CVE-2002-1220 in FreeBSD
Summary
by MITRE
BIND 8.3.x through 8.3.3 allows remote attackers to cause a denial of service (termination due to assertion failure) via a request for a subdomain that does not exist, with an OPT resource record with a large UDP payload size.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/07/2025
The vulnerability described in CVE-2002-1220 represents a critical denial of service weakness affecting Internet Systems Consortium BIND versions 8.3.x through 8.3.3. This flaw specifically targets the authoritative name server functionality of BIND, where the software fails to properly validate incoming DNS queries containing malformed OPT resource records. The vulnerability operates through a carefully crafted request that includes a non-existent subdomain query combined with an OPT record specifying an excessively large UDP payload size, typically exceeding the standard 512 byte limit for DNS responses. This particular attack vector exploits the assertion failure mechanism within the BIND resolver code, causing the service to terminate unexpectedly and resulting in complete denial of service for legitimate DNS queries.
The technical implementation of this vulnerability stems from insufficient input validation within the DNS query processing pipeline of BIND 8.3.x versions. When the resolver encounters a query with an OPT record containing an oversized UDP payload size, the software's internal assertion checks fail to properly handle this malformed input, leading to an abrupt termination of the name server process. This assertion failure occurs during the processing of the OPT resource record, which is typically used to indicate support for extended DNS features such as DNSSEC or larger UDP packet sizes. The flaw manifests when the resolver attempts to validate the payload size parameter within the OPT record against the actual network capabilities and internal buffer limits, causing a critical assertion to fail and subsequently triggering a service crash.
From an operational impact perspective, this vulnerability presents a significant risk to DNS infrastructure as it allows remote attackers to disrupt DNS services with minimal resources required for exploitation. The attack does not require authentication or specialized privileges, making it particularly dangerous for public-facing DNS servers. Network administrators and security professionals must recognize that this vulnerability affects the core functionality of DNS resolution, potentially causing widespread disruption to internet services that depend on the affected BIND versions. The impact extends beyond simple service interruption, as the termination of DNS services can cascade into broader network outages affecting multiple applications and services that rely on proper domain name resolution for their operations.
Security mitigations for this vulnerability should prioritize immediate patching of affected BIND installations to version 8.3.4 or later, which contains the necessary code modifications to properly validate OPT resource record parameters. Organizations should also implement network-level protections such as rate limiting for DNS queries and monitoring for unusual OPT record patterns that may indicate attempted exploitation. The vulnerability aligns with CWE-119 in the Common Weakness Enumeration, which categorizes it as an improper restriction of operations within a restricted environment, specifically relating to buffer overflow conditions that occur during DNS query processing. From an ATT&CK framework perspective, this vulnerability maps to the T1499.004 technique for network denial of service, where adversaries leverage weaknesses in network infrastructure to disrupt availability of services. Additionally, the vulnerability demonstrates characteristics of T1590 for reconnaissance activities, as attackers may probe for vulnerable systems before launching exploitation attempts. System administrators should also consider implementing redundant DNS infrastructure and failover mechanisms to minimize the impact of such attacks on overall network availability.