CVE-2021-25220 DNS forwarders - cache poisoning vulnerability
Attackers can poison the DNS cache in BIND, causing clients to receive incorrect records and potentially redirecting traffic to malicious servers.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-25220?
CVE-2021-25220 is a medium-severity vulnerability in Fedoraproject Fedora, published on 23 Mar 2022. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
BIND 9.11.0 -> 9.11.36 9.12.0 -> 9.16.26 9.17.0 -> 9.18.0 BIND Supported Preview Editions: 9.11.4-S1 -> 9.11.36-S1 9.16.8-S1 -> 9.16.26-S1 Versions of BIND 9 earlier than those shown - back to 9.1.0, including Supported Preview Editions - are also believed to be affected but have not been tested as they are EOL. The cache could become poisoned with incorrect records leading to queries being made to the wrong servers, which might also result in false information being returned to clients.
Weakness: CWE-444
Which versions are affected by CVE-2021-25220?
It affects 12 products.
Linux distribution packages (40)
bind AlmaLinux:8 | All versions | 32:9.11.36-5.el8 |
bind-chroot AlmaLinux:8 | All versions | 32:9.11.36-5.el8 |
bind-devel AlmaLinux:8 | All versions | 32:9.11.36-5.el8 |
bind-export-devel AlmaLinux:8 | All versions | 32:9.11.36-5.el8 |
bind-export-libs AlmaLinux:8 | All versions | 32:9.11.36-5.el8 |
bind-libs AlmaLinux:8 | All versions | 32:9.11.36-5.el8 |
bind-libs-lite AlmaLinux:8 | All versions | 32:9.11.36-5.el8 |
bind-license AlmaLinux:8 | All versions | 32:9.11.36-5.el8 |
bind-lite-devel AlmaLinux:8 | All versions | 32:9.11.36-5.el8 |
bind-pkcs11 AlmaLinux:8 | All versions | 32:9.11.36-5.el8 |
bind-pkcs11-devel AlmaLinux:8 | All versions | 32:9.11.36-5.el8 |
bind-pkcs11-libs AlmaLinux:8 | All versions | 32:9.11.36-5.el8 |
bind-pkcs11-utils AlmaLinux:8 | All versions | 32:9.11.36-5.el8 |
bind-sdb AlmaLinux:8 | All versions | 32:9.11.36-5.el8 |
bind-sdb-chroot AlmaLinux:8 | All versions | 32:9.11.36-5.el8 |
bind-utils AlmaLinux:8 | All versions | 32:9.11.36-5.el8 |
python3-bind AlmaLinux:8 | All versions | 32:9.11.36-5.el8 |
dhcp-client AlmaLinux:9 | All versions | 12:4.4.2-17.b1.el9 |
dhcp-common AlmaLinux:9 | All versions | 12:4.4.2-17.b1.el9 |
dhcp-relay AlmaLinux:9 | All versions | 12:4.4.2-17.b1.el9 |
dhcp-server AlmaLinux:9 | All versions | 12:4.4.2-17.b1.el9 |
bind Red Hat:enterprise_linux:8::appstream | All versions | 32:9.11.36-5.el8 |
bind-chroot Red Hat:enterprise_linux:8::appstream | All versions | 32:9.11.36-5.el8 |
bind-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 32:9.11.36-5.el8 |
bind-debugsource Red Hat:enterprise_linux:8::appstream | All versions | 32:9.11.36-5.el8 |
bind-devel Red Hat:enterprise_linux:8::appstream | All versions | 32:9.11.36-5.el8 |
bind-export-libs-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 32:9.11.36-5.el8 |
bind-libs Red Hat:enterprise_linux:8::appstream | All versions | 32:9.11.36-5.el8 |
bind-libs-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 32:9.11.36-5.el8 |
bind-libs-lite Red Hat:enterprise_linux:8::appstream | All versions | 32:9.11.36-5.el8 |
bind-libs-lite-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 32:9.11.36-5.el8 |
bind-license Red Hat:enterprise_linux:8::appstream | All versions | 32:9.11.36-5.el8 |
bind-lite-devel Red Hat:enterprise_linux:8::appstream | All versions | 32:9.11.36-5.el8 |
bind-pkcs11 Red Hat:enterprise_linux:8::appstream | All versions | 32:9.11.36-5.el8 |
bind-pkcs11-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 32:9.11.36-5.el8 |
bind-pkcs11-devel Red Hat:enterprise_linux:8::appstream | All versions | 32:9.11.36-5.el8 |
bind-pkcs11-libs Red Hat:enterprise_linux:8::appstream | All versions | 32:9.11.36-5.el8 |
bind-pkcs11-libs-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 32:9.11.36-5.el8 |
bind-pkcs11-utils Red Hat:enterprise_linux:8::appstream | All versions | 32:9.11.36-5.el8 |
bind-pkcs11-utils-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 32:9.11.36-5.el8 |
Products include Fedoraproject Fedora, Isc Bind, Juniper Junos, Netapp H300e Firmware, Netapp H300s Firmware, Netapp H410c Firmware and 6 more.
How do I fix CVE-2021-25220?
Upgrade to a fixed version.
Is CVE-2021-25220 being exploited?
There is no known exploitation of CVE-2021-25220 in the wild and no public exploit code.
Other vulnerabilities in Fedoraproject Fedora
Sources
Also known as ALPINE-CVE-2021-25220, ALSA-2022:7790, ALSA-2022:8385, AZL-9118, CLSA-2022-1649170483, CLSA-2022-1649172068 and 20 more.