CVE-2011-2464 Denial of service in n/a

Medium 5.0 Published 8 Jul 2011 Updated 6 Aug 2024

Remote attackers can crash the ISC BIND DNS server daemon by sending a crafted UPDATE request, causing a denial of service.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2011-2464?

CVE-2011-2464 is a medium-severity denial of service vulnerability in Isc Bind, published on 8 Jul 2011. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Unspecified vulnerability in ISC BIND 9 9.6.x before 9.6-ESV-R4-P3, 9.7.x before 9.7.3-P3, and 9.8.x before 9.8.0-P4 allows remote attackers to cause a denial of service (named daemon crash) via a crafted UPDATE request.

Which versions are affected by CVE-2011-2464?

It affects 1 product.

Linux distribution packages (13)

`bind97` Red Hat:enterprise_linux:5::server	All versions	`32:9.7.0-6.P2.el5_6.3`
`bind97-chroot` Red Hat:enterprise_linux:5::server	All versions	`32:9.7.0-6.P2.el5_6.3`
`bind97-debuginfo` Red Hat:enterprise_linux:5::server	All versions	`32:9.7.0-6.P2.el5_6.3`
`bind97-devel` Red Hat:enterprise_linux:5::server	All versions	`32:9.7.0-6.P2.el5_6.3`
`bind97-libs` Red Hat:enterprise_linux:5::server	All versions	`32:9.7.0-6.P2.el5_6.3`
`bind97-utils` Red Hat:enterprise_linux:5::server	All versions	`32:9.7.0-6.P2.el5_6.3`
`bind` Red Hat:enterprise_linux:6::server	All versions	`32:9.7.3-2.el6_1.P3.2`
`bind-chroot` Red Hat:enterprise_linux:6::server	All versions	`32:9.7.3-2.el6_1.P3.2`
`bind-debuginfo` Red Hat:enterprise_linux:6::server	All versions	`32:9.7.3-2.el6_1.P3.2`
`bind-devel` Red Hat:enterprise_linux:6::server	All versions	`32:9.7.3-2.el6_1.P3.2`
`bind-libs` Red Hat:enterprise_linux:6::server	All versions	`32:9.7.3-2.el6_1.P3.2`
`bind-sdb` Red Hat:enterprise_linux:6::server	All versions	`32:9.7.3-2.el6_1.P3.2`
`bind-utils` Red Hat:enterprise_linux:6::server	All versions	`32:9.7.3-2.el6_1.P3.2`

Products include Isc Bind.

How do I fix CVE-2011-2464?

Upgrade to a fixed version.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2011-2464 being exploited?

There is no known exploitation of CVE-2011-2464 in the wild and no public exploit code.

All Isc Bind vulnerabilities

Sources

Also known as DEBIAN-CVE-2011-2464, DSA-2272-1, GHSA-pgw8-84wx-gr5w, RHSA-2011:0926.