Latest isc bind Vulnerabilities

Unbound: disclosure of CVE-2023-50387 and CVE-2023-50868 DNSSEC validation vulnerabilities
Microsoft Windows Server 2008 R2
Microsoft Windows Server 2022
Microsoft Windows Server 2012
Microsoft Windows Server 2012 R2
Microsoft Windows Server 2022, 23H2 Edition
Microsoft Windows Server 2022
and 56 more
named may terminate unexpectedly under high DNS-over-TLS query load
debian/bind9<=1:9.18.16-1~deb12u1<=1:9.18.16-1
ISC BIND>=9.18.0<9.18.18
ISC BIND=9.18.11-s1
ISC BIND=9.18.18-s1
debian/bind9
ubuntu/bind9<1:9.18.12-0ubuntu0.22.04.3
and 18 more
A stack exhaustion flaw in control channel code may cause named to terminate unexpectedly
debian/bind9<=1:9.18.16-1<=1:9.18.16-1~deb12u1<=1:9.16.42-1~deb11u1<=1:9.16.37-1~deb11u1
ISC BIND>=9.2.0<9.16.44
ISC BIND>=9.18.0<9.18.19
ISC BIND>=9.19.0<9.19.17
ISC BIND=9.9.3-s1
ISC BIND=9.9.12-s1
and 46 more
A `named` instance configured to run as a DNSSEC-validating recursive resolver with the Aggressive Use of DNSSEC-Validated Cache (RFC 8198) option (`synth-from-dnssec`) enabled can be remotely termina...
ISC BIND>=9.16.8<=9.16.41
ISC BIND>=9.18.11<=9.18.15
Netapp Active Iq Unified Manager Vmware Vsphere
Netapp H500s Firmware
Netapp H500s
Netapp H700s Firmware
and 7 more
If the `recursive-clients` quota is reached on a BIND 9 resolver configured with both `stale-answer-enable yes;` and `stale-answer-client-timeout 0;`, a sequence of serve-stale-related lookups could c...
ubuntu/bind9<1:9.16.1-0ubuntu2.15
ubuntu/bind9<1:9.18.12-0ubuntu0.22.04.2
ubuntu/bind9<1:9.18.12-0ubuntu0.22.10.2
ubuntu/bind9<1:9.18.12-1ubuntu1.1
ubuntu/bind9<9.16.42<9.18.16
ubuntu/bind9<1:9.18.12-1ubuntu2
and 30 more
ISC BIND is vulnerable to a denial of service, caused by a flaw that allows the named's configured cache size limit to be significantly exceeded. By querying the resolver for specific RRsets in a cert...
IBM QRadar SIEM<=7.5.0 - 7.5.0 UP6
ubuntu/bind9<1:9.11.3+dfsg-1ubuntu1.19+
ubuntu/bind9<1:9.9.5.dfsg-3ubuntu0.19+
ubuntu/bind9<1:9.10.3.dfsg.
ubuntu/bind9<1:9.16.1-0ubuntu2.15
ubuntu/bind9<1:9.18.12-0ubuntu0.22.04.2
and 39 more
Processing of repeated responses to the same query, where both responses contain ECS pseudo-options, but where the first is broken in some way, can cause BIND to exit with an assertion failure. 'Broke...
ISC BIND=9.11.4-s1
ISC BIND=9.11.37-s1
ISC BIND=9.16.8-s1
ISC BIND=9.16.36-s1
This issue can affect BIND 9 resolvers with `stale-answer-enable yes;` that also make use of the option `stale-answer-client-timeout`, configured with a value greater than zero. If the resolver receiv...
redhat/bind9.16<32:9.16.23-0.14.el8
redhat/bind<32:9.16.23-11.el9
ISC BIND>=9.16.12<9.16.37
ISC BIND>=9.18.0<9.18.11
ISC BIND>=9.19.0<9.19.9
ISC BIND=9.16.12-s1
and 5 more
BIND 9 resolver can crash when stale cache and stale answers are enabled, option `stale-answer-client-timeout` is set to a positive integer, and the resolver receives an RRSIG query. This issue affect...
