InfoSecBulletin Cybersecurity for mankind
BIND9 DNA Cache poisoning impact 267 IPs in Bangladesh via CVE: 2025-40778. The high severity flaw can allow remote attackers to inject forged DNS records into resolver caches.
BGD e-GOV CIRT published an advisory stating all organizations operating BIND 9 resolvers in Bangladesh (ISPs, data centers, government, enterprises) must upgrade to ISC (Internet Systems Consortium) patched releases 9.18.41, 9.20.15, 9.21.14 (or S1 variants) immediately. If cannot patch immediately, restrict recursion to trusted networks, enable DNSSEC validation where possible, and monitor DNS logs for anomalous answers.
Mysterious AI model “Ox Alpha” with free 100 trillion tokens a day for coders
After BDJobs, Directorate of Secondary and Higher Education 390k data surfaced online
Researchers show new technique to bypass AI safety guardrails in Grok and Gemini
About thousands of leaked AWS keys Held Full Admin Rights
US Bank investigates LockBit’s Data Breach Claims
Five new malware families actively targeting Asian Gov.t infra
T-Mobile Cuts Cables to Remove Chiness Salt Typhoon Hackers from Network
Splunk, Zyxel Patch Multiple Flaws Enabling RCE and Root Command Execution
“Zombie Card” attack revels expired Visa card may be used for contactless payments
Critical Zimbra RCE Flaw Actively Exploited in the Wild
The vulnerability (CVSS 8.6) in BIND 9 lets attackers inject fake DNS records into resolver caches through regular queries. It affects BIND versions 9.11.0–9.16.50, 9.18.0–9.18.39, 9.20.0–9.20.13, and 9.21.0–9.21.12 (including S1 previews). This can lead to DNS cache poisoning and redirect users to harmful sites.
Researchers released the PoC that demonstrates how an unauthenticated, remote attacker could poison DNS caches in vulnerable BIND 9 resolvers.
Mitigation & Recommended Actions:
Immediate Actions:
* Upgrade resolver instances to the patched BIND releases that correspond to respective
branch: 9.18.41, 9.20.15, 9.21.14 (and S1 variants 9.18.41-S1, 9.20.15-S1 where
applicable). If any affected 9.x version is running, upgrade to the closest patched release
from ISC immediately.
* ISP/recursive resolver operator or host a resolver for many clients (e.g., public DNS, ISP,
cloud provider), schedule an emergency update window and announce it to customers;
treat this as an urgent operational priority.
* If BIND instance is authoritative-only and does not perform recursion, it is likely not
directly exploitable, confirm configuration and ensure recursion is disabled for public
networks. (But verify with named -V and configurations)
Temporary mitigations (until you patch): (These reduce risk but are not full fixes)
* Restrict recursion to trusted IP ranges only (use allow-recursion and allow-query-cache to
trusted networks). This prevents external attackers from triggering recursive queries
against your resolver.
* Disable recursion on servers that must be authoritative-only (recursion no;) if possible
* If environment allows, reduce cache lifetime (TTL) temporarily to reduce window of
poisoned entries (shorter TTL means forged entries expire sooner). Note: this is disruptive
and should be used carefully.
* Use DNSSEC validation on resolvers (enable validation with a validating resolver or dnssec
enable/dnssec-validation in BIND); while this doesn’t protect all record types, DNSSEC
validation prevents signed zones from being silently replaced by unsigned forged records.
Note: enabling DNSSEC validation requires configuration and trust-anchor setup.
* Use upstream, validated recursive resolvers from trustworthy providers if local resolver
cannot be patched immediately (need to ensure clients are protected).
* Firewall / rate-limit DNS responses from the outside where practical, and monitor for
unusual DNS answer patterns/TTL/unknown authoritative servers.
DDoS Scandals Hit Bangladesh ISP Sector: BTRC Prepares Crackdown
