CAPEC-142: DNS Cache Poisoning

Description
A domain name server translates a domain name (such as www.example.com) into an IP address that Internet hosts use to contact Internet resources. An adversary modifies a public DNS cache to cause certain names to resolve to incorrect addresses that the adversary specifies. The result is that client applications that rely upon the targeted cache for domain name resolution will be directed not to the actual address of the specified domain name but to some other address. Adversaries can use this to herd clients to sites that install malware on the victim's computer or to masquerade as part of a Pharming attack.
Extended Description

Many applications allow users to send email messages by filling in fields. For example, a web site may have a link to "share this site with a friend" where the user provides the recipient's email address and the web application fills out all the other fields, such as the subject and body. In this pattern, an adversary adds header and body information to an email message by injecting additional content in an input field used to construct a header of the mail message. This attack takes advantage of the fact that RFC 822 requires that headers in a mail message be separated by a carriage return. As a result, an adversary can inject new headers or content simply by adding a delimiting carriage return and then supplying the new heading and body information. This attack will not work if the user can only supply the message body since a carriage return in the body is treated as a normal character.

Severity :

High

Possibility :

High

Type :

Detailed
Relationships with other CAPECs

This table shows the other attack patterns and high level categories that are related to this attack pattern.

CAPEC-89: Pharming Pharming CAPEC-141: Cache Poisoning Cache Poisoning
Prerequisites

This table shows the other attack patterns and high level categories that are related to this attack pattern.

  • A DNS cache must be vulnerable to some attack that allows the adversary to replace addresses in its lookup table.Client applications must trust the corrupted cashed values and utilize them for their domain name resolutions.
Skills required

This table shows the other attack patterns and high level categories that are related to this attack pattern.

  • Medium To overwrite/modify targeted DNS cache
Taxonomy mappings

Mappings to ATT&CK, OWASP and other frameworks.

ATTACK | Compromise Infrastructure: DNS Server
Resources required

The adversary must have the resources to modify the targeted cache. In addition, in most cases the adversary will wish to host the sites to which users will be redirected, although in some cases redirecting to a third party site will accomplish the adversary's goals.

Related CWE

A Related Weakness relationship associates a weakness with this attack pattern. Each association implies a weakness that must exist for a given attack to be successful.

CWE-345: Insufficient Verification of Data Authenticity

CWE-346: Origin Validation Error

CWE-348: Use of Less Trusted Source

CWE-349: Acceptance of Extraneous Untrusted Data With Trusted Data

CWE-350: Reliance on Reverse DNS Resolution for a Security-Critical Action

Visit http://capec.mitre.org/ for more details.