DNSSEC Validation Bypass in Hickory DNS

Executive Summary

This vulnerability in Hickory DNS 0.26.0-beta.1 before 0.26.2 allows an attacker to bypass DNSSEC validation. The issue occurs because the Name's Hash ignores label lengths and the ValidationCacheKey only compares that hash. An attacker can exploit this by controlling an unsigned delegation whose name differs from a signed target only in dot positions, causing forged answers to skip signature verification and return incorrect data instead of SERVFAIL.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability could allow attackers to provide false DNS responses, leading to potential man-in-the-middle attacks. Users might be redirected to malicious websites or receive incorrect data without realizing it. Systems relying on DNSSEC for security could be tricked into accepting invalid responses.

Useful 0 Not Useful 0

Mitigation Strategies

Update the hickory-net crate in Hickory DNS to version 0.26.2 or later to address the DNSSEC validation bypass issue.

Useful 0 Not Useful 0