CVE-2012-1191 in djbdns
Summary
by MITRE
The resolver in dnscache in Daniel J. Bernstein djbdns 1.05 overwrites cached server names and TTL values in NS records during the processing of a response to an A record query, which allows remote attackers to trigger continued resolvability of revoked domain names via a "ghost domain names" attack.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 11/30/2021
The vulnerability identified as CVE-2012-1191 affects the dnscache component within Daniel J. Bernstein's djbdns suite version 1.05, specifically targeting the resolver functionality that handles DNS query responses. This flaw resides in the manner in which cached NS records are managed during A record query processing, creating a critical security weakness that undermines DNS resolution integrity. The vulnerability represents a classic case of improper handling of cached DNS data where the system fails to maintain accurate record state during concurrent query operations, leading to potential domain hijacking scenarios.
The technical mechanism behind this vulnerability involves the overwrite behavior of cached server names and TTL values within NS records when processing A record responses. During normal DNS resolution, when a client queries for an A record, the resolver may simultaneously receive responses for NS records that contain authoritative server information. In the affected version of djbdns, the resolver incorrectly overwrites existing cached NS record data with new information from the A record response, causing the cached TTL values and server names to become inconsistent with the actual domain state. This behavior creates a window where previously revoked or expired domain names can continue to appear resolvable due to stale cached data, effectively enabling attackers to maintain access to domains that should no longer be accessible.
The operational impact of this vulnerability extends beyond simple DNS caching issues, creating a persistent threat vector that aligns with attack patterns described in the MITRE ATT&CK framework under the DNS tunneling and credential access categories. An attacker exploiting this vulnerability can maintain continued access to domain resources by leveraging the cached NS records to redirect queries to malicious servers or maintain access to compromised domains that have been revoked or discontinued. This ghost domain attack effectively bypasses normal DNS expiration mechanisms and can be particularly dangerous in environments where domain monitoring and access control rely on accurate DNS resolution. The vulnerability affects the fundamental trust model of DNS resolution, potentially allowing attackers to maintain persistent access to systems or resources that should be inaccessible.
Security implications of CVE-2012-1191 are significant, particularly for organizations relying on djbdns for DNS resolution services. The flaw directly relates to CWE-200, which addresses information exposure, and CWE-1286, which deals with improper handling of cached data. Organizations using affected versions of djbdns face risks including unauthorized access to domain resources, potential data exfiltration through DNS tunneling, and continued access to compromised domains. The vulnerability also impacts DNS security protocols and can undermine DNSSEC validation if the cached data becomes inconsistent with the authoritative DNS server responses. Mitigation strategies should include immediate upgrade to patched versions of djbdns, implementation of proper DNS cache monitoring, and consideration of alternative DNS resolution mechanisms that do not exhibit this behavior. Network administrators should also implement DNS query logging to detect anomalous resolution patterns that might indicate exploitation attempts. The vulnerability demonstrates the critical importance of proper cache management in DNS resolution systems and highlights the potential for seemingly benign caching behavior to create significant security weaknesses.