BIND9 DNS Server Denial of Service Vulnerability
Summary
DSA-3094-1: bind9 - security update. Affects bind9 versions < 1:9.8.4.dfsg.P1-6+nmu2+deb7u3. Fixed in 1:9.8.4.dfsg.P1-6+nmu2+deb7u3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
BIND (Berkeley Internet Name Domain) is a widely used open-source DNS server software. It provides the functionality to resolve domain names to IP addresses and vice versa. BIND is a critical component of the internet infrastructure and is used by many organizations and service providers. However, a vulnerability has been discovered in BIND that can be exploited to cause a denial of service (DoS) attack.
Vulnerability Detail
The vulnerability in BIND9 allows an attacker to exploit an oversight in the code used to follow delegations in the Domain Name Service. By using maliciously-constructed zones or a rogue server, the attacker can trigger BIND to issue unlimited queries in an attempt to follow the delegation. This can lead to resource exhaustion and result in a denial of service, potentially causing the termination of the named server process. The vulnerability is tracked as CVE-2014-8500.
How To Fix
Minimum fixed version
1:9.8.4.dfsg.P1-6+nmu2+deb7u3
This is the first release that contains the fix.
sudo apt-get install --only-upgrade bind9Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the provided fix by upgrading the bind9 package to the patched version.
Conclusion
The BIND9 DNS server vulnerability allows an attacker to exploit an oversight in the delegation-following code, leading to a denial of service. It is crucial to upgrade the bind9 package to the patched version to mitigate this vulnerability. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for bind9 →
FAQ
BIND (Berkeley Internet Name Domain) is an open-source DNS server software that translates domain names to IP addresses and vice versa.
The vulnerability allows an attacker to cause a denial of service by exploiting an oversight in BIND's delegation-following code. This can lead to resource exhaustion and potentially terminate the named server process.
To fix this vulnerability, upgrade the bind9 package to version 1:9.8.4.dfsg.P1-6+nmu2+deb7u3 or later.
No, there is no known workaround for this vulnerability. It is crucial to apply the provided fix by upgrading the bind9 package.
You can find more information about this vulnerability in the Debian Security Advisory DSA-3094-1.
Related vulnerabilities
Recent vulnerabilities recorded for bind9.
