DNS: Short Time To Live Response
This signature detects DNS responses with very short Time To Live (TTL) values. This is not normal for DNS and is indicative of DNS tunneling. Dropping these packets will usually block the tunnel.
Extended Description
The prefetch implementation in named in ISC BIND 9.10.0, when a recursive nameserver is enabled, allows remote attackers to cause a denial of service (REQUIRE assertion failure and daemon exit) via a DNS query that triggers a response with unspecified attributes.
Affected Products
Isc bind
Short Name
DNS:TUNNEL:SHORT-TTL
Severity
Minor
Recommended
False
Recommended Action
None
Category
DNS
Keywords
CVE-2014-3214 Live Response Short Time To
Release Date
12/04/2013
Supported Platforms
srx-branch-12.3
srx-19.3
srx-branch-19.3
vsrx3bsd-19.2
srx-branch-19.4
vsrx-19.4
mx-12.3
mx-19.4
vmx-19.4
mx-19.3
vsrx3bsd-19.4
srx-19.4
vsrx-12.3
vmx-19.3
vsrx-19.2
srx-12.3
Sigpack Version
3761
False Positive
Unknown
Vendors
Isc
CVSS Score
5.0