An attacker who is able to send and receive messages to an authoritative DNS server and who has knowledge of a valid TSIG key name may be able to circumvent TSIG authentication of AXFR requests via a carefully constructed request packet. A server that relies solely on TSIG keys for protection with no other ACL protection could be manipulated into: providing an AXFR of a zone to an unauthorized recipient or accepting bogus NOTIFY packets. Affects BIND 9.4.0->9.8.8, 9.9.0->9.9.10-P1, 9.10.0->9.10.5-P1, 9.11.0->9.11.1-P1, 9.9.3-S1->9.9.10-S2, 9.10.5-S1->9.10.5-S2.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade bind | Jan 16, 2019 | Jan 16, 2019 |
| Amazon_linux | — | Upgrade bind | Jul 25, 2017 | Jun 29, 2017 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Jan 16, 2019 |
| Centos_linux | — | Upgrade bind-pkcs11-utilsUpgrade bind-libs-liteUpgrade bind-utilsUpgrade bind-lite-develUpgrade bind-chrootUpgrade bind-pkcs11-libsUpgrade bind-pkcs11-develUpgrade bind-sdb-chrootUpgrade bind-libsUpgrade bind-sdbUpgrade bindUpgrade bind-pkcs11Upgrade bind-licenseUpgrade bind-develUpgrade bind-debuginfo | Jul 6, 2017 | Jun 29, 2017 |
| Debian | — | Upgrade bind9 | Jul 9, 2017 | Jun 29, 2017 |
| Dns Bind | — | Upgrade ISC BIND to latest version | Jul 4, 2017 | Jul 4, 2017 |
| F5 Big Ip | — | Update F5 BIG-IP to the latest version | Jun 17, 2026 | Jun 30, 2017 |
| Hpux | — | Update NameService to the latest version | Nov 9, 2017 | Oct 7, 2017 |
| Huawei Euleros 2_0_sp1 | — | Upgrade bind-libsUpgrade bind-chrootUpgrade bind-utilsUpgrade bind-libs-liteUpgrade bindUpgrade bind-license | Nov 30, 2017 | Jun 29, 2017 |
| Huawei Euleros 2_0_sp2 | — | Upgrade bind-libsUpgrade bind-pkcs11-libsUpgrade bindUpgrade bind-licenseUpgrade bind-pkcs11Upgrade bind-chrootUpgrade bind-pkcs11-utilsUpgrade bind-libs-liteUpgrade bind-utils | Nov 30, 2017 | Jun 29, 2017 |
| Ibm Aix | — | Apply the fix or workaround for bind_advisory16 | Nov 2, 2017 | Nov 2, 2017 |
| Oracle Solaris | — | Upgrade service/network/dns/bind to version 9.10.5.0.3-0.175.3.29.0.3.0 on Solaris 11.3Upgrade network/dns/bind to version 9.10.5.0.3-0.175.3.29.0.3.0 on Solaris 11.3 | Feb 22, 2018 | Feb 22, 2018 |
| Oracle_linux | — | Upgrade bind-licenseUpgrade bind-pkcs11-develUpgrade bind-pkcs11-libsUpgrade bind-sdbUpgrade bind-sdb-chrootUpgrade bindUpgrade bind-libs-liteUpgrade bind-libsUpgrade bind-lite-develUpgrade bind-chrootUpgrade bind-develUpgrade bind-pkcs11-utilsUpgrade bind-utilsUpgrade bind-pkcs11 | Jul 5, 2017 | Jun 29, 2017 |
| Redhat_linux | — | Upgrade bind-libsUpgrade bindUpgrade bind-pkcs11-libsUpgrade bind-develNo solution existsUpgrade bind-libs-liteUpgrade bind-licenseUpgrade bind-chrootUpgrade bind-pkcs11-utilsUpgrade bind-debuginfoUpgrade bind-pkcs11Upgrade bind-sdb-chrootUpgrade bind-utilsUpgrade bind-sdbUpgrade bind-lite-develUpgrade bind-pkcs11-devel | Jul 5, 2017 | Jun 29, 2017 |
| Suse | — | Upgrade libisccc160Upgrade bind-chrootenvUpgrade libirs-develUpgrade libisc166-32bitUpgrade python-bindUpgrade bind-devel-32bitUpgrade bind-develUpgrade bind-libs-32bitUpgrade bind-utilsUpgrade python3-bindUpgrade libisc166Upgrade libirs160Upgrade libdns1605Upgrade bindUpgrade bind-libs-x86Upgrade libbind9-160Upgrade libisccfg1600Upgrade libisccfg160Upgrade libdns169Upgrade libirs1601Upgrade bind-libsUpgrade liblwres160Upgrade libns1604Upgrade bind-docUpgrade libisc1606Upgrade libisccc1600Upgrade libbind9-1600 | Jul 1, 2017 | Jun 29, 2017 |
| Ubuntu | — | Upgrade bind9 | Jul 1, 2017 | Jun 29, 2017 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub