REDHAT-BUG-2535466: High severity Internet Systems Consortium BIND 9 vulnerability
If a BIND resolver sends a query for a DNSSEC-signed authoritative zone, and the authoritative server replies with a valid wildcard answer and signed NSEC3 proof, followed by an unsigned NSEC at the same owner name, it will trigger an unexpected program exit. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.
Affected Software
Event History
Frequently Asked Questions
Which BIND deployments are exposed to this issue?
The affected component is the BIND resolver. The issue applies to BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.
What response conditions are needed to trigger the failure?
A resolver must query a DNSSEC-signed authoritative zone and receive a valid wildcard answer with signed NSEC3 proof, followed by an unsigned NSEC record at the same owner name. Under those conditions, the resolver can exit unexpectedly.
How can I determine whether an instance is potentially affected?
Confirm that the instance is operating as a resolver and compare its BIND 9 version against the listed affected ranges. The issue is relevant when that resolver can receive the specified DNSSEC wildcard and NSEC/NSEC3 response sequence.