In BIND 9.14.0 -> 9.16.5, 9.17.0 -> 9.17.3, If a server is configured with both QNAME minimization and 'forward first' then an attacker who can send queries to it may be able to trigger the condition that will cause the server to crash. Servers that 'forward only' are not affected.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | alpine-linux-upgrade-bind | Aug 22, 2024 | Aug 21, 2020 | |
| Debian | debian-upgrade-bind9 | Jul 30, 2024 | Aug 21, 2020 | |
| Dns Bind | upgrade-isc-bind-latest | Sep 8, 2020 | Aug 21, 2020 | |
| Gentoo Linux | gentoo-linux-upgrade-net-dns-bind | Aug 31, 2020 | Aug 21, 2020 | |
| Oracle Solaris | oracle-solaris-11-4-upgrade-network-dns-bind-9-11-22-0-0-11-4-26-0-1-75-1oracle-solaris-11-4-upgrade-service-network-dns-bind-9-11-22-0-0-11-4-26-0-1-75-1 | Jan 19, 2021 | Aug 21, 2020 | |
| Suse | — | suse-upgrade-bindsuse-upgrade-bind-chrootenvsuse-upgrade-bind-develsuse-upgrade-bind-devel-32bitsuse-upgrade-bind-docsuse-upgrade-bind-utilssuse-upgrade-libbind9-1600suse-upgrade-libbind9-1600-32bitsuse-upgrade-libdns1605suse-upgrade-libdns1605-32bitsuse-upgrade-libirs-develsuse-upgrade-libirs1601suse-upgrade-libirs1601-32bitsuse-upgrade-libisc1606suse-upgrade-libisc1606-32bitsuse-upgrade-libisccc1600suse-upgrade-libisccc1600-32bitsuse-upgrade-libisccfg1600suse-upgrade-libisccfg1600-32bitsuse-upgrade-libns1604suse-upgrade-libns1604-32bitsuse-upgrade-libuv-develsuse-upgrade-libuv1suse-upgrade-libuv1-32bitsuse-upgrade-python3-bindsuse-upgrade-sysuser-shadowsuse-upgrade-sysuser-tools | Oct 14, 2020 | Aug 21, 2020 |
| Ubuntu | ubuntu-upgrade-bind9 | Aug 22, 2020 | Aug 21, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub