BIND9 Denial of Service Vulnerability
Summary
DSA-3304-1: bind9 - security update. Affects bind9 versions < 1:9.8.4.dfsg.P1-6+nmu2+deb7u5. Fixed in 1:9.8.4.dfsg.P1-6+nmu2+deb7u5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
BIND9 is a DNS server software package that provides domain name resolution services. It is widely used across various operating systems and is a critical component of the internet infrastructure. The vulnerability in BIND9 allows a remote attacker to cause a denial of service (DoS) by exploiting a flaw in the server's handling of specially crafted DNS queries.
Vulnerability Detail
The vulnerability in BIND9 arises from a failure to handle certain DNS queries properly. When a validating resolver queries a zone containing specifically constructed contents, it can lead to an assertion failure in the resolver, causing it to terminate unexpectedly. This results in a denial of service to clients relying on the resolver. An attacker with the ability to send malicious DNS queries to a vulnerable BIND9 server can exploit this vulnerability to disrupt DNS resolution services and potentially impact the availability of affected systems.
How To Fix
Minimum fixed version
1:9.8.4.dfsg.P1-6+nmu2+deb7u5
This is the first release that contains the fix.
sudo apt-get install --only-upgrade bind9Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is necessary to apply the provided fix by upgrading the BIND9 package to the fixed versions.
Conclusion
The BIND9 Denial of Service vulnerability allows a remote attacker to disrupt DNS resolution services by exploiting a flaw in the server's handling of DNS queries. To mitigate this vulnerability, it is crucial to upgrade the BIND9 package to the fixed versions. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for bind9 →
FAQ
BIND9 is a DNS server software package that provides domain name resolution services.
The vulnerability allows a remote attacker to cause a denial of service by exploiting a flaw in the server's handling of DNS queries. This can result in the termination of the resolver and a disruption of DNS resolution services.
To fix this vulnerability, upgrade the BIND9 package to the fixed versions: 1:9.8.4.dfsg.P1-6+nmu2+deb7u5 for wheezy and 1:9.9.5.dfsg-9+deb8u1 for jessie.
No, there is no known workaround for this vulnerability. It is necessary to apply the provided fix by upgrading the BIND9 package.
You can find more information about this vulnerability in the Debian Security Advisory DSA-3304-1.
Related vulnerabilities
Recent vulnerabilities recorded for bind9.
