CVE-2011-0414: High severity isc bind 9 vulnerability
ISC BIND 9.7.1 through 9.7.2-P3, when configured as an authoritative server, allows remote attackers to cause a denial of service (deadlock and daemon hang) by sending a query at the time of (1) an IXFR transfer or (2) a DDNS update.
Other sources
It was reported [1] that when the BIND authoritative name server daemon (named) processed a successful IXFR transfer or a dynamic update, there was a small period of time during which the IXFR/update, along with a query, could cause the server to stop processing all requests. A higher update and/or query rate would increase the probability of the deadlock occurring.
This flaw only affects BIND 9.7.1 and 9.7.2; upstream has released 9.7.3 to correct this flaw. Upstream also documents that using the "-n1" option to cause named to use only one worker thread would mitigate this problem.
[1] https://www.isc.org/software/bind/advisories/cve-2011-0414
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2011-0414?
CVE-2011-0414 has a severity rating of moderate as it can lead to denial of service for authoritative servers.
How do I fix CVE-2011-0414?
To fix CVE-2011-0414, upgrade to BIND versions 9.7.3 or later, or apply the relevant patches provided by ISC.
What systems are affected by CVE-2011-0414?
CVE-2011-0414 affects BIND versions 9.7.1 through 9.7.2-P3 when configured as an authoritative server.
What type of attack does CVE-2011-0414 facilitate?
CVE-2011-0414 allows remote attackers to cause a denial of service through specific timing attacks during IXFR transfers or DDNS updates.
Is CVE-2011-0414 a local or remote vulnerability?
CVE-2011-0414 is a remote vulnerability, allowing attackers to exploit the issue without local access to the server.