Hackers have started exploiting an extremely severe vulnerability in a widely used software utility, touching off concerns that the in-the-wild attacks could affect the stability of the Internet.

The attacks are exploiting a denial-of-service bug in all versions of Bind, the most widely used software for translating human-friendly domain names into IP addresses used by servers. As Ars reported last week, the flaw can be exploited with a single command to crash authoritative and recursive domain name system servers and in theory could allow a single person to take down large swaths of the Internet. There's no practical workaround, although some website firewalls can block many exploits. The only way administrators can ensure they don't fall victim is to install a recently published patch

"Because of its severity we've been actively monitoring to see when the exploit would be live," Daniel Cid, founder and CTO of security firm Sucuri, wrote in a blog post published Sunday. "We can confirm that the attacks have begun. DNS is one of the most critical parts of the Internet infrastructure, so having your DNS go down, it also means your e-mail, HTTP, and all other services will be unavailable."

The crashing bug involves the way Bind handles queries related to transaction key records. Administrators who want to know if their servers have been subject to the real-world attacks seen by Sucuri can check logs for strings with "ANY TKEY" in them. Any example from one of the public exploits released looks like this:

Aug 2 10:32:48 dns named[2717]: client a.b.c.d#42212 (foo.bar): view north_america: query: foo.bar ANY TKEY + (x.y.z.zz)

Admins can also look for any type of TKEY request since they aren't common.

Bind is bundled in most versions of Linux. While the update is already available for just about every distribution, admins must manually install it and restart DNS servers to be properly patched. Researchers at Internet Systems Consortium, the developer behind Bind, have more about the vulnerability here.