DNSSEC validation does not sufficiently distinguish between NODATA respones and positive responses with wildcard expansion. If a query is made that should result in a NODATA response, and the zone has records with wildcard names, it is possible for an attacker to combine an NSEC3 record matching the query name, the record with a wildcard name, and its signature into a bogus positive response that will be accepted by DNSSEC validation. If the query name is proven to exist, then wildcard expansion should not be performed, and an answer section with a wildcard-expanded positive response should not be accepted.
qifan-sailboat Reporter
DNSSEC validation does not sufficiently distinguish between NODATA respones and positive responses with wildcard expansion. If a query is made that should result in a NODATA response, and the zone has records with wildcard names, it is possible for an attacker to combine an NSEC3 record matching the query name, the record with a wildcard name, and its signature into a bogus positive response that will be accepted by DNSSEC validation. If the query name is proven to exist, then wildcard expansion should not be performed, and an answer section with a wildcard-expanded positive response should not be accepted.