In BIND 9.14.0 -> 9.16.5, 9.17.0 -> 9.17.3, If a server is configured with both QNAME minimization and 'forward first' then an attacker who can send queries to it may be able to trigger the condition that will cause the server to crash. Servers that 'forward only' are not affected.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade bind | Aug 22, 2024 | Aug 21, 2020 |
| Debian | — | Upgrade bind9 | Jul 30, 2024 | Aug 21, 2020 |
| Dns Bind | — | Upgrade ISC BIND to latest version | Sep 8, 2020 | Aug 21, 2020 |
| Gentoo Linux | — | Upgrade net-dns/bind. | Aug 31, 2020 | Aug 21, 2020 |
| Oracle Solaris | — | Upgrade network/dns/bind to version 9.11.22.0.0-11.4.26.0.1.75.1 on Solaris 11.4Upgrade service/network/dns/bind to version 9.11.22.0.0-11.4.26.0.1.75.1 on Solaris 11.4 | Jan 19, 2021 | Aug 21, 2020 |
| Suse | — | Upgrade libisccfg1600Upgrade bindUpgrade bind-devel-32bitUpgrade libisccc1600-32bitUpgrade libirs-develUpgrade bind-chrootenvUpgrade libisccc1600Upgrade sysuser-toolsUpgrade bind-utilsUpgrade libisccfg1600-32bitUpgrade libns1604-32bitUpgrade sysuser-shadowUpgrade libdns1605Upgrade bind-develUpgrade libirs1601Upgrade libuv1-32bitUpgrade python3-bindUpgrade libbind9-1600Upgrade libuv1Upgrade libns1604Upgrade libbind9-1600-32bitUpgrade bind-docUpgrade libisc1606-32bitUpgrade libuv-develUpgrade libisc1606Upgrade libdns1605-32bitUpgrade libirs1601-32bit | Oct 14, 2020 | Aug 21, 2020 |
| Ubuntu | — | Upgrade bind9 | Aug 22, 2020 | Aug 21, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub