BIND9 DNS Server Crash Vulnerability
Summary
DSA-3162-1: bind9 - security update. Affects bind9 versions < 1:9.8.4.dfsg.P1-6+nmu2+deb7u4. Fixed in 1:9.8.4.dfsg.P1-6+nmu2+deb7u4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
BIND9 is a DNS server software that provides domain name resolution services. It is widely used in various operating systems, including Debian 7. BIND9 supports DNSSEC (Domain Name System Security Extensions) for secure DNS operations. However, a vulnerability has been discovered in BIND9 that can cause the server to crash when processing an invalid DNSSEC key rollover.
Vulnerability Detail
The vulnerability in BIND9 arises when an invalid DNSSEC key rollover is encountered. This can occur due to an error on the zone operator's part or due to interference with network traffic by an attacker. The issue affects configurations with the directives 'dnssec-validation auto;' or 'dnssec-lookaside auto;' enabled. When triggered, the vulnerability can lead to a denial of service (DoS) condition, causing the DNS server to crash and become unresponsive.
How To Fix
Minimum fixed version
1:9.8.4.dfsg.P1-6+nmu2+deb7u4
This is the first release that contains the fix.
sudo apt-get install --only-upgrade bind9Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. However, administrators can mitigate the risk by disabling the 'dnssec-validation' and 'dnssec-lookaside' directives in the BIND9 configuration if they are not required for their environment. This can be done by modifying the configuration file and commenting out or removing the respective lines.
Conclusion
The BIND9 DNS server vulnerability can result in a DoS condition when processing invalid DNSSEC key rollovers. It is crucial to upgrade the bind9 package to the recommended version to mitigate the risk and ensure the stability and availability of DNS resolution services. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for bind9 →
FAQ
BIND9 is a DNS server software that provides domain name resolution services.
DNSSEC (Domain Name System Security Extensions) is a set of extensions to DNS that provide authentication and integrity for DNS responses.
This vulnerability can cause the BIND9 DNS server to crash when processing an invalid DNSSEC key rollover, resulting in a denial of service (DoS) condition.
The vulnerability can lead to a DoS condition, rendering the DNS server unresponsive and impacting the availability of DNS resolution services.
To fix this vulnerability, upgrade the bind9 package to version 1:9.8.4.dfsg.P1-6+nmu2+deb7u4 or later.
Related vulnerabilities
Recent vulnerabilities recorded for bind9.
