CVE-2024-1737

What it actually does

Resolver caches and authoritative zone databases holding many RRs for the same hostname suffer degraded performance during content addition, updates, and client query handling, resulting in high resource consumption that can lead to denial of service.

Why it matters to the business

DNS services on affected systems can slow down or become unresponsive under targeted query loads, disrupting network connectivity, email, web access, and other dependent operations across an organization.

How an attack unfolds

An attacker sends crafted queries or updates targeting a single hostname associated with a large number of resource records, causing the BIND server to expend excessive resources while processing the data in caches or zone databases.

How to fix it

Upgrade BIND 9 installations to versions beyond the affected ranges (after 9.11.37, 9.16.50, 9.18.27 and corresponding subscription editions) using patches released by ISC.

How to confirm the fix worked

Verify the installed BIND version against the affected list, then test query handling performance for hostnames containing large numbers of RRs before and after the upgrade.

Typical attack path

1. Locate an internet-facing or internal BIND 9 server running an affected version
2. Identify or create a hostname with a high volume of RRs of any type
3. Issue repeated queries or updates for that hostname to trigger performance degradation
4. Sustain the load to maintain denial of service conditions

How to detect it

Review BIND query and update logs for repeated access to individual hostnames accompanied by elevated resource utilization; correlate with system performance metrics indicating cache or database processing delays.

What your security team should do

• Immediately inventory all BIND 9 deployments and schedule upgrades to fixed releases
• Apply query rate limiting and response policy zones where feasible to reduce exposure
• Monitor CPU and memory usage on DNS servers for anomalous spikes correlated with specific hostnames