BIND 9.20.29 / 9.21.26 Released: Unauthenticated DoH Crash Flaw — Detection, Patching and Hardening Guide

---
title: BIND named Daemon Crash or Unexpected Termination
id: 3f9b1c44-8a2e-4d5b-9c71-6e2f4a8b9d10
status: experimental
description: Detects abnormal termination, assertion failures, or fatal errors in the BIND named daemon, consistent with exploitation of remote crash vulnerabilities such as the invalid SIG(0) over DoH flaw fixed in 9.20.29/9.21.26.
references:
  - https://www.isc.org/blogs/
author: Security Arsenal
date: 2026/09/17
tags:
  - attack.impact
  - attack.t1499
logsource:
  product: linux
  service: named
detection:
  selection:
    - 'assertion failure'
    - 'fatal'
    - 'aborting'
    - 'exiting (due to fatal error)'
    - 'unexpected error'
    - 'general: critical'
  condition: selection
falsepositives:
  - Legitimate misconfiguration at startup causing named to exit
level: high
---
title: SIG(0) Processing Errors on BIND DoH Listener
id: 8c2d5e61-3f47-4a9b-b5e2-1a6d8c3f7e24
status: experimental
description: Detects SIG(0) verification or processing errors in BIND query logs, which may indicate crafted requests targeting the SIG(0) parsing path reachable over DNS-over-HTTPS.
references:
  - https://www.isc.org/blogs/
author: Security Arsenal
date: 2026/09/17
tags:
  - attack.impact
  - attack.t1499.004
logsource:
  product: linux
  service: named
detection:
  selection:
    - 'SIG(0)'
    - 'sig0'
    - 'invalid sig'
    - 'bad signature'
  condition: selection
falsepositives:
  - Misconfigured dynamic update clients using SIG(0) signing
level: medium
---
title: named Process Spawned by Non-init Parent After Crash
id: 5e1a7b92-4d63-4c8f-a291-7b3e9f2c6d48
status: experimental
description: Detects the named daemon being restarted by an unexpected parent process or in rapid succession, which may indicate a crash loop from repeated remote exploitation attempts.
references:
  - https://attack.mitre.org/techniques/T1499/
author: Security Arsenal
date: 2026/09/17
tags:
  - attack.impact
  - attack.t1499
logsource:
  category: process_creation
  product: linux
detection:
  selection_image:
    Image|endswith:
      - '/named'
  filter_parents:
    ParentImage|endswith:
      - '/systemd'
      - '/init'
      - '/named-checkconf'
  condition: selection_image and not filter_parents
falsepositives:
  - Manual restarts by administrators from an interactive shell
  - Container orchestrators with non-standard init systems
level: medium

// Hunt for BIND named crash indicators and DoH-targeted abuse in Sentinel
// Assumes named logs are ingested via Syslog/CEF from DNS servers
Syslog
| where TimeGenerated > ago(24h)
| where ProcessName =~ "named" or SyslogMessage has "named["
| where SyslogMessage has_any ("assertion failure", "fatal", "aborting", "exiting (due to fatal error)", "sig0", "SIG(0)")
| project TimeGenerated, Computer, ProcessName, SeverityLevel, SyslogMessage
| order by TimeGenerated desc;
// Correlate: spike in HTTPS connections to DNS servers from single sources (DoH probing/crash attempts)
CommonSecurityLog
| where TimeGenerated > ago(24h)
| where DestinationPort == 443
| summarize ConnectionCount = count(), DistinctDestinations = dcount(DestinationIP) by SourceIP, bin(TimeGenerated, 5m)
| where ConnectionCount > 500
| order by ConnectionCount desc;
// Identify all DNS servers running named to scope the exposure inventory
Syslog
| where ProcessName =~ "named"
| summarize LastSeen = max(TimeGenerated) by Computer
| order by LastSeen desc;

-- Hunt: enumerate BIND named instances, listeners, and recent crash artifacts on Linux DNS servers
SELECT Pid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE Name =~ 'named'
   OR CommandLine =~ '/named'

-- Check which ports named is listening on (443 exposure = DoH enabled = urgent patch target)
SELECT Pid, Name, Laddr, Status
FROM netstat()
WHERE Name =~ 'named'
   AND Status =~ 'LISTEN'

-- Look for core dumps from repeated named crashes (exploitation artifact)
SELECT FullPath, Size, Mtime
FROM glob(globs=['/var/lib/systemd/coredump/*named*', '/var/crash/*named*', '/tmp/core*named*'])
ORDER BY Mtime DESC

#!/usr/bin/env bash
# BIND exposure check and remediation helper — run as root on each DNS server
set -euo pipefail

echo "=== [1] Installed BIND version ==="
if command -v named >/dev/null 2>&1; then
  named -v
  named -V | head -n 3
else
  echo "named binary not found on this host."
fi

# Flag vulnerable builds: anything below 9.20.29 (9.20 branch) or 9.21.26 (9.21 branch)
VER=$(named -v 2>/dev/null | awk '{print $2}' | cut -d- -f1 || echo "unknown")
echo "Detected version: $VER"
case "$VER" in
  9.20.29|9.21.26) echo "STATUS: PATCHED (fixed release installed)" ;;
  9.20.3*|9.21.2[6-9]*) echo "STATUS: likely patched — verify against ISC advisory" ;;
  9.20.*|9.21.*|9.18.*|9.16.*) echo "STATUS: VULNERABLE — upgrade required" ;;
  *) echo "STATUS: unknown — check vendor backport notices (distro packages may carry patched builds with older version strings)" ;;
esac

echo "=== [2] DoH exposure check (port 443 listener) ==="
ss -tlnp 2>/dev/null | grep -E 'named|:443' || echo "No HTTPS/DoH listener detected on named."

echo "=== [3] named.conf DoH directives ==="
grep -nE 'tls|http|doh|listen-on.*443' /etc/named.conf /etc/bind/named.conf* 2>/dev/null || echo "No DoH/TLS directives found in config files."

echo "=== [4] Recent named crash indicators in logs ==="
journalctl -u named --since "7 days ago" 2>/dev/null | grep -iE 'assertion|fatal|abort|sig' | tail -n 20 || true
grep -iE 'assertion failure|fatal|aborting' /var/log/named/*.log /var/log/messages /var/log/syslog 2>/dev/null | tail -n 20 || true

echo "=== [5] Apply vendor patch (choose your distro path) ==="
echo "# RHEL/Rocky/Alma:   dnf update bind && systemctl restart named"
echo "# Debian/Ubuntu:     apt-get update && apt-get install --only-upgrade bind9 && systemctl restart named"
echo "# ISC source builds: upgrade to 9.20.29 (ESV) or 9.21.26 (stable) from https://www.isc.org/download/"

echo "=== [6] TEMPORARY MITIGATION if patching is delayed ==="
echo "# If DoH is not business-critical, disable the HTTPS listener by removing the"
echo "# 'tls'/'http' listen blocks from named.conf, then run: named-checkconf && rndc reconfig"
echo "# If DoH IS required, restrict reachability with a firewall allowlist:"
echo "#   nft add rule inet filter input tcp dport 443 ip saddr {TRUSTED_NETS} accept"
echo "#   nft add rule inet filter input tcp dport 443 drop"

echo "=== [7] Ensure auto-restart to blunt DoS impact (mitigation, not a fix) ==="
systemctl show named -p Restart 2>/dev/null || echo "Consider: systemctl edit named -> [Service] Restart=on-failure, RestartSec=5"

echo "Done. Re-run after patching to confirm fixed version is active: named -v"