redhat/bind<9.16.37
redhat/bind<9.18.11
redhat/bind<9.19.9
redhat/bind9.16<32:9.16.23-0.14.el8
redhat/bind<32:9.16.23-11.el9
ISC BIND>=9.16.12<9.16.37
and 8 more
A flaw was found in Bind, where sending a flood of dynamic DNS updates may cause named to allocate large amounts of memory. This issue may cause named to exit due to a lack of free memory, resulting i...
redhat/bind9.16<32:9.16.23-0.14.el8
redhat/bind<32:9.16.23-11.el9
ISC BIND>=9.16.0<9.16.37
ISC BIND>=9.18.0<9.18.11
ISC BIND>=9.19.0<9.19.9
ISC BIND=9.16.8-s1
and 6 more
An attacker can leverage this flaw to gradually erode available memory to the point where named crashes for lack of resources. Upon restart the attacker would have to begin again, but nevertheless the...
ISC BIND>=9.18.0<9.18.7
ISC BIND>=9.19.0<9.19.5
By spoofing the target resolver with responses that have a malformed ECDSA signature, an attacker can trigger a small memory leak. It is possible to gradually erode available memory to the point where...
redhat/bind<32:9.11.4-26.P2.el7_9.10
redhat/bind<32:9.11.36-3.el8_6.1
redhat/bind9.16<32:9.16.23-0.7.el8_6.1
redhat/bind<32:9.11.4-26.P2.el8_1.6
redhat/bind<32:9.11.13-6.el8_2.4
redhat/bind<32:9.11.26-4.el8_4.1
and 37 more
By sending specific queries to the resolver, an attacker can cause named to crash.
ISC BIND>=9.16.14<9.16.33
ISC BIND>=9.18.0<9.18.7
ISC BIND>=9.19.0<9.19.5
ISC BIND=9.16.14-s1
ISC BIND=9.16.21-s1
ISC BIND=9.16.32-s1
and 6 more
By spoofing the target resolver with responses that have a malformed EdDSA signature, an attacker can trigger a small memory leak. It is possible to gradually erode available memory to the point where...
redhat/bind<32:9.11.4-26.P2.el7_9.10
redhat/bind<32:9.11.36-3.el8_6.1
redhat/bind9.16<32:9.16.23-0.7.el8_6.1
redhat/bind<32:9.11.4-26.P2.el8_1.6
redhat/bind<32:9.11.13-6.el8_2.4
redhat/bind<32:9.11.26-4.el8_4.1
and 35 more
By flooding the target resolver with queries exploiting this flaw an attacker can significantly impair the resolver's performance, effectively denying legitimate clients access to the DNS resolution s...
redhat/bind<32:9.11.4-26.P2.el7_9.13
redhat/bind9.16<32:9.16.23-0.14.el8
redhat/bind<32:9.11.36-8.el8
redhat/bind<32:9.16.23-11.el9
debian/bind9<=1:9.11.5.P4+dfsg-5.1+deb10u7
redhat/bind<9.16.33
and 37 more
On vulnerable configurations, the named daemon may, in some circumstances, terminate with an assertion failure. Vulnerable configurations are those that include a reference to http within the listen-o...
ISC BIND>=9.18.0<=9.18.2
ISC BIND=9.19.0
Netapp H410c Firmware
Netapp H410c
Netapp H300s Firmware
Netapp H300s
and 6 more
Versions affected: BIND 9.18.0 When a vulnerable version of named receives a series of specific queries, the named process will eventually terminate due to a failed assertion check.
