Haixin Duan

**Name of the Vulnerable Software and Affected Versions** NLnet Labs Unbound versions up to and including 1.24.0 **Description** Unbound is susceptible to domain hijack attacks through the manipulation of DNS responses. Specifically, maliciously crafted NS Resource Record Sets (RRSets) included in replies can cause the resolver to update its delegation information, potentially leading to a zone transfer. An attacker could exploit this by injecting NS RRSets, possibly through packet spoofing or fragmentation attacks, causing Unbound to update its existing NS RRSet data due to the perceived trustworthiness of the injected information. **Recommendations** Update to version 1.24.1 or later.

**Name of the Vulnerable Software and Affected Versions** PowerDNS Recursor versions prior to 5.2.6-0+deb13u1 **Description** Insufficient validation of delegation information could lead to cache pollution in PowerDNS Recursor, a resolving name server. Updates will not be backported to the version of PDNS recursor in the oldstable distribution (bookworm). **Recommendations** Upgrade pdns-recursor packages to version 5.2.6-0+deb13u1. For affected setups, an update to Debian stable/trixie is recommended.

**Name of the Vulnerable Software and Affected Versions** PDNS Recursor versions prior to 5.2.6-0+deb13u1 **Description** Insufficient validation of delegation information could lead to cache pollution in PDNS Recursor, a resolving name server. The changes required to address this are too extensive to backport to the version of PDNS Recursor included in the oldstable distribution (bookworm). **Recommendations** Upgrade pdns-recursor packages to version 5.2.6-0+deb13u1 or later. For affected setups using the oldstable distribution (bookworm), upgrade to Debian stable/trixie.

**Name of the Vulnerable Software and Affected Versions** Apple iOS versions prior to 9.1 Apple OS X versions prior to 10.11.1 **Description** The issue arises from the improper consideration of uppercase-versus-lowercase distinction during cookie parsing in CFNetwork. This allows remote web servers to overwrite cookies. **Recommendations** For Apple iOS versions prior to 9.1, update to version 9.1 or later. For Apple OS X versions prior to 10.11.1, update to version 10.11.1 or later.

**Name of the Vulnerable Software and Affected Versions** ISC BIND 9 versions 9.1.1 through 9.8.1-P1 ISC BIND 9 version 9.7.0 ISC BIND 9 version 9.7.2 **Description** The issue allows remote attackers to trigger continued resolvability of revoked domain names via a "ghost domain names" attack. This occurs because the resolver in ISC BIND 9 overwrites cached server names and TTL values in NS records during the processing of a response to an A record query. The estimated number of potentially affected devices is not specified. However, the issue has been leveraged for DNS tunneling in various campaigns, including those by Darkhydrus, Oilrig, and Cobalt katana, targeting educational institutions, network infrastructure, and cloud environments across APAC, America, EMEA, and Japan. **Recommendations** For ISC BIND 9 versions 9.1.1 through 9.8.1-P1, consider updating to a version that is not affected by this issue. For ISC BIND 9 version 9.7.0, consider updating to a version that is not affected by this issue. For ISC BIND 9 version 9.7.2, consider updating to a version that is not affected by this issue. As a temporary workaround, consider restricting the use of the resolver function to minimize the risk of exploitation.