Stale Data and Assertion Failures in BIND 9 Versions
CVE-2024-4076

7.5HIGH

Key Information:

Vendor
Isc
Status
Bind 9
Vendor
CVE Published:
23 July 2024

Badges

đź‘ľ Exploit Existsđź“° News Worthy

Summary

This vulnerability in BIND 9 arises from a failure in handling client queries that can trigger the serving of stale data. In scenarios where local authoritative zone data is required for lookups, the issue may lead to an assertion failure. This poses a significant concern for users relying on BIND 9 for DNS services. Versions of BIND 9 affected include a range from 9.11.x to 9.19.x, necessitating immediate attention to prevent potential disruptions in service.

Affected Version(s)

BIND 9 9.16.13 <= 9.16.50

BIND 9 9.18.0 <= 9.18.27

BIND 9 9.19.0 <= 9.19.24

News Articles

favicon imageDefend Edge

ISC Releases Security Advisories for BIND 9 - Defend Edge

The Internet Systems Consortium (ISC) released security advisories to address vulnerabilities affecting multiple versions of ISC’s Berkeley Internet Name Domain (BIND) 9. A cyber threat actor could exploit one of these vulnerabilities to cause a denial-of-service condition. CISA encourages users and...

References

https://kb.isc.org/docs/cve-2024-4076
vendor-advisory
http://www.openwall.com/lists/oss-security/2024/07/23/1
http://www.openwall.com/lists/oss-security/2024/07/31/2

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • đź‘ľ

    Exploit known to exist

  • đź“°

    First article discovered by Defend Edge

  • Vulnerability published

  • Vulnerability Reserved

Credit

ISC would like to thank Daniel Stränger for bringing this vulnerability to our attention.
.