ISC BIND=9.18.0
Netapp Baseboard Management Controller H300s Firmware
Netapp Baseboard Management Controller H300s
Netapp Baseboard Management Controller H500s Firmware
Netapp Baseboard Management Controller H500s
Netapp Baseboard Management Controller H700s Firmware
and 27 more
When the vulnerability is triggered the BIND process will exit. BIND 9.18.0
ISC BIND=9.18.0
Netapp Baseboard Management Controller H300s Firmware
Netapp Baseboard Management Controller H300s
Netapp Baseboard Management Controller H500s Firmware
Netapp Baseboard Management Controller H500s
Netapp Baseboard Management Controller H700s Firmware
and 27 more
BIND 9.16.11 -> 9.16.26, 9.17.0 -> 9.18.0 and versions 9.16.11-S1 -> 9.16.26-S1 of the BIND Supported Preview Edition. Specifically crafted TCP streams can cause connections to BIND to remain in CLOSE...
redhat/bind9.16<32:9.16.23-0.9.el8.1
redhat/bind<32:9.16.23-5.el9_1
ISC BIND>=9.16.11<9.16.27
ISC BIND>=9.16.11<9.16.27
ISC BIND>=9.17.0<=9.18.0
Fedoraproject Fedora=34
and 39 more
BIND 9.11.0 -> 9.11.36 9.12.0 -> 9.16.26 9.17.0 -> 9.18.0 BIND Supported Preview Editions: 9.11.4-S1 -> 9.11.36-S1 9.16.8-S1 -> 9.16.26-S1 Versions of BIND 9 earlier than those shown - back to 9.1.0, ...
redhat/bind<32:9.11.4-26.P2.el7_9.13
redhat/bind9.16<32:9.16.23-0.9.el8.1
redhat/bind<32:9.11.36-5.el8
redhat/bind<32:9.16.23-5.el9_1
redhat/dhcp<12:4.4.2-17.b1.el9
ISC BIND>=9.11.0<9.11.37
and 184 more
In BIND 9.3.0 -> 9.11.35, 9.12.0 -> 9.16.21, and versions 9.9.3-S1 -> 9.11.35-S1 and 9.16.8-S1 -> 9.16.21-S1 of BIND Supported Preview Edition, as well as release versions 9.17.0 -> 9.17.18 of the BIN...
debian/bind9
ISC BIND>=9.3.0<9.11.36
ISC BIND>=9.12.0<9.16.22
ISC BIND>=9.17.0<9.17.19
ISC BIND=9.9.3-s1
ISC BIND=9.9.12-s1
and 46 more
ISC BIND TKEY Query Integer Overflow Remote Code Execution Vulnerability
debian/bind9
ISC BIND
debian/bind9<=1:9.11.5.P4+dfsg-5.1<=1:9.11.5.P4+dfsg-5.1+deb10u3<=1:9.16.13-1
Debian Debian Linux=9.0
Debian Debian Linux=10.0
ISC BIND>=9.0.0<9.11.31
and 42 more
In BIND 9.0.0 -> 9.11.29, 9.12.0 -> 9.16.13, and versions BIND 9.9.3-S1 -> 9.11.29-S1 and 9.16.8-S1 -> 9.16.13-S1 of BIND Supported Preview Edition, as well as release versions 9.17.0 -> 9.17.11 of th...
debian/bind9<=1:9.11.5.P4+dfsg-5.1+deb10u3<=1:9.11.5.P4+dfsg-5.1<=1:9.16.13-1
IBM Cloud Pak for Security (CP4S)<=1.7.2.0
IBM Cloud Pak for Security (CP4S)<=1.7.1.0
IBM Cloud Pak for Security (CP4S)<=1.7.0.0
debian/bind9
Debian Debian Linux=9.0
and 47 more
In BIND 9.8.5 -> 9.8.8, 9.9.3 -> 9.11.29, 9.12.0 -> 9.16.13, and versions BIND 9.9.3-S1 -> 9.11.29-S1 and 9.16.8-S1 -> 9.16.13-S1 of BIND 9 Supported Preview Edition, as well as release versions 9.17....
