CVE-2019-6477 TCP-pipelined queries can bypass tcp-clients limit
Attackers can cause denial of service in BIND9 by sending TCP-pipelined queries that exhaust server resources, leading to unresponsiveness.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2019-6477?
CVE-2019-6477 is a high-severity denial of service vulnerability in Fedoraproject Fedora, published on 26 Nov 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
With pipelining enabled each incoming query on a TCP connection requires a similar resource allocation to a query received via UDP or via TCP without pipelining enabled. A client using a TCP-pipelined connection to a server could consume more resources than the server has been provisioned to handle. When a TCP connection with a large number of pipelined queries is closed, the load on the server releasing these multiple resources can cause it to become unresponsive, even for queries that can be answered authoritatively or from cache. (This is most likely to be perceived as an intermittent server problem).
Weakness: CWE-400
Which versions are affected by CVE-2019-6477?
It affects 2 products.
Linux distribution packages (38)
bind Red Hat:enterprise_linux:8::appstream | All versions | 32:9.11.13-3.el8 |
bind-chroot Red Hat:enterprise_linux:8::appstream | All versions | 32:9.11.13-3.el8 |
bind-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 32:9.11.13-3.el8 |
bind-debugsource Red Hat:enterprise_linux:8::appstream | All versions | 32:9.11.13-3.el8 |
bind-devel Red Hat:enterprise_linux:8::appstream | All versions | 32:9.11.13-3.el8 |
bind-export-libs-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 32:9.11.13-3.el8 |
bind-libs Red Hat:enterprise_linux:8::appstream | All versions | 32:9.11.13-3.el8 |
bind-libs-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 32:9.11.13-3.el8 |
bind-libs-lite Red Hat:enterprise_linux:8::appstream | All versions | 32:9.11.13-3.el8 |
bind-libs-lite-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 32:9.11.13-3.el8 |
bind-license Red Hat:enterprise_linux:8::appstream | All versions | 32:9.11.13-3.el8 |
bind-lite-devel Red Hat:enterprise_linux:8::appstream | All versions | 32:9.11.13-3.el8 |
bind-pkcs11 Red Hat:enterprise_linux:8::appstream | All versions | 32:9.11.13-3.el8 |
bind-pkcs11-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 32:9.11.13-3.el8 |
bind-pkcs11-devel Red Hat:enterprise_linux:8::appstream | All versions | 32:9.11.13-3.el8 |
bind-pkcs11-libs Red Hat:enterprise_linux:8::appstream | All versions | 32:9.11.13-3.el8 |
bind-pkcs11-libs-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 32:9.11.13-3.el8 |
bind-pkcs11-utils Red Hat:enterprise_linux:8::appstream | All versions | 32:9.11.13-3.el8 |
bind-pkcs11-utils-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 32:9.11.13-3.el8 |
bind-sdb Red Hat:enterprise_linux:8::appstream | All versions | 32:9.11.13-3.el8 |
bind-sdb-chroot Red Hat:enterprise_linux:8::appstream | All versions | 32:9.11.13-3.el8 |
bind-sdb-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 32:9.11.13-3.el8 |
bind-utils Red Hat:enterprise_linux:8::appstream | All versions | 32:9.11.13-3.el8 |
bind-utils-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 32:9.11.13-3.el8 |
python3-bind Red Hat:enterprise_linux:8::appstream | All versions | 32:9.11.13-3.el8 |
bind Red Hat:enterprise_linux:8::baseos | All versions | 32:9.11.13-3.el8 |
bind-debuginfo Red Hat:enterprise_linux:8::baseos | All versions | 32:9.11.13-3.el8 |
bind-debugsource Red Hat:enterprise_linux:8::baseos | All versions | 32:9.11.13-3.el8 |
bind-export-devel Red Hat:enterprise_linux:8::baseos | All versions | 32:9.11.13-3.el8 |
bind-export-libs Red Hat:enterprise_linux:8::baseos | All versions | 32:9.11.13-3.el8 |
bind-export-libs-debuginfo Red Hat:enterprise_linux:8::baseos | All versions | 32:9.11.13-3.el8 |
bind-libs-debuginfo Red Hat:enterprise_linux:8::baseos | All versions | 32:9.11.13-3.el8 |
bind-libs-lite-debuginfo Red Hat:enterprise_linux:8::baseos | All versions | 32:9.11.13-3.el8 |
bind-pkcs11-debuginfo Red Hat:enterprise_linux:8::baseos | All versions | 32:9.11.13-3.el8 |
bind-pkcs11-libs-debuginfo Red Hat:enterprise_linux:8::baseos | All versions | 32:9.11.13-3.el8 |
bind-pkcs11-utils-debuginfo Red Hat:enterprise_linux:8::baseos | All versions | 32:9.11.13-3.el8 |
bind-sdb-debuginfo Red Hat:enterprise_linux:8::baseos | All versions | 32:9.11.13-3.el8 |
bind-utils-debuginfo Red Hat:enterprise_linux:8::baseos | All versions | 32:9.11.13-3.el8 |
Products include Fedoraproject Fedora, Isc Bind.
How do I fix CVE-2019-6477?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2019-6477 being exploited?
There is no known exploitation of CVE-2019-6477 in the wild and no public exploit code.
Other vulnerabilities in Fedoraproject Fedora
Sources
Also known as ALPINE-CVE-2019-6477, DEBIAN-CVE-2019-6477, GHSA-6q2x-892r-7qm4, RHSA-2020:1845, UBUNTU-CVE-2019-6477, USN-4197-1.