CVE-2009-4022: Low severity isc bind 9 vulnerability

Q: What is the severity of CVE-2009-4022?

CVE-2009-4022 has been categorized as a high severity vulnerability that can allow DNS cache poisoning attacks.

Q: How do I fix CVE-2009-4022?

To address CVE-2009-4022, it is recommended to upgrade to a version of BIND that is 9.4.3-P4 or newer.

Q: What systems are affected by CVE-2009-4022?

CVE-2009-4022 affects ISC BIND 9.0.x through 9.3.x, as well as several prior versions including pre-released candidates.

Q: Can CVE-2009-4022 impact DNSSEC validation?

Yes, this vulnerability affects systems with DNSSEC validation enabled but DNSSEC checking disabled.

Q: What are the potential consequences of CVE-2009-4022?

Exploitation of CVE-2009-4022 can lead to unauthorized modifications of DNS records, resulting in possible redirection of users to malicious sites.

Published Nov 19, 2009

Updated

ISC reports a cache poisoning flaw reported by Michael Sinatra of UC Berkeley that may cause bind to cache replies that were not properly DNSSEC validated when recursive query was done based on uncommon client query.

A nameserver with DNSSEC validation enabled may incorrectly add records to its cache from the additional section of responses received during resolution of a recursive client query. This behavior only occurs when processing client queries with checking disabled (CD) at the same time as requesting DNSSEC records (DO).

This issue was reported to affect all 9.x versions and should be fixed in 9.4.3-P4, 9.5.2-P1 and 9.6.1-P2.

Other sources

Unspecified vulnerability in ISC BIND 9.0.x through 9.3.x, 9.4 before 9.4.3-P4, 9.5 before 9.5.2-P1, 9.6 before 9.6.1-P2, and 9.7 beta before 9.7.0b3, with DNSSEC validation enabled and checking disabled (CD), allows remote attackers to conduct DNS cache poisoning attacks by receiving a recursive client query and sending a response that contains an Additional section with crafted data, which is not properly handled when the response is processed "at the same time as requesting DNSSEC records (DO)," aka Bug 20438.