debian/bind9
debian/bind9<=1:9.11.5.P4+dfsg-5.1<=1:9.16.13-1<=1:9.11.5.P4+dfsg-5.1+deb10u3
IBM Cloud Pak for Security (CP4S)<=1.7.2.0
IBM Cloud Pak for Security (CP4S)<=1.7.1.0
IBM Cloud Pak for Security (CP4S)<=1.7.0.0
ISC BIND>=9.8.5<=9.8.8
and 47 more
ISC BIND TKEY Query Heap-based Buffer Overflow Remote Code Execution Vulnerability
debian/bind9
debian/bind9<=1:9.11.5.P4+dfsg-5.1+deb10u2<=1:9.11.5.P4+dfsg-5.1<=1:9.16.11-2
ISC BIND
ISC BIND>=9.5.0<=9.11.27
ISC BIND>=9.12.0<=9.16.11
ISC BIND=9.11.3-s1
and 25 more
In BIND 9.10.0 -> 9.11.21, 9.12.0 -> 9.16.5, 9.17.0 -> 9.17.3, also affects 9.10.5-S1 -> 9.11.21-S1 of the BIND 9 Supported Preview Edition, An attacker that can reach a vulnerable system with a speci...
ISC BIND>=9.10.0<=9.11.21
ISC BIND>=9.12.1<=9.16.5
ISC BIND>=9.17.0<=9.17.3
ISC BIND=9.10.5-s1
ISC BIND=9.11.21-s1
Fedoraproject Fedora=31
and 14 more
In BIND 9.0.0 -> 9.11.21, 9.12.0 -> 9.16.5, 9.17.0 -> 9.17.3, also affects 9.9.3-S1 -> 9.11.21-S1 of the BIND 9 Supported Preview Edition, An attacker on the network path for a TSIG-signed request, or...
IBM Cloud Pak for Security (CP4S)<=1.7.2.0
IBM Cloud Pak for Security (CP4S)<=1.7.1.0
IBM Cloud Pak for Security (CP4S)<=1.7.0.0
ISC BIND>=9.0.0<=9.11.21
ISC BIND>=9.12.0<=9.16.5
ISC BIND>=9.17.0<=9.17.3
and 21 more
In BIND 9.15.6 -> 9.16.5, 9.17.0 -> 9.17.3, An attacker who can establish a TCP connection with the server and send data on that connection can exploit this to trigger the assertion failure, causing t...
ISC BIND>=9.15.6<=9.16.5
ISC BIND>=9.17.0<=9.17.3
ISC BIND=9.9.12-s1
ISC BIND=9.9.13-s1
ISC BIND=9.11.3-s1
ISC BIND=9.11.21-s1
and 8 more
In BIND 9.14.0 -> 9.16.5, 9.17.0 -> 9.17.3, If a server is configured with both QNAME minimization and 'forward first' then an attacker who can send queries to it may be able to trigger the condition ...
ISC BIND>=9.14.0<=9.16.5
ISC BIND>=9.17.0<=9.17.3
openSUSE Leap=15.1
openSUSE Leap=15.2
Canonical Ubuntu Linux=16.04
Canonical Ubuntu Linux=18.04
and 5 more
In BIND 9.9.12 -> 9.9.13, 9.10.7 -> 9.10.8, 9.11.3 -> 9.11.21, 9.12.1 -> 9.16.5, 9.17.0 -> 9.17.3, also affects 9.9.12-S1 -> 9.9.13-S1, 9.11.3-S1 -> 9.11.21-S1 of the BIND 9 Supported Preview Edition,...
IBM Cloud Pak for Security (CP4S)<=1.7.2.0
IBM Cloud Pak for Security (CP4S)<=1.7.1.0
IBM Cloud Pak for Security (CP4S)<=1.7.0.0
ISC BIND>=9.9.12<=9.9.13
ISC BIND>=9.10.7<=9.10.8
ISC BIND>=9.11.3<=9.11.21
and 18 more
An attacker who is permitted to send zone data to a server via zone transfer can exploit this to intentionally trigger the assertion failure with a specially constructed zone, denying service to clien...
ISC BIND>=9.16.0<=9.16.3
openSUSE Leap=15.1
openSUSE Leap=15.2
Netapp Steelstore Cloud Integrated Storage
Canonical Ubuntu Linux=20.04
ubuntu/bind9<1:9.16.1-0ubuntu2.2
and 2 more
In ISC BIND9 versions BIND 9.11.14 -> 9.11.19, BIND 9.14.9 -> 9.14.12, BIND 9.16.0 -> 9.16.3, BIND Supported Preview Edition 9.11.14-S1 -> 9.11.19-S1: Unless a nameserver is providing authoritative se...
