Premature Exit and Assertion Failure in BIND 9 Due to Query-Handling Code Flaw

CVE-2023-5517
7.5HIGH

Key Information

Vendor
Isc
Status
Bind 9
Vendor
CVE Published:
13 February 2024

Badges

👾 Exploit Exists

Summary

A flaw in query-handling code can cause `named` to exit prematurely with an assertion failure when: - `nxdomain-redirect <domain>;` is configured, and - the resolver receives a PTR query for an RFC 1918 address that would normally result in an authoritative NXDOMAIN response. This issue affects BIND 9 versions 9.12.0 through 9.16.45, 9.18.0 through 9.18.21, 9.19.0 through 9.19.19, 9.16.8-S1 through 9.16.45-S1, and 9.18.11-S1 through 9.18.21-S1.

Affected Version(s)

BIND 9 <= 9.16.45

BIND 9 <= 9.18.21

BIND 9 <= 9.19.19

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • 👾

    Exploit exists.

  • Vulnerability published.

  • Vulnerability Reserved.

Collectors

NVD DatabaseMitre Database
.