Critical Assertion Failure in BIND Package Due to nxdomain-redirect Feature
Summary
ALPINE-CVE-2019-6467: A programming error in the nxdomain-redirect feature can cause an assertion failure in query.c if the alternate namespace used by nxdomain-redirect is a descendant of a zone that is served locally. Affects bind versions < 9.14.1-r0. Fixed in 9.14.1-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
BIND (Berkeley Internet Name Domain) is a widely used DNS (Domain Name System) software that provides a robust and flexible solution for managing domain names and their associated IP addresses. It is essential for the functioning of the internet, allowing users to access websites using human-readable domain names instead of numerical IP addresses. The package is known for its reliability and extensive features, but it is also susceptible to vulnerabilities that can compromise its security and functionality. The vulnerability in question arises from a programming error in the nxdomain-redirect feature, which can lead to an assertion failure under specific configurations.
Vulnerability Detail
The vulnerability, identified as CVE-2019-6467, is caused by a programming error in the nxdomain-redirect feature of BIND. This issue can lead to an assertion failure in the query.c file if the alternate namespace used by nxdomain-redirect is a descendant of a zone that is served locally. This scenario is most likely to occur when the server performs NXDOMAIN redirection for recursive clients while also serving a local copy of the root zone or utilizing mirroring to provide the root zone. The affected versions include BIND 9.12.0 through 9.12.4 and 9.14.0, as well as all releases in the 9.13 development branch. The CVSS score for this vulnerability is 7.5, indicating a high severity level.
How To Fix
Minimum fixed version
9.14.1-r0
This is the first release that contains the fix.
sudo apk add --upgrade bindTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate patching is not feasible, consider disabling the nxdomain-redirect feature in your BIND configuration to mitigate the risk until the package can be updated. This can be done by commenting out or removing the relevant configuration lines in the named.conf file.
Conclusion
In summary, CVE-2019-6467 is a critical vulnerability in the BIND package that can lead to assertion failures due to a programming error in the nxdomain-redirect feature. It is crucial for users to update their BIND installations to the patched versions to mitigate the risk of exploitation. Additionally, utilizing tools like Vulert can help monitor and manage open-source vulnerabilities effectively.
See every vulnerability recorded for bind →
FAQ
CVE-2019-6467 is a vulnerability in the BIND DNS software that can cause an assertion failure due to a programming error in the nxdomain-redirect feature.
The affected versions include BIND 9.12.0 through 9.12.4, 9.14.0, and all releases in the 9.13 development branch.
Exploitation of this vulnerability can lead to assertion failures, which may disrupt DNS services and impact the availability of websites relying on the affected BIND server.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without requiring any signup.
The CVSS score for CVE-2019-6467 is 7.5, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for bind.
