⚠ Exploited in the wild
Exploitation observed in the wild. Not yet on CISA KEV.

CVE-2009-0696 — Reachable Assertion in Bind

CWE-1612 documents11 sources
Severity
4.3MEDIUMNVD
EPSS
29.5%
top 3.39%
CISA KEV
Not in KEV
Exploit
Exploited in wild
Active exploitation observed
Affected products
2
ISC Bind9ISC Bind
Timeline
PublishedJul 29
Latest updateMay 3

Description

The dns_db_findrdataset function in db.c in named in ISC BIND 9.4 before 9.4.3-P3, 9.5 before 9.5.1-P3, and 9.6 before 9.6.1-P1, when configured as a master server, allows remote attackers to cause a denial of service (assertion failure and daemon exit) via an ANY record in the prerequisite section of a crafted dynamic update message.

CVSS vector

AV:N/AC:M/C:N/I:N/A:PExploitability: 8.6 | Impact: 2.9

Affected Packages2 packages

▶Debianisc/bind9< 1:9.6.1.dfsg.P1-1+3
▶NVDisc/bind10 versions+9

Patches

Patch: www.isc.org ↗Patch: www.isc.org ↗

🔴Vulnerability Details

4
GHSA
GHSA-54q7-wf84-v94r: The dns_db_findrdataset function in db↗2022-05-03
▶
CVEList
CVE-2009-0696: The dns_db_findrdataset function in db↗2009-07-29
▶
OSV
CVE-2009-0696: The dns_db_findrdataset function in db↗2009-07-29
▶
VulnCheck
ISC BIND dns_db_findrdataset Function Denial of Service↗2009
▶

💥Exploits & PoCs

1
Exploit-DB
ISC BIND 9 - Remote Dynamic Update Message Denial of Service (PoC)↗2009-07-30
▶

📋Vendor Advisories

4
Ubuntu
Bind vulnerability↗2009-07-29
▶
BSD
FreeBSD-SA-09:12.bind: BIND named(8) dynamic update message remote DoS↗2009-07-29
▶
Red Hat
bind: DoS (assertion failure) via nsupdate packets↗2009-07-28
▶
Debian
CVE-2009-0696: bind9 - The dns_db_findrdataset function in db.c in named in ISC BIND 9.4 before 9.4.3-P...↗2009
▶

💬Community

2
Bugzilla
CVE-2011-4313 bind: Remote denial of service against recursive servers via logging negative cache entry↗2011-11-16
▶
Bugzilla
CVE-2009-0696 bind: DoS (assertion failure) via nsupdate packets↗2009-07-28
▶
CVE-2009-0696 — Reachable Assertion in ISC Bind | cvebase