Lior Shafir

The issue in the DNS protocol allows malicious parties to use recursive DNS services to attack third-party authoritative name servers, resulting in degraded performance. This is triggered by random subdomains in the NSDNAME in NS records. The attack uses a crafted reply by an authoritative name server to amplify the resulting traffic between the recursive and other authoritative name servers.

The issue is related to Insufficient Control of Network Message Volume, also known as an "NXNSAttack" issue. This is triggered by random subdomains in the NSDNAME in NS records.

The issue is related to a lack of effective limitation on the number of fetches performed when processing referrals, which can cause a recursing server to issue a large number of fetches. This can lead to degradation of the server's performance and potentially be exploited in a reflection attack with a high amplification factor. The vulnerability can be exploited by a remote attacker to trigger an assertion failure in tsig.c, causing a denial of service.