BIND9 Denial of Service Vulnerability
Summary
DSA-3023-1: bind9 - security update. Affects bind9 versions < 1:9.8.4.dfsg.P1-6+nmu2+deb7u2. Fixed in 1:9.8.4.dfsg.P1-6+nmu2+deb7u2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
BIND9 is a DNS server that provides domain name resolution services. It is widely used in various operating systems and distributions, including Debian 7 (wheezy). BIND9 supports NSEC3-signed zones, which provide enhanced security for DNS queries. However, a vulnerability has been discovered in BIND9 that allows a remote attacker to cause a denial of service (DoS) by sending a specially crafted query to an authoritative name server serving NSEC3-signed zones.
Vulnerability Detail
The vulnerability in BIND9 arises from a flaw in the handling of queries for NSEC3-signed zones. By exploiting this flaw, an attacker can send a malicious query that triggers a crash in the named process, effectively rendering the DNS server unavailable. This vulnerability can be exploited remotely, and it affects BIND9 versions prior to 1:9.8.4.dfsg.P1-6+nmu2+deb7u2 on Debian 7 (wheezy). The impact of this vulnerability is limited to a DoS attack and does not allow for arbitrary code execution or unauthorized access to the system.
How To Fix
Minimum fixed version
1:9.8.4.dfsg.P1-6+nmu2+deb7u2
This is the first release that contains the fix.
sudo apt-get install --only-upgrade bind9Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the provided fix by upgrading the bind9 package to the patched version.
Conclusion
The BIND9 Denial of Service Vulnerability allows a remote attacker to crash a BIND9 DNS server serving NSEC3-signed zones, resulting in a denial of service. To mitigate this vulnerability, it is crucial to upgrade the bind9 package to the patched version. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for bind9 →
FAQ
BIND9 is a DNS server software that provides domain name resolution services.
The vulnerability allows a remote attacker to cause a denial of service (DoS) by crashing the named process of a BIND9 DNS server serving NSEC3-signed zones.
Yes, this vulnerability can be exploited remotely by sending a specially crafted query to the targeted BIND9 DNS server.
No, this vulnerability only allows for a denial of service (DoS) attack and does not enable arbitrary code execution or unauthorized access to the system.
To fix this vulnerability on Debian 7 (wheezy), you should upgrade the bind9 package to version 1:9.8.4.dfsg.P1-6+nmu2+deb7u2 or later using the package manager update command.
Related vulnerabilities
Recent vulnerabilities recorded for bind9.
