CVE-2006-0987

published 2006-03-03

CVE-2006-0987: The default configuration of ISC BIND before 9.4.1-P1, when configured as a caching name server, allows recursive queries and provides additional delegation…

Priority P4 34 medium 5 CVSS 2.0

AV N AC L Au N C N I N A P

EXPLOIT

The default configuration of ISC BIND before 9.4.1-P1, when configured as a caching name server, allows recursive queries and provides additional delegation information to arbitrary IP addresses, which allows remote attackers to cause a denial of service (traffic amplification) via DNS queries with spoofed source IP addresses.

Affected

6 ranges

Vendor	Product	Version range	Fixed in
debian	bind9	< bind9 1:9.4.0-1 (bookworm)	bind9 1:9.4.0-1 (bookworm)
isc	bind	—	—
isc	bind9	>= 0 < 1:9.4.0-1	1:9.4.0-1
isc	bind9	>= 0 < 1:9.4.0-1	1:9.4.0-1
isc	bind9	>= 0 < 1:9.4.0-1	1:9.4.0-1
isc	bind9	>= 0 < 1:9.4.0-1	1:9.4.0-1

Detection & IOCs extracted from sources · hover to see the quote

• → DNS amplification attack vector: detect recursive DNS queries sent to open resolvers with spoofed source IP addresses, particularly high-volume query patterns indicative of traffic amplification abuse. ↗
• → Use the Metasploit auxiliary module dns_amp to scan for DNS servers exposing recursive name lookups that can be abused in amplification attacks. ↗
• → Audit named.conf for absence of 'allow-query { localhost; };' or equivalent ACL restriction — servers without this restriction accepting queries from arbitrary IPs are vulnerable. ↗
• → A recursive name server should only accept queries from local or authorized clients; any BIND caching nameserver in default config (pre-9.4.1-P1) accepting recursive queries from arbitrary IPs is a candidate for amplification abuse. ↗

• · ISC BIND versions before 9.4.1-P1 are vulnerable in their default caching nameserver configuration; the fix is present from 9.4.1-P1 onward. ↗
• · Red Hat Enterprise Linux 5 and 6 ship BIND with 'allow-query { localhost; };' in named.conf by default, making those specific packages NOT vulnerable even without patching. ↗
• · This vulnerability is inherent to DNS design and cannot be fixed at the protocol level; rate-limiting patches (e.g., from redbarn.org/dns/ratelimits) are the recommended mitigation for non-default configurations. ↗

CVSS provenance

nvd v2.0 5.0 MEDIUM AV:N/AC:L/Au:N/C:N/I:N/A:P

osv 5.0 MEDIUM

vendor_debian 5.0 LOW

vendor_redhat 5.0 MEDIUM

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.