Critical Race Condition Vulnerability in BIND Package
Summary
ALPINE-CVE-2019-6471: A race condition which may occur when discarding malformed packets can result in BIND exiting due to a REQUIRE assertion failure in dispatch.c. Affects bind versions < 9.14.3-r0. Fixed in 9.14.3-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
BIND (Berkeley Internet Name Domain) is a widely used DNS server software that provides a robust and flexible solution for managing domain name resolution. It is essential for translating human-readable domain names into IP addresses. BIND is known for its reliability and extensive features, making it a cornerstone of internet infrastructure. However, it is susceptible to vulnerabilities that can compromise its stability and security, such as the race condition issue described in this report.
Vulnerability Detail
A race condition may occur when BIND discards malformed packets, leading to an unexpected exit due to a REQUIRE assertion failure in the dispatch.c file. This vulnerability affects multiple versions of BIND, specifically versions 9.11.0 through 9.11.7, 9.12.0 through 9.12.4-P1, and 9.14.0 through 9.14.2. Additionally, all releases of the BIND 9.13 development branch and version 9.15.0 of the BIND 9.15 development branch are impacted. The ramifications of this vulnerability include potential service disruption and denial of service, which can severely affect DNS resolution services.
How To Fix
Minimum fixed version
9.14.3-r0
This is the first release that contains the fix.
sudo apk add --upgrade bindTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider implementing strict input validation to filter out malformed packets before they reach the BIND server. This can help mitigate the risk of triggering the race condition until a proper update can be applied.
Conclusion
The race condition vulnerability in the BIND package poses significant risks to DNS services, potentially leading to service disruptions. It is essential to update to the patched versions to protect against this vulnerability. Utilizing tools like Vulert can help monitor and manage vulnerabilities effectively.
See every vulnerability recorded for bind →
FAQ
The CVSS score for this vulnerability is 5.9, indicating a medium severity level.
Affected versions include BIND 9.11.0 to 9.11.7, 9.12.0 to 9.12.4-P1, and 9.14.0 to 9.14.2, along with all releases of the BIND 9.13 development branch and version 9.15.0.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without requiring access to the code.
The vulnerability can lead to service disruptions and denial of service, impacting DNS resolution services and potentially affecting users' access to websites.
Implementing strict input validation to filter out malformed packets can help mitigate the risk of triggering the race condition until a proper update is applied.
References
Related vulnerabilities
Recent vulnerabilities recorded for bind.
