.

• Risk or side effect 1: Patching could temporarily interrupt DNS resolution services.
• Roll back: Restore the DNS server from the pre-patch backup if issues occur.

8. References and Resources

Refer to the vendor advisory for specific instructions on patching your DNS software.

• Vendor advisory or bulletin: http://cs.unc.edu/~fabian/course_papers/cache_snooping.pdf
• NVD or CVE entry: Not available in context.