Detections
Analytics
DNS Server Cache Snooping Remote Information Disclosure
medium Nessus Plugin ID 12217
Language:
Synopsis
The remote DNS server is vulnerable to cache snooping attacks.Description
The remote DNS server responds to queries for third-party domains that do not have the recursion bit set.This may allow a remote attacker to determine which domains have recently been resolved via this name server, and therefore which hosts have been recently visited.
For instance, if an attacker was interested in whether your company utilizes the online services of a particular financial institution, they would be able to use this attack to build a statistical model regarding company usage of that financial institution. Of course, the attack can also be used to find B2B partners, web-surfing patterns, external mail servers, and more.
Note: If this is an internal DNS server not accessible to outside networks, attacks would be limited to the internal network. This may include employees, consultants and potentially users on a guest network or WiFi connection if supported.
Solution
Contact the vendor of the DNS software for a fix.See Also
Plugin Details
Severity: Medium
ID: 12217
File Name: dns_cache_sniffing.nasl
Version: 1.26
Type: remote
Family: DNS
Published: 4/27/2004
Updated: 4/7/2020
Supported Sensors: Nessus
Risk Information
CVSS Score Rationale: Score from a more in depth analysis done by tenable
CVSS v2
Risk Factor: Medium
Base Score: 5
Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N
CVSS Score Source: manual
CVSS v3
Risk Factor: Medium
Base Score: 5.3
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Vulnerability Information
Required KB Items: DNS/udp/53, dns_server/version