ISC BIND>=9.11.14<=9.11.19
ISC BIND>=9.11.14-s1<=9.11.19-s1
ISC BIND>=9.14.9<=9.14.12
ISC BIND>=9.16.0<=9.16.3
Fedoraproject Fedora=31
Fedoraproject Fedora=32
and 8 more
ISC BIND is vulnerable to a denial of service, caused by a logic error in code which checks TSIG validity. A remote attacker could exploit this vulnerability to trigger an assertion failure in tsig.c.
IBM Cloud Pak for Security (CP4S)<=1.7.2.0
IBM Cloud Pak for Security (CP4S)<=1.7.1.0
IBM Cloud Pak for Security (CP4S)<=1.7.0.0
ISC BIND>=9.0.0<=9.11.18
ISC BIND>=9.12.0<=9.12.4
ISC BIND>=9.13.0<=9.13.7
and 34 more
A malicious actor who intentionally exploits this lack of effective limitation on the number of fetches performed when processing referrals can, through the use of specially crafted referrals, cause a...
ISC BIND>=9.0.0<=9.11.18
ISC BIND>=9.12.0<=9.12.4
ISC BIND>=9.13.0<=9.13.7
ISC BIND>=9.14.0<=9.14.11
ISC BIND>=9.15.0<=9.15.6
ISC BIND>=9.16.0<=9.16.2
and 20 more
ISC BIND is vulnerable to a denial of service. By sending TCP-pipelined queries, a remote attacker could exploit this vulnerability to bypass tcp-clients limit and cause the server to consume all avai...
debian/bind9<=1:9.15.5-1<=1:9.11.5.P4+dfsg-1<=1:9.11.5.P4+dfsg-5.1
IBM Data Risk Manager<=2.0.6
ISC BIND>=9.11.7<=9.11.12
ISC BIND>=9.14.1<=9.14.7
ISC BIND>=9.15.0<=9.15.5
ISC BIND=9.11.5-s6
and 11 more
Cache Poisoning issue exists in DNS Response Rate Limiting.
ISC BIND>=9.8.0<=9.9.0
Nlnetlabs Nsd=3.2.15
Nic Knot Resolver<1.3.0
Redhat Enterprise Linux=6.0
Redhat Enterprise Linux=7.0
While backporting a feature for a newer branch of BIND9, RedHat introduced a path leading to an assertion failure in buffer.c:420. Affects RedHat versions bind-9.9.4-65.el7 -> bind-9.9.4-72.el7. No IS...
ISC BIND>=9.9.4-65<=9.9.4-72
Redhat Enterprise Linux=7.0
A defect in code added to support QNAME minimization can cause named to exit with an assertion failure if a forwarder returns a referral rather than resolving the query. This affects BIND versions 9.1...
ISC BIND>=9.14.0<=9.14.6
ISC BIND>=9.15.0<=9.15.4
Mirror zones are a BIND feature allowing recursive servers to pre-cache zone data provided by other servers. A mirror zone is similar to a zone of type secondary, except that its data is subject to DN...
ISC BIND>=9.14.0<=9.14.6
ISC BIND>=9.15.0<=9.15.4
An error in the EDNS Client Subnet (ECS) feature for recursive resolvers can cause BIND to exit with an assertion failure when processing a response that has malformed RRSIGs. Versions affected: BIND ...
ISC BIND=9.10.5-s1
ISC BIND=9.11.6-s1
A race condition which may occur when discarding malformed packets can result in BIND exiting due to a REQUIRE assertion failure in dispatch.c. Versions affected: BIND 9.11.0 -> 9.11.7, 9.12.0 -> 9.12...
