Critical Vulnerability in BIND Package: IXFR Malformed Input Causes Process Termination
Summary
ALPINE-CVE-2021-25214: In BIND 9.8.5 -> 9.8.8, 9.9.3 -> 9.11.29, 9.12.0 -> 9.16.13, and versions BIND 9.9.3-S1 -> 9.11.29-S1 and 9.16.8-S1 -> 9.16.13-S1 of BIND 9 Supported Preview Edition, as well as release versions 9.17.0 -> 9.17.11 of the... Affects bind versions < 9.16.15-r0. Fixed in 9.16.15-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
BIND (Berkeley Internet Name Domain) is a widely used DNS server software that enables the resolution of domain names into IP addresses. It is known for its robustness and flexibility, supporting various DNS features and configurations. However, certain versions of BIND are susceptible to vulnerabilities that can compromise the stability of the DNS service, particularly when handling malformed IXFR (Incremental Zone Transfer) requests.
Vulnerability Detail
The vulnerability identified as CVE-2021-25214 affects BIND versions 9.8.5 to 9.8.8, 9.9.3 to 9.11.29, 9.12.0 to 9.16.13, and several other specific versions. When a vulnerable version of the named process receives a malformed IXFR request, it triggers a failed assertion, leading to the termination of the named process. This can result in a denial of service, affecting the availability of DNS services and potentially disrupting network operations.
How To Fix
Minimum fixed version
9.16.15-r0
This is the first release that contains the fix.
sudo apk add --upgrade bindTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can restrict access to the named service to trusted IP addresses only, thereby minimizing the risk of receiving malformed IXFR requests. Additionally, consider implementing rate limiting on incoming requests to further mitigate potential denial of service attacks.
Conclusion
CVE-2021-25214 is a significant vulnerability in the BIND package that can lead to denial of service through malformed IXFR requests. It is crucial for users of affected versions to update to the patched version 9.16.15-r0 or later to ensure the stability and security of their DNS services. Implementing workarounds can provide temporary relief while updates are being planned.
See every vulnerability recorded for bind →
FAQ
CVE-2021-25214 is a vulnerability in BIND that allows a malformed IXFR request to terminate the named process, leading to a denial of service.
Affected versions include BIND 9.8.5 to 9.8.8, 9.9.3 to 9.11.29, and 9.12.0 to 9.16.13, among others.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score for CVE-2021-25214 is 6.5, indicating a medium severity level.
If immediate updates are not possible, consider implementing access restrictions and rate limiting as temporary workarounds to mitigate the risk.
References
Related vulnerabilities
Recent vulnerabilities recorded for bind.