— Red Hat

Affected Software

170 affected componentsFixes available

redhat/bind<30:9.3.6-4.P1.el5_4.1

30:9.3.6-4.P1.el5_4.1

ISC BIND=9.2.0-rc7

ISC BIND=9.1.1-rc6

ISC BIND=9.3.1-rc1

ISC BIND=9.5.0-a6

ISC BIND=9.1.1

ISC BIND=9.4.3-b1

ISC BIND=9.2.3-rc2

ISC BIND=9.1.3

ISC BIND=9.5.1-b2

ISC BIND=9.7.0-rc2

ISC BIND=9.4.3-b2

ISC BIND=9.6.1-rc1

ISC BIND=9.1.1-rc1

ISC BIND=9.1.3-rc3

ISC BIND=9.4.0-b2

ISC BIND=9.3.5

ISC BIND=9.2.0-b2

ISC BIND=9.7.0-b1

ISC BIND=9.3.2-rc1

ISC BIND=9.2.0-a3

ISC BIND=9.7.0-a1

ISC BIND=9.2.3-rc4

ISC BIND=9.7.0-rc1

ISC BIND=9.5.0-p2_w1

ISC BIND=9.2.8

ISC BIND=9.2

ISC BIND=9.3.0-rc4

ISC BIND=9.2.4-rc8

ISC BIND=9.2.1-rc1

ISC BIND=9.3.0-rc2

ISC BIND=9.0.0-rc2

ISC BIND=9.5.0-a3

ISC BIND=9.6.1

ISC BIND=9.4.0-a4

ISC BIND=9.3

ISC BIND=9.3.4

ISC BIND=9.3.0-b2

ISC BIND=9.5.1-rc2

ISC BIND=9.1.0-rc1

ISC BIND=9.2.7-rc1

ISC BIND=9.5.2

ISC BIND=9.0.0-rc1

ISC BIND=9.4.3-p1

ISC BIND=9.2.5

ISC BIND=9.3.2

ISC BIND=9.1.1-rc5

ISC BIND=9.5.0-rc1

ISC BIND=9.2.3-rc3

ISC BIND=9.2.0-rc2

ISC BIND=9.5.2-b1

ISC BIND=9.5.0-p1

ISC BIND=9.2.5-b2

ISC BIND=9.3.6-rc1

ISC BIND=9.3.6

ISC BIND=9.2.2

ISC BIND=9.4.3-p2

ISC BIND=9.6.1-p1

ISC BIND=9.4.1

ISC BIND=9.5.2-rc1

ISC BIND=9.2.0-rc9

ISC BIND=9.4.0-a3

ISC BIND=9.5.0-a1

ISC BIND=9.5.0-b1

ISC BIND=9.0.0-rc3

ISC BIND=9.5.1-b3

ISC BIND=9.2.2-p2

ISC BIND=9.3.3-rc1

ISC BIND=9.2.4-rc6

ISC BIND=9.5.0-a7

ISC BIND=9.7.0-a3

ISC BIND=9.3.0

ISC BIND=9.4.0-rc2

ISC BIND=9.3.0-b3

ISC BIND=9.3.5-rc2

ISC BIND=9.5.0-a2

ISC BIND=9.6.0-p1

ISC BIND=9.5.0-a4

ISC BIND=9.3.3-rc2

ISC BIND=9.2.4-rc7

ISC BIND=9.2.7-rc3

ISC BIND=9.5.0-a5

ISC BIND=9.1.3-rc2

ISC BIND=9.7.0

ISC BIND=9.5.0-p2_w2

ISC BIND=9.7.0-a2

ISC BIND=9.2.7

ISC BIND=9.2.4

ISC BIND=9.7.0-p1

ISC BIND=9.2.5-rc1

ISC BIND=9.2.1

ISC BIND=9.1.2

ISC BIND=9.5.0

ISC BIND=9.1.1-rc4

ISC BIND=9.4.2

ISC BIND=9.4.0-a2

ISC BIND=9.3.1

ISC BIND=9.4.3-b3

ISC BIND=9.2.0-rc4

ISC BIND=9.1.1-rc3

ISC BIND=9.1

ISC BIND=9.6.1-b1

ISC BIND=9.3.3-rc3

ISC BIND=9.2.1-rc2

ISC BIND=9.4.2-rc1

ISC BIND=9.4.0-b4

ISC BIND=9.4.0-b3

ISC BIND=9.2.4-rc2

ISC BIND=9.2.2-p3

ISC BIND=9.6.0-rc2

ISC BIND=9.2.9-rc1

ISC BIND=9.2.7-rc2

ISC BIND=9.4.3

ISC BIND=9.1.3-rc1

ISC BIND=9.2.2-rc1

ISC BIND=9.2.0-rc3

ISC BIND=9.5.0-p2

ISC BIND=9.2.0-rc8

ISC BIND=9.0.1-rc2

ISC BIND=9.2.4-rc3

ISC BIND=9.0.0-rc6

ISC BIND=9.4.0-a1

ISC BIND=9.2.0-rc5

ISC BIND=9.3.5-rc1

ISC BIND=9.3.0-rc1

ISC BIND=9.4.0-a5

ISC BIND=9.3.3

ISC BIND=9.5.0-b3

ISC BIND=9.3.0-b4

ISC BIND=9.4.0-rc1

ISC BIND=9.4.0

ISC BIND=9.5.0-b2

ISC BIND=9.3.0-rc3

ISC BIND=9.2.3

ISC BIND=9.4.3-p3

ISC BIND=9.6.0-rc1

ISC BIND=9.2.0-rc6

ISC BIND=9.2.0-rc10

ISC BIND=9.2.0

ISC BIND=9.2.9

ISC BIND=9.5.1-b1

ISC BIND=9.4.3-rc1

ISC BIND=9.0.1

ISC BIND=9.6.0-a1

ISC BIND=9.4.0-a6

ISC BIND=9.5.1-rc1

ISC BIND=9.2.0-a2

ISC BIND=9.1.1-rc2

ISC BIND=9.4.0-b1

ISC BIND=9.1.2-rc1

ISC BIND=9.2.4-rc4

ISC BIND=9.0.0-rc4

ISC BIND=9.0

ISC BIND=9.2.3-rc1

ISC BIND=9.4.2-rc2

ISC BIND=9.2.0-b1

ISC BIND=9.2.4-rc5

ISC BIND=9.2.0-rc1

ISC BIND=9.0.0-rc5

ISC BIND=9.6.0-b1

ISC BIND=9.2.6-rc1

ISC BIND=9.0.1-rc1

ISC BIND=9.3.1-b2

ISC BIND=9.7.0-b2

ISC BIND=9.1.1-rc7

ISC BIND=9.2.6

ISC BIND=9.2.0-a1

ISC BIND=9.5.1

ISC BIND=9.6.0

ISC BIND=9.7.0-b3

Remediation

Patch Available

https://bugzilla.redhat.com/show_bug.cgi?id=538744

Event History

Nov 19, 2009

Data Sourced

via Red Hat·09:59 AM

DescriptionSeverityAffected Software

Nov 23, 2009

CVE Published

via Red Hat·12:00 AM

Nov 25, 2009

CVE Published

via MITRE·04:00 PM

Data Sourced

via MITRE·04:00 PM

Description

Parent advisories

This vulnerability appears in the following advisories.

RHSA-2009:1620

Frequently Asked Questions

What is the severity of CVE-2009-4022?