F5 Big-ip Local Traffic Manager>=11.5.2<=11.5.9
F5 Big-ip Local Traffic Manager>=11.6.1<=11.6.4
F5 Big-ip Local Traffic Manager>=12.1.0<=12.1.4
F5 Big-ip Local Traffic Manager>=13.1.0<=13.1.1
F5 Big-ip Local Traffic Manager=14.0.0
F5 Big-ip Local Traffic Manager=14.1.0
and 103 more
ISC BIND=9.10.5-s1
ISC BIND=9.11.5-s5
A programming error in the nxdomain-redirect feature can cause an assertion failure in query.c if the alternate namespace used by nxdomain-redirect is a descendant of a zone that is served locally. Th...
ISC BIND>=9.12.0<=9.12.4
ISC BIND>=9.13.0<=9.13.7
ISC BIND=9.14.0
By design, BIND is intended to limit the number of TCP clients that can be connected at any given time. The number of allowed connections is a tunable parameter which, if unset, defaults to a conserva...
F5 Big-ip Local Traffic Manager>=11.5.2<=11.6.5
F5 Big-ip Local Traffic Manager>=12.1.0<=12.1.4
F5 Big-ip Local Traffic Manager>=13.0.0<=13.1.1
F5 Big-ip Local Traffic Manager>=14.0.0<=14.1.0
F5 Big-ip Local Traffic Manager=15.0.0
F5 Big-ip Application Acceleration Manager>=11.5.2<=11.6.5
and 73 more
A failure to free memory can occur when processing messages having a specific combination of EDNS options. Versions affected are: BIND 9.10.7 -> 9.10.8-P1, 9.11.3 -> 9.11.5-P1, 9.12.0 -> 9.12.3-P1, an...
ISC BIND>=9.10.7<9.10.8
ISC BIND>=9.11.3<9.11.5
ISC BIND>=9.12.0<9.12.3
ISC BIND>=9.13.0<9.13.6
ISC BIND=9.10.7-s1
ISC BIND=9.10.8
and 10 more
ISC BIND could allow a remote attacker to obtain sensitive information, caused by the failure to properly apply controls for zone transfers to Dynamically Loadable Zones (DLZs) if the zones are writab...
IBM Data Risk Manager<=2.0.6
redhat/bind<9.11.5
redhat/bind<9.12.3
ISC BIND>=9.9.0<=9.10.7
ISC BIND>=9.11.0<=9.11.4
ISC BIND>=9.12.0<=9.12.2
and 12 more
ISC BIND is vulnerable to a denial of service, caused by an error in the managed-keys feature. By replacing a trust anchor&#39;s keys with keys which use an unsupported algorithm, a remote authenticat...
IBM Data Risk Manager<=2.0.6
redhat/bind<9.11.5
redhat/bind<9.12.3
ISC BIND>=9.9.0<=9.10.7
ISC BIND>=9.11.0<=9.11.4
ISC BIND>=9.12.0<=9.12.2
and 9 more
If named is configured to use Response Policy Zones (RPZ) an error processing some rule types can lead to a condition where BIND will endlessly loop while handling a query. Affects BIND 9.9.10, 9.10.5...
ISC BIND>=9.11.0<=9.11.1
ISC BIND=9.9.10
ISC BIND=9.9.10-s1
ISC BIND=9.10.5
ISC BIND=9.10.5-s1
Netapp Data Ontap Edge
and 2 more
The BIND installer on Windows uses an unquoted service path which can enable a local user to achieve privilege escalation if the host file system permissions allow this. Affects BIND 9.2.6-P2->9.2.9, ...
ISC BIND>=9.2.6<=9.2.9
ISC BIND>=9.3.2<=9.3.6
ISC BIND>=9.4.0<=9.8.8
ISC BIND>=9.9.0<=9.9.10
ISC BIND>=9.10.0<=9.10.5
ISC BIND>=9.11.0<=9.11.1
and 2 more
While handling a particular type of malformed packet BIND erroneously selects a SERVFAIL rcode instead of a FORMERR rcode. If the receiving view has the SERVFAIL cache feature enabled, this can trigge...
ISC BIND=9.10.5-s1
ISC BIND=9.10.5-s4
ISC BIND=9.10.6-s1
ISC BIND=9.10.6-s2
Netapp Data Ontap Edge
Netapp Solidfire Element Os Management Node

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2024 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203