BIND 9 Cache Update from Additional Section (updated 19Jan2010)

A nameserver with DNSSEC validation enabled may incorrectly add unauthenticated records to its cache that are received during the resolution of a recursive client query with checking disabled (CD), or when the nameserver internally triggers a query for missing records for recursive name resolution. Cached records can be returned in response to subsequent client queries with or without requesting DNSSEC records (DO). In addition, some of them can be returned to queries with or without checking disabled (CD).

*Severity: Medium (SEVERE for nameservers with DNSSEC validation enabled)

Impact:

This problem only affects nameservers that allow recursive queries and who are performing DNSSEC validation with a trust anchor on behalf of their clients.

The same underlying problem is observed in two slightly different scenarios:

1. A nameserver with DNSSEC validation enabled may incorrectly add unauthenticated records to its cache from responses received from the additional section, either when processing client queries with checking disabled (CD) or when the nameserver internally triggers a query for missing records for recursive name resolution.

These cached unauthenticated records may be returned to subsequent queries with checking disabled (CD), and with or without requesting DNSSEC records (DO).

2. A nameserver with DNSSEC validation enabled may incorrectly add unauthenticated CNAME or DNAME records to its cache, either when processing client queries with checking disabled (CD) or when the nameserver internally triggers a query for missing records for recursive name resolution.

CNAME or DNAME records added to cache in this way can be returned in response to a query with or without checking disabled (CD), and with or without requesting DNSSEC records (DO).