CVE-2019-6467 An error in the nxdomain redirect feature can cause BIND to exit with an INSIST assertion failure in query.c
A programming error in BIND's nxdomain-redirect feature causes an assertion failure and server crash when specific zone configurations are used.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2019-6467?
CVE-2019-6467 is a medium-severity denial of service vulnerability in Isc Bind, published on 9 Oct 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A programming error in the nxdomain-redirect feature can cause an assertion failure in query.c if the alternate namespace used by nxdomain-redirect is a descendant of a zone that is served locally. The most likely scenario where this might occur is if the server, in addition to performing NXDOMAIN redirection for recursive clients, is also serving a local copy of the root zone or using mirroring to provide the root zone, although other configurations are also possible. Versions affected: BIND 9.12.0-> 9.12.4, 9.14.0. Also affects all releases in the 9.13 development branch.
Weakness: CWE-617
Which versions are affected by CVE-2019-6467?
It affects 1 product.
Products include Isc Bind.
How do I fix CVE-2019-6467?
Upgrade to a fixed version.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2019-6467 being exploited?
There is no known exploitation of CVE-2019-6467 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in Isc Bind
Sources
Also known as ALPINE-CVE-2019-6467, GHSA-92q8-7pjj-mpmp.