BIND 8.2.2-P5 DoS vulnerability (exploit, BIND_ZXFR)
8 Nov. 2000
Summary
A security vulnerability in BIND was discovered. The bug involves a problem with the ZXFR feature - if the BIND_ZXFR feature has been disabled, sending someone a request for a zone transfer may cause the BIND DNS server to crash.
We'll transfer the zone zone.example.com from the DNS server dns.example.com (192.168.1.1) from the host attacker.example.org (10.10.10.10). This will actually crash the server.
We will send a Zone Transfer request using "-Z" switch, meaning we wish to use ZXFR. dns.example.com doesn't support ZXFR and have "allow-transfer{}" not configured, so everyone can ask him for *.zone.example.com.
On the server's log:
Nov 7 11:19:09 dns.example.com: named[188510]: approved ZXFR from [10.10.10.10].2284 for "zone.example.com"
Nov 7 11:19:09 dns.example.com: named[188510]: unsupported XFR (type ZXFR) of "zone.example.com" (IN) to [10.10.10.10].2284
