CVE-2006-4095 — Reachable Assertion in Bind

CWE-617 — Reachable Assertion9 documents9 sources
Severity
7.5HIGHNVD
EPSS
4.9%
top 10.41%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
5
ISC Bind9Apple MAC OS XApple MAC OS X Server+2 more
Timeline
PublishedSep 6
Latest updateMay 1

Description

BIND before 9.2.6-P1 and 9.3.x before 9.3.2-P1 allows remote attackers to cause a denial of service (crash) via certain SIG queries, which cause an assertion failure when multiple RRsets are returned.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 3.9 | Impact: 3.6

Affected Packages4 packages

▶Debianisc/bind9< 1:9.3.2-P1-1+3
▶NVDisc/bind9.3.0 — 9.3.2+1
▶NVDapple/mac_os_x10.4.0 — 10.4.9+1
▶NVDapple/mac_os_x_server10.4.0 — 10.4.9+1

Also affects: Ubuntu Linux 5.04, 5.10, 6.06

Patches

Patch: www.kb.cert.org ↗Patch: www.niscc.gov.uk ↗Patch: www.kb.cert.org ↗

🔴Vulnerability Details

3
GHSA
GHSA-4vp8-cx5p-gwx4: BIND before 9↗2022-05-01
▶
OSV
CVE-2006-4095: BIND before 9↗2006-09-06
▶
CVEList
CVE-2006-4095: BIND before 9↗2006-09-06
▶

📋Vendor Advisories

4
Ubuntu
bind9 vulnerabilities↗2006-09-08
▶
BSD
FreeBSD-SA-06:20.bind: Denial of Service in named(8)↗2006-09-06
▶
Debian
CVE-2006-4095: bind9 - BIND before 9.2.6-P1 and 9.3.x before 9.3.2-P1 allows remote attackers to cause ...↗2006
▶
Red Hat
CVE-2006-4095: BIND before 9↗
▶

💬Community

1
Bugzilla
CVE-2006-0457 Key syscalls use get length of strings before copying, and assume terminating NUL copied from userspace↗2006-02-17
▶
CVE-2006-4095 — Reachable Assertion in ISC Bind | cvebase