Critical Vulnerability in BIND Package: CVE-2019-6475 Allows Data Forgery
Summary
ALPINE-CVE-2019-6475: Mirror zones are a BIND feature allowing recursive servers to pre-cache zone data provided by other servers. Affects bind versions < 9.14.7-r0. Fixed in 9.14.7-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
BIND (Berkeley Internet Name Domain) is a widely used DNS server software that enables the translation of human-readable domain names into IP addresses. It is essential for the functioning of the internet, allowing users to access websites using domain names instead of numerical IP addresses. BIND is known for its flexibility and extensive features, including support for DNSSEC, which adds a layer of security to DNS queries. However, certain versions of BIND are vulnerable to a significant security flaw that can be exploited by attackers to inject forged data into DNS responses.
Vulnerability Detail
The vulnerability, identified as CVE-2019-6475, arises from an error in the validity checks for incoming zone data in BIND's mirror zone feature. This feature allows recursive servers to pre-cache zone data from other servers, enhancing performance. However, if an attacker can position themselves in the network path between a recursive server using a mirror zone and a root name server, they can exploit this vulnerability to replace validated zone data with forged data. This could lead to serious consequences, including redirecting users to malicious sites or intercepting sensitive information. The affected versions are BIND 9.14.0 to 9.14.6 and 9.15.0 to 9.15.4, with a CVSS score of 7.5 indicating a high severity level.
How To Fix
Minimum fixed version
9.14.7-r0
This is the first release that contains the fix.
sudo apk add --upgrade bindTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate updating is not feasible, consider disabling the mirror zone feature in BIND's configuration to mitigate the risk of exploitation. This can be done by modifying the named.conf file and removing or commenting out any mirror zone entries.
Conclusion
CVE-2019-6475 is a critical vulnerability in the BIND DNS server software that poses significant risks if left unaddressed. By updating to the patched version and considering workarounds, users can protect their systems from potential exploitation. Regular monitoring and vulnerability management practices, such as those offered by Vulert, can further enhance security.
See every vulnerability recorded for bind →
FAQ
CVE-2019-6475 is a vulnerability in the BIND DNS server software that allows attackers to inject forged DNS data into responses.
The affected versions are BIND 9.14.0 to 9.14.6 and 9.15.0 to 9.15.4.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
An attacker could redirect users to malicious sites or intercept sensitive information by replacing legitimate DNS responses with forged data.
You can update your BIND package to the patched version 9.14.7-r0 using the command 'apk add bind@9.14.7-r0' in Alpine Linux.
References
Related vulnerabilities
Recent vulnerabilities recorded for bind.
