DNSSEC Validation Flaw in Hickory DNS

Executive Summary

This vulnerability affects Hickory DNS versions 0.25 through 0.26.0-alpha.1 and hickory-net 0.26.0-beta.1 before 0.26.2. It involves a flaw in DNSSEC validation where the NSEC3 handler incorrectly matches the closest encloser by hash alone without verifying the type bitmap. This allows attacker-controlled responses with valid parent NSEC3 records to falsely prove nonexistence of names, causing NXDOMAIN or NODATA responses with AD=1 flag to be cached.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to deny resolution of legitimate domain names by causing false NXDOMAIN or NODATA responses to be cached with AD=1. This disrupts DNS resolution for domains under the targeted zone, leading to service outages or misdirection to malicious sites. Systems relying on Hickory DNS for DNSSEC validation are particularly affected.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could impact compliance by disrupting DNS resolution, potentially causing service unavailability or data exposure if DNSSEC validation is bypassed. GDPR requires ensuring data integrity and availability, while HIPAA mandates reliable access to systems handling protected health information. DNS failures may violate these requirements.

Useful 0 Not Useful 0

Mitigation Strategies

Update Hickory DNS to version 0.26.2 or later to address the DNSSEC validation flaw in the NSEC3 handler.

Useful 0 Not Useful 0