REDHAT-BUG-2535477: High severity ISC BIND 9 vulnerability
On a resolver configured to use dns64, if an applicable answer from the authoritative server is malformed in a specific way, the resolver named process will exit unexpectedly. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.
Affected Software
Event History
Frequently Asked Questions
Which deployments are in scope for this issue?
The reported condition applies to BIND 9 resolver deployments where the named process is configured to use dns64 and the installed version falls within one of the listed affected version ranges.
Is a resolver without dns64 configuration identified as affected?
The issue is described specifically for resolvers configured to use dns64. The provided information does not identify resolvers without dns64 configuration as affected.
How can I determine whether a resolver may be vulnerable?
Check whether named is operating as a resolver with dns64 enabled, then compare its BIND 9 version against the affected ranges: 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, or 9.20.9-S1 through 9.20.27-S1.