An attacker who can send to and receive from an authoritative DNS server may be able to circumvent TSIG authentication of AXFR requests via a carefully constructed request packet.
A server that relies solely on TSIG keys for protection with no other ACL protection could be manipulated into:
– providing an AXFR of a zone to an unauthorized recipient
– accepting bogus Notify packets
Furthermore, if the attacker has knowledge of a valid TSIG key name for the zone and service being targeted, then it may be possible to manipulate BIND into accepting an unauthorized dynamic update.
This would effectively allow the attacker to inject arbitrary malicious content into the DNS server’s master zones.
An unauthorized AXFR (full zone transfer) permits an attacker to view the entire contents of a zone. Protection of zone contents is often a commercial or business requirement.
If accepted, a Notify sets the zone refresh interval to ‘now’.
If there is not already a refresh cycle in progress then named will initiate one by asking for the SOA RR from its list of masters.
If there is already a refresh cycle in progress, then named will queue the new refresh request.
If there is already a queued refresh request, the new Notify will be discarded.
Bogus notifications can’t be used to force a zone transfer from a malicious server, but could trigger a high rate of zone refresh cycles.