InfoSecBulletin Cybersecurity for mankind
BIND9 DNA Cache poisoning impact 267 IPs in Bangladesh via CVE: 2025-40778. The high severity flaw can allow remote attackers to inject forged DNS records into resolver caches.
BGD e-GOV CIRT published an advisory stating all organizations operating BIND 9 resolvers in Bangladesh (ISPs, data centers, government, enterprises) must upgrade to ISC (Internet Systems Consortium) patched releases 9.18.41, 9.20.15, 9.21.14 (or S1 variants) immediately. If cannot patch immediately, restrict recursion to trusted networks, enable DNSSEC validation where possible, and monitor DNS logs for anomalous answers.
Citrix NetScaler SAML 0-Day Flaw Under Attack
Major Danish university breached, 200,000 users at risk
Microsoft’s X account hijacked to promote Clippy crypto scam
Critical cPanel, GitLab AI Gateway and Dell CSM Flaws Enable RCE And Admin Hijacking
Nearly 100,000 email addresses exposed in first AI-related data breach in Singapore
Hackers Exploit Zimbra Mail Servers: TeamViewer patched 5 critical flaws
Google Warns of Hackers Actively Exploiting Citrix 0-Day Flaws
CISA Warns Critical MikroTik RouterOS Flaw While Cisco SD-WAN Zero-Day Exploited in Attacks
Apple Zero-Day Exploited: Pentagon Data Breach Reportedly Exposes Sensitive Data of 3 Million People
JadePuffer Agentic AI targets and destroys Azure’s cloud resources
The vulnerability (CVSS 8.6) in BIND 9 lets attackers inject fake DNS records into resolver caches through regular queries. It affects BIND versions 9.11.0–9.16.50, 9.18.0–9.18.39, 9.20.0–9.20.13, and 9.21.0–9.21.12 (including S1 previews). This can lead to DNS cache poisoning and redirect users to harmful sites.
Researchers released the PoC that demonstrates how an unauthenticated, remote attacker could poison DNS caches in vulnerable BIND 9 resolvers.
Mitigation & Recommended Actions:
Immediate Actions:
* Upgrade resolver instances to the patched BIND releases that correspond to respective
branch: 9.18.41, 9.20.15, 9.21.14 (and S1 variants 9.18.41-S1, 9.20.15-S1 where
applicable). If any affected 9.x version is running, upgrade to the closest patched release
from ISC immediately.
* ISP/recursive resolver operator or host a resolver for many clients (e.g., public DNS, ISP,
cloud provider), schedule an emergency update window and announce it to customers;
treat this as an urgent operational priority.
* If BIND instance is authoritative-only and does not perform recursion, it is likely not
directly exploitable, confirm configuration and ensure recursion is disabled for public
networks. (But verify with named -V and configurations)
Temporary mitigations (until you patch): (These reduce risk but are not full fixes)
* Restrict recursion to trusted IP ranges only (use allow-recursion and allow-query-cache to
trusted networks). This prevents external attackers from triggering recursive queries
against your resolver.
* Disable recursion on servers that must be authoritative-only (recursion no;) if possible
* If environment allows, reduce cache lifetime (TTL) temporarily to reduce window of
poisoned entries (shorter TTL means forged entries expire sooner). Note: this is disruptive
and should be used carefully.
* Use DNSSEC validation on resolvers (enable validation with a validating resolver or dnssec
enable/dnssec-validation in BIND); while this doesn’t protect all record types, DNSSEC
validation prevents signed zones from being silently replaced by unsigned forged records.
Note: enabling DNSSEC validation requires configuration and trust-anchor setup.
* Use upstream, validated recursive resolvers from trustworthy providers if local resolver
cannot be patched immediately (need to ensure clients are protected).
* Firewall / rate-limit DNS responses from the outside where practical, and monitor for
unusual DNS answer patterns/TTL/unknown authoritative servers.
DDoS Scandals Hit Bangladesh ISP Sector: BTRC Prepares Crackdown
