Critical Vulnerability in BIND Package: Improper Zone Transfer Controls
Summary
ALPINE-CVE-2019-6465: Controls for zone transfers may not be properly applied to Dynamically Loadable Zones (DLZs) if the zones are writable Versions affected: BIND 9.9.0 -> 9.10.8-P1, 9.11.0 -> 9.11.5-P2, 9.12.0 -> 9.12.3-P2, and versions 9.... Affects bind versions < 9.12.3_p4-r0. Fixed in 9.12.3_p4-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
BIND (Berkeley Internet Name Domain) is a widely used DNS (Domain Name System) software suite that provides a method for translating domain names into IP addresses. It is essential for the functioning of the internet, allowing users to access websites using human-readable names. BIND is known for its flexibility and extensive features, but it has also been the target of various vulnerabilities over the years. This specific vulnerability, identified as CVE-2019-6465, affects multiple versions of BIND and is related to improper application of zone transfer controls, particularly for Dynamically Loadable Zones (DLZs).
Vulnerability Detail
CVE-2019-6465 arises from the failure to properly enforce zone transfer controls on writable Dynamically Loadable Zones (DLZs). This vulnerability can allow unauthorized access to zone data, potentially leading to data leakage or manipulation. The affected versions include BIND 9.9.0 through 9.10.8-P1, 9.11.0 through 9.11.5-P2, and 9.12.0 through 9.12.3-P2, among others. The implications of this vulnerability are significant, as it can compromise the integrity and confidentiality of DNS data, impacting both service providers and end-users.
How To Fix
Minimum fixed version
9.12.3_p4-r0
This is the first release that contains the fix.
sudo apk add --upgrade bindTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can restrict access to the zone transfer functionality by configuring your BIND settings to limit which IP addresses can perform zone transfers. This can be done by modifying the 'allow-transfer' directive in your BIND configuration file (named.conf) to include only trusted IP addresses.
Conclusion
CVE-2019-6465 is a critical vulnerability affecting various versions of the BIND package, which can lead to unauthorized access to DNS data. It is crucial for users to update their installations to the patched version to ensure the security and integrity of their DNS services. Utilizing tools like Vulert can further enhance your ability to monitor and manage vulnerabilities in your software.
See every vulnerability recorded for bind →
FAQ
CVE-2019-6465 is a vulnerability in the BIND DNS software that allows improper application of zone transfer controls for writable Dynamically Loadable Zones.
You can check your BIND version against the affected versions listed in the vulnerability details. Additionally, using tools like Vulert can help identify vulnerabilities in your software.
The vulnerability can lead to unauthorized access to DNS zone data, potentially resulting in data leakage or manipulation, which can severely impact DNS integrity.
Yes, a patch is available. Users should update to BIND version 9.12.3_p4-r0 or later to mitigate the vulnerability.
Vulert allows you to monitor open-source vulnerabilities in your software using a manifest file like package-lock.json. You can check your application for vulnerabilities without needing to sign up.
References
Related vulnerabilities
Recent vulnerabilities recorded for bind.
