Abstract:DNS can be compared to a game of chess in that its rules are simple, yet the possibilities it presents are endless. While the fundamental rules of DNS are straightforward, DNS implementations can be extremely complex. In this study, we intend to explore the complexities and vulnerabilities in DNS response pre-processing by systematically analyzing DNS RFCs and DNS software implementations. We present the discovery of three new types of logic vulnerabilities, leading to the proposal of three novel attacks, namely the TuDoor attack. These attacks involve the use of malformed DNS response packets to carry out DNS cache poisoning, denial- of-service, and resource consuming attacks. By performing comprehensive experiments, we demonstrate the attack’s feasibility and significant real-world impacts of TUDOOR. In total, 24 mainstream DNS software, including BIND, PowerDNS, and Microsoft DNS, are affected by TuDoor. Attackers can instigate cache poisoning and denial-of-service attacks against vulnerable resolvers using a handful of crafted packets within 1 second or circumvent the query limit to deplete resolution resources (e.g., CPU). Besides, to determine the vulnerable resolver population in the wild, we collect and evaluate 16 popular Wi-Fi routers, 6 prevalent router OSes, 42 public DNS services, and around 1.8M open DNS resolvers. Our measurement results indicate that TUDOOR could exploit 7 routers (OSes), 18 public DNS services, and 424,652 (23.1%) open DNS resolvers. Following the best practice of responsible disclosure, we have reported these vulnerabilities to all affected vendors, and 18 of them, including BIND, Chrome, Cloudflare, and Microsoft, have acknowledged our findings and discussed mitigation solutions with us. Furthermore, 33 CVE IDs are assigned to our discovered vulnerabilities, and we provide an online detection tool as one of the mitigation measures. Our research highlights the urgent need for standardization of DNS response pre-processing logic to enhance the security of DNS.

Analysis of Stack Overflows on Windows DNS Server

Different is Good

Defense Buffer Overflow in Code Writing

Analysis and Using of Buffer OverFlow on Linux System

TuDoor Attack: Systematically Exploring and Exploiting Logic Vulnerabilities in DNS Response Pre-processing with Malformed Packets

Research on Principle and Defense of Buffer Overflow Attacks

Analysis and Study of Buffer Overflow Attack Detection Technology

Detecting heap smashing attacks through fault containment wrappers

Principle and Attack Method of Kernel Overflow under Win32 Enviroment

Study on OpenSSL Heartbleed Attack Principle and Defense Method

Buffer Overflow Attacks Analysis and Real-time Detection

Study on Buffer Overflow Attack and Detection Method

DNS Cache Poisoning Attack Reloaded: Revolutions with Side Channels

Research on Detection of Vulnerability-Exploiting Technology Heap Spray

The Technical Analysis and Security Countermeasure of DoS-based Network Attacks

SecretSafe: A Lightweight Approach against Heap Buffer Over-Read Attack

Dynamic and static analyses of integer overflow vulnerabilities

Survey on Domain Name System Security.

Detection of Data Leakage Based on DNS Traffic

The Maginot Line: Attacking the Boundary of DNS Caching Protection

To Detect Stack Buffer Overflow with Polymorphic